1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (C) 2023 Google Corporation
4 */
5
6 #include <linux/devcoredump.h>
7
8 #include <linux/unaligned.h>
9 #include <net/bluetooth/bluetooth.h>
10 #include <net/bluetooth/hci_core.h>
11
12 enum hci_devcoredump_pkt_type {
13 HCI_DEVCOREDUMP_PKT_INIT,
14 HCI_DEVCOREDUMP_PKT_SKB,
15 HCI_DEVCOREDUMP_PKT_PATTERN,
16 HCI_DEVCOREDUMP_PKT_COMPLETE,
17 HCI_DEVCOREDUMP_PKT_ABORT,
18 };
19
20 struct hci_devcoredump_skb_cb {
21 u16 pkt_type;
22 };
23
24 struct hci_devcoredump_skb_pattern {
25 u8 pattern;
26 u32 len;
27 } __packed;
28
29 #define hci_dmp_cb(skb) ((struct hci_devcoredump_skb_cb *)((skb)->cb))
30
31 #define DBG_UNEXPECTED_STATE() \
32 bt_dev_dbg(hdev, \
33 "Unexpected packet (%d) for state %s.", \
34 hci_dmp_cb(skb)->pkt_type, \
35 hci_devcd_state_name(hdev->dump.state))
36
hci_devcd_update_hdr_state(char * buf,size_t size,int state)37 static int hci_devcd_update_hdr_state(char *buf, size_t size, int state)
38 {
39 int len = 0;
40
41 if (!buf)
42 return 0;
43
44 len = scnprintf(buf, size, "Bluetooth devcoredump\nState: %d\n", state);
45
46 return len + 1; /* scnprintf adds \0 at the end upon state rewrite */
47 }
48
49 /* Call with hci_dev_lock only. */
hci_devcd_update_state(struct hci_dev * hdev,int state)50 static int hci_devcd_update_state(struct hci_dev *hdev, int state)
51 {
52 bt_dev_dbg(hdev, "Updating devcoredump state from %s to %s.",
53 hci_devcd_state_name(hdev->dump.state),
54 hci_devcd_state_name(state));
55
56 hdev->dump.state = state;
57
58 return hci_devcd_update_hdr_state(hdev->dump.head,
59 hdev->dump.alloc_size, state);
60 }
61
hci_devcd_mkheader(struct hci_dev * hdev,struct sk_buff * skb)62 static int hci_devcd_mkheader(struct hci_dev *hdev, struct sk_buff *skb)
63 {
64 char hdr[80];
65 int hdr_len;
66
67 hdr_len = hci_devcd_update_hdr_state(hdr, sizeof(hdr),
68 HCI_DEVCOREDUMP_IDLE);
69 skb_put_data(skb, hdr, hdr_len);
70
71 if (hdev->dump.dmp_hdr)
72 hdev->dump.dmp_hdr(hdev, skb);
73
74 skb_put_data(skb, HCI_DEVCD_HDR_END_MARKER, strlen(HCI_DEVCD_HDR_END_MARKER));
75
76 return skb->len;
77 }
78
79 /* Do not call with hci_dev_lock since this calls driver code. */
hci_devcd_notify(struct hci_dev * hdev,int state)80 static void hci_devcd_notify(struct hci_dev *hdev, int state)
81 {
82 if (hdev->dump.notify_change)
83 hdev->dump.notify_change(hdev, state);
84 }
85
86 /* Call with hci_dev_lock only. */
hci_devcd_reset(struct hci_dev * hdev)87 void hci_devcd_reset(struct hci_dev *hdev)
88 {
89 hdev->dump.head = NULL;
90 hdev->dump.tail = NULL;
91 hdev->dump.alloc_size = 0;
92
93 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE);
94
95 cancel_delayed_work(&hdev->dump.dump_timeout);
96 skb_queue_purge(&hdev->dump.dump_q);
97 }
98
99 /* Call with hci_dev_lock only. */
hci_devcd_free(struct hci_dev * hdev)100 static void hci_devcd_free(struct hci_dev *hdev)
101 {
102 vfree(hdev->dump.head);
103
104 hci_devcd_reset(hdev);
105 }
106
107 /* Call with hci_dev_lock only. */
hci_devcd_alloc(struct hci_dev * hdev,u32 size)108 static int hci_devcd_alloc(struct hci_dev *hdev, u32 size)
109 {
110 hdev->dump.head = vmalloc(size);
111 if (!hdev->dump.head)
112 return -ENOMEM;
113
114 hdev->dump.alloc_size = size;
115 hdev->dump.tail = hdev->dump.head;
116 hdev->dump.end = hdev->dump.head + size;
117
118 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE);
119
120 return 0;
121 }
122
123 /* Call with hci_dev_lock only. */
hci_devcd_copy(struct hci_dev * hdev,char * buf,u32 size)124 static bool hci_devcd_copy(struct hci_dev *hdev, char *buf, u32 size)
125 {
126 if (hdev->dump.tail + size > hdev->dump.end)
127 return false;
128
129 memcpy(hdev->dump.tail, buf, size);
130 hdev->dump.tail += size;
131
132 return true;
133 }
134
135 /* Call with hci_dev_lock only. */
hci_devcd_memset(struct hci_dev * hdev,u8 pattern,u32 len)136 static bool hci_devcd_memset(struct hci_dev *hdev, u8 pattern, u32 len)
137 {
138 if (hdev->dump.tail + len > hdev->dump.end)
139 return false;
140
141 memset(hdev->dump.tail, pattern, len);
142 hdev->dump.tail += len;
143
144 return true;
145 }
146
147 /* Call with hci_dev_lock only. */
hci_devcd_prepare(struct hci_dev * hdev,u32 dump_size)148 static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size)
149 {
150 struct sk_buff *skb;
151 int dump_hdr_size;
152 int err = 0;
153
154 skb = alloc_skb(HCI_DEVCD_HDR_SIZE_MAX, GFP_ATOMIC);
155 if (!skb)
156 return -ENOMEM;
157
158 dump_hdr_size = hci_devcd_mkheader(hdev, skb);
159
160 if (hci_devcd_alloc(hdev, dump_hdr_size + dump_size)) {
161 err = -ENOMEM;
162 goto hdr_free;
163 }
164
165 /* Insert the device header */
166 if (!hci_devcd_copy(hdev, skb->data, skb->len)) {
167 bt_dev_err(hdev, "Failed to insert header");
168 hci_devcd_free(hdev);
169
170 err = -ENOMEM;
171 goto hdr_free;
172 }
173
174 hdr_free:
175 kfree_skb(skb);
176
177 return err;
178 }
179
hci_devcd_handle_pkt_init(struct hci_dev * hdev,struct sk_buff * skb)180 static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb)
181 {
182 u32 dump_size;
183
184 if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) {
185 DBG_UNEXPECTED_STATE();
186 return;
187 }
188
189 if (skb->len != sizeof(dump_size)) {
190 bt_dev_dbg(hdev, "Invalid dump init pkt");
191 return;
192 }
193
194 dump_size = get_unaligned_le32(skb_pull_data(skb, 4));
195 if (!dump_size) {
196 bt_dev_err(hdev, "Zero size dump init pkt");
197 return;
198 }
199
200 if (hci_devcd_prepare(hdev, dump_size)) {
201 bt_dev_err(hdev, "Failed to prepare for dump");
202 return;
203 }
204
205 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ACTIVE);
206 queue_delayed_work(hdev->workqueue, &hdev->dump.dump_timeout,
207 hdev->dump.timeout);
208 }
209
hci_devcd_handle_pkt_skb(struct hci_dev * hdev,struct sk_buff * skb)210 static void hci_devcd_handle_pkt_skb(struct hci_dev *hdev, struct sk_buff *skb)
211 {
212 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) {
213 DBG_UNEXPECTED_STATE();
214 return;
215 }
216
217 if (!hci_devcd_copy(hdev, skb->data, skb->len))
218 bt_dev_dbg(hdev, "Failed to insert skb");
219 }
220
hci_devcd_handle_pkt_pattern(struct hci_dev * hdev,struct sk_buff * skb)221 static void hci_devcd_handle_pkt_pattern(struct hci_dev *hdev,
222 struct sk_buff *skb)
223 {
224 struct hci_devcoredump_skb_pattern *pattern;
225
226 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) {
227 DBG_UNEXPECTED_STATE();
228 return;
229 }
230
231 if (skb->len != sizeof(*pattern)) {
232 bt_dev_dbg(hdev, "Invalid pattern skb");
233 return;
234 }
235
236 pattern = skb_pull_data(skb, sizeof(*pattern));
237
238 if (!hci_devcd_memset(hdev, pattern->pattern, pattern->len))
239 bt_dev_dbg(hdev, "Failed to set pattern");
240 }
241
hci_devcd_dump(struct hci_dev * hdev)242 static void hci_devcd_dump(struct hci_dev *hdev)
243 {
244 struct sk_buff *skb;
245 u32 size;
246
247 bt_dev_dbg(hdev, "state %s", hci_devcd_state_name(hdev->dump.state));
248
249 size = hdev->dump.tail - hdev->dump.head;
250
251 /* Send a copy to monitor as a diagnostic packet */
252 skb = bt_skb_alloc(size, GFP_ATOMIC);
253 if (skb) {
254 skb_put_data(skb, hdev->dump.head, size);
255 hci_recv_diag(hdev, skb);
256 }
257
258 /* Emit a devcoredump with the available data */
259 dev_coredumpv(&hdev->dev, hdev->dump.head, size, GFP_KERNEL);
260 }
261
hci_devcd_handle_pkt_complete(struct hci_dev * hdev,struct sk_buff * skb)262 static void hci_devcd_handle_pkt_complete(struct hci_dev *hdev,
263 struct sk_buff *skb)
264 {
265 u32 dump_size;
266
267 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) {
268 DBG_UNEXPECTED_STATE();
269 return;
270 }
271
272 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_DONE);
273 dump_size = hdev->dump.tail - hdev->dump.head;
274
275 bt_dev_dbg(hdev, "complete with size %u (expect %zu)", dump_size,
276 hdev->dump.alloc_size);
277
278 hci_devcd_dump(hdev);
279 }
280
hci_devcd_handle_pkt_abort(struct hci_dev * hdev,struct sk_buff * skb)281 static void hci_devcd_handle_pkt_abort(struct hci_dev *hdev,
282 struct sk_buff *skb)
283 {
284 u32 dump_size;
285
286 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) {
287 DBG_UNEXPECTED_STATE();
288 return;
289 }
290
291 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ABORT);
292 dump_size = hdev->dump.tail - hdev->dump.head;
293
294 bt_dev_dbg(hdev, "aborted with size %u (expect %zu)", dump_size,
295 hdev->dump.alloc_size);
296
297 hci_devcd_dump(hdev);
298 }
299
300 /* Bluetooth devcoredump state machine.
301 *
302 * Devcoredump states:
303 *
304 * HCI_DEVCOREDUMP_IDLE: The default state.
305 *
306 * HCI_DEVCOREDUMP_ACTIVE: A devcoredump will be in this state once it has
307 * been initialized using hci_devcd_init(). Once active, the driver
308 * can append data using hci_devcd_append() or insert a pattern
309 * using hci_devcd_append_pattern().
310 *
311 * HCI_DEVCOREDUMP_DONE: Once the dump collection is complete, the drive
312 * can signal the completion using hci_devcd_complete(). A
313 * devcoredump is generated indicating the completion event and
314 * then the state machine is reset to the default state.
315 *
316 * HCI_DEVCOREDUMP_ABORT: The driver can cancel ongoing dump collection in
317 * case of any error using hci_devcd_abort(). A devcoredump is
318 * still generated with the available data indicating the abort
319 * event and then the state machine is reset to the default state.
320 *
321 * HCI_DEVCOREDUMP_TIMEOUT: A timeout timer for HCI_DEVCOREDUMP_TIMEOUT sec
322 * is started during devcoredump initialization. Once the timeout
323 * occurs, the driver is notified, a devcoredump is generated with
324 * the available data indicating the timeout event and then the
325 * state machine is reset to the default state.
326 *
327 * The driver must register using hci_devcd_register() before using the hci
328 * devcoredump APIs.
329 */
hci_devcd_rx(struct work_struct * work)330 void hci_devcd_rx(struct work_struct *work)
331 {
332 struct hci_dev *hdev = container_of(work, struct hci_dev, dump.dump_rx);
333 struct sk_buff *skb;
334 int start_state;
335
336 while ((skb = skb_dequeue(&hdev->dump.dump_q))) {
337 /* Return if timeout occurs. The timeout handler function
338 * hci_devcd_timeout() will report the available dump data.
339 */
340 if (hdev->dump.state == HCI_DEVCOREDUMP_TIMEOUT) {
341 kfree_skb(skb);
342 return;
343 }
344
345 hci_dev_lock(hdev);
346 start_state = hdev->dump.state;
347
348 switch (hci_dmp_cb(skb)->pkt_type) {
349 case HCI_DEVCOREDUMP_PKT_INIT:
350 hci_devcd_handle_pkt_init(hdev, skb);
351 break;
352
353 case HCI_DEVCOREDUMP_PKT_SKB:
354 hci_devcd_handle_pkt_skb(hdev, skb);
355 break;
356
357 case HCI_DEVCOREDUMP_PKT_PATTERN:
358 hci_devcd_handle_pkt_pattern(hdev, skb);
359 break;
360
361 case HCI_DEVCOREDUMP_PKT_COMPLETE:
362 hci_devcd_handle_pkt_complete(hdev, skb);
363 break;
364
365 case HCI_DEVCOREDUMP_PKT_ABORT:
366 hci_devcd_handle_pkt_abort(hdev, skb);
367 break;
368
369 default:
370 bt_dev_dbg(hdev, "Unknown packet (%d) for state %s.",
371 hci_dmp_cb(skb)->pkt_type,
372 hci_devcd_state_name(hdev->dump.state));
373 break;
374 }
375
376 hci_dev_unlock(hdev);
377 kfree_skb(skb);
378
379 /* Notify the driver about any state changes before resetting
380 * the state machine
381 */
382 if (start_state != hdev->dump.state)
383 hci_devcd_notify(hdev, hdev->dump.state);
384
385 /* Reset the state machine if the devcoredump is complete */
386 hci_dev_lock(hdev);
387 if (hdev->dump.state == HCI_DEVCOREDUMP_DONE ||
388 hdev->dump.state == HCI_DEVCOREDUMP_ABORT)
389 hci_devcd_reset(hdev);
390 hci_dev_unlock(hdev);
391 }
392 }
393
hci_devcd_timeout(struct work_struct * work)394 void hci_devcd_timeout(struct work_struct *work)
395 {
396 struct hci_dev *hdev = container_of(work, struct hci_dev,
397 dump.dump_timeout.work);
398 u32 dump_size;
399
400 hci_devcd_notify(hdev, HCI_DEVCOREDUMP_TIMEOUT);
401
402 hci_dev_lock(hdev);
403
404 cancel_work(&hdev->dump.dump_rx);
405
406 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_TIMEOUT);
407
408 dump_size = hdev->dump.tail - hdev->dump.head;
409 bt_dev_dbg(hdev, "timeout with size %u (expect %zu)", dump_size,
410 hdev->dump.alloc_size);
411
412 hci_devcd_dump(hdev);
413
414 hci_devcd_reset(hdev);
415
416 hci_dev_unlock(hdev);
417 }
418
hci_devcd_register(struct hci_dev * hdev,coredump_t coredump,dmp_hdr_t dmp_hdr,notify_change_t notify_change)419 int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump,
420 dmp_hdr_t dmp_hdr, notify_change_t notify_change)
421 {
422 /* Driver must implement coredump() and dmp_hdr() functions for
423 * bluetooth devcoredump. The coredump() should trigger a coredump
424 * event on the controller when the device's coredump sysfs entry is
425 * written to. The dmp_hdr() should create a dump header to identify
426 * the controller/fw/driver info.
427 */
428 if (!coredump || !dmp_hdr)
429 return -EINVAL;
430
431 hci_dev_lock(hdev);
432 hdev->dump.coredump = coredump;
433 hdev->dump.dmp_hdr = dmp_hdr;
434 hdev->dump.notify_change = notify_change;
435 hdev->dump.supported = true;
436 hdev->dump.timeout = DEVCOREDUMP_TIMEOUT;
437 hci_dev_unlock(hdev);
438
439 return 0;
440 }
441 EXPORT_SYMBOL(hci_devcd_register);
442
hci_devcd_enabled(struct hci_dev * hdev)443 static inline bool hci_devcd_enabled(struct hci_dev *hdev)
444 {
445 return hdev->dump.supported;
446 }
447
hci_devcd_init(struct hci_dev * hdev,u32 dump_size)448 int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
449 {
450 struct sk_buff *skb;
451
452 if (!hci_devcd_enabled(hdev))
453 return -EOPNOTSUPP;
454
455 skb = alloc_skb(sizeof(dump_size), GFP_ATOMIC);
456 if (!skb)
457 return -ENOMEM;
458
459 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT;
460 put_unaligned_le32(dump_size, skb_put(skb, 4));
461
462 skb_queue_tail(&hdev->dump.dump_q, skb);
463 queue_work(hdev->workqueue, &hdev->dump.dump_rx);
464
465 return 0;
466 }
467 EXPORT_SYMBOL(hci_devcd_init);
468
hci_devcd_append(struct hci_dev * hdev,struct sk_buff * skb)469 int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb)
470 {
471 if (!skb)
472 return -ENOMEM;
473
474 if (!hci_devcd_enabled(hdev)) {
475 kfree_skb(skb);
476 return -EOPNOTSUPP;
477 }
478
479 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_SKB;
480
481 skb_queue_tail(&hdev->dump.dump_q, skb);
482 queue_work(hdev->workqueue, &hdev->dump.dump_rx);
483
484 return 0;
485 }
486 EXPORT_SYMBOL(hci_devcd_append);
487
hci_devcd_append_pattern(struct hci_dev * hdev,u8 pattern,u32 len)488 int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len)
489 {
490 struct hci_devcoredump_skb_pattern p;
491 struct sk_buff *skb;
492
493 if (!hci_devcd_enabled(hdev))
494 return -EOPNOTSUPP;
495
496 skb = alloc_skb(sizeof(p), GFP_ATOMIC);
497 if (!skb)
498 return -ENOMEM;
499
500 p.pattern = pattern;
501 p.len = len;
502
503 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_PATTERN;
504 skb_put_data(skb, &p, sizeof(p));
505
506 skb_queue_tail(&hdev->dump.dump_q, skb);
507 queue_work(hdev->workqueue, &hdev->dump.dump_rx);
508
509 return 0;
510 }
511 EXPORT_SYMBOL(hci_devcd_append_pattern);
512
hci_devcd_complete(struct hci_dev * hdev)513 int hci_devcd_complete(struct hci_dev *hdev)
514 {
515 struct sk_buff *skb;
516
517 if (!hci_devcd_enabled(hdev))
518 return -EOPNOTSUPP;
519
520 skb = alloc_skb(0, GFP_ATOMIC);
521 if (!skb)
522 return -ENOMEM;
523
524 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_COMPLETE;
525
526 skb_queue_tail(&hdev->dump.dump_q, skb);
527 queue_work(hdev->workqueue, &hdev->dump.dump_rx);
528
529 return 0;
530 }
531 EXPORT_SYMBOL(hci_devcd_complete);
532
hci_devcd_abort(struct hci_dev * hdev)533 int hci_devcd_abort(struct hci_dev *hdev)
534 {
535 struct sk_buff *skb;
536
537 if (!hci_devcd_enabled(hdev))
538 return -EOPNOTSUPP;
539
540 skb = alloc_skb(0, GFP_ATOMIC);
541 if (!skb)
542 return -ENOMEM;
543
544 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_ABORT;
545
546 skb_queue_tail(&hdev->dump.dump_q, skb);
547 queue_work(hdev->workqueue, &hdev->dump.dump_rx);
548
549 return 0;
550 }
551 EXPORT_SYMBOL(hci_devcd_abort);
552
hci_devcd_state_name(enum devcoredump_state state)553 const char *hci_devcd_state_name(enum devcoredump_state state)
554 {
555 const char *state_name = "Unknown";
556
557 switch (state) {
558 case HCI_DEVCOREDUMP_IDLE:
559 state_name = "IDLE";
560 break;
561 case HCI_DEVCOREDUMP_ACTIVE:
562 state_name = "ACTIVE";
563 break;
564 case HCI_DEVCOREDUMP_DONE:
565 state_name = "DONE";
566 break;
567 case HCI_DEVCOREDUMP_ABORT:
568 state_name = "ABORT";
569 break;
570 case HCI_DEVCOREDUMP_TIMEOUT:
571 state_name = "TIMEOUT";
572 break;
573 default:
574 break;
575 }
576
577 return state_name;
578 }
579 EXPORT_SYMBOL(hci_devcd_state_name);
580