1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2023 Google Corporation 4 */ 5 6 #include <linux/devcoredump.h> 7 8 #include <linux/unaligned.h> 9 #include <net/bluetooth/bluetooth.h> 10 #include <net/bluetooth/hci_core.h> 11 12 enum hci_devcoredump_pkt_type { 13 HCI_DEVCOREDUMP_PKT_INIT, 14 HCI_DEVCOREDUMP_PKT_SKB, 15 HCI_DEVCOREDUMP_PKT_PATTERN, 16 HCI_DEVCOREDUMP_PKT_COMPLETE, 17 HCI_DEVCOREDUMP_PKT_ABORT, 18 }; 19 20 struct hci_devcoredump_skb_cb { 21 u16 pkt_type; 22 }; 23 24 struct hci_devcoredump_skb_pattern { 25 u8 pattern; 26 u32 len; 27 } __packed; 28 29 #define hci_dmp_cb(skb) ((struct hci_devcoredump_skb_cb *)((skb)->cb)) 30 31 #define DBG_UNEXPECTED_STATE() \ 32 bt_dev_dbg(hdev, \ 33 "Unexpected packet (%d) for state (%d). ", \ 34 hci_dmp_cb(skb)->pkt_type, hdev->dump.state) 35 36 #define MAX_DEVCOREDUMP_HDR_SIZE 512 /* bytes */ 37 38 static int hci_devcd_update_hdr_state(char *buf, size_t size, int state) 39 { 40 int len = 0; 41 42 if (!buf) 43 return 0; 44 45 len = scnprintf(buf, size, "Bluetooth devcoredump\nState: %d\n", state); 46 47 return len + 1; /* scnprintf adds \0 at the end upon state rewrite */ 48 } 49 50 /* Call with hci_dev_lock only. */ 51 static int hci_devcd_update_state(struct hci_dev *hdev, int state) 52 { 53 bt_dev_dbg(hdev, "Updating devcoredump state from %d to %d.", 54 hdev->dump.state, state); 55 56 hdev->dump.state = state; 57 58 return hci_devcd_update_hdr_state(hdev->dump.head, 59 hdev->dump.alloc_size, state); 60 } 61 62 static int hci_devcd_mkheader(struct hci_dev *hdev, struct sk_buff *skb) 63 { 64 char dump_start[] = "--- Start dump ---\n"; 65 char hdr[80]; 66 int hdr_len; 67 68 hdr_len = hci_devcd_update_hdr_state(hdr, sizeof(hdr), 69 HCI_DEVCOREDUMP_IDLE); 70 skb_put_data(skb, hdr, hdr_len); 71 72 if (hdev->dump.dmp_hdr) 73 hdev->dump.dmp_hdr(hdev, skb); 74 75 skb_put_data(skb, dump_start, strlen(dump_start)); 76 77 return skb->len; 78 } 79 80 /* Do not call with hci_dev_lock since this calls driver code. */ 81 static void hci_devcd_notify(struct hci_dev *hdev, int state) 82 { 83 if (hdev->dump.notify_change) 84 hdev->dump.notify_change(hdev, state); 85 } 86 87 /* Call with hci_dev_lock only. */ 88 void hci_devcd_reset(struct hci_dev *hdev) 89 { 90 hdev->dump.head = NULL; 91 hdev->dump.tail = NULL; 92 hdev->dump.alloc_size = 0; 93 94 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 95 96 cancel_delayed_work(&hdev->dump.dump_timeout); 97 skb_queue_purge(&hdev->dump.dump_q); 98 } 99 100 /* Call with hci_dev_lock only. */ 101 static void hci_devcd_free(struct hci_dev *hdev) 102 { 103 vfree(hdev->dump.head); 104 105 hci_devcd_reset(hdev); 106 } 107 108 /* Call with hci_dev_lock only. */ 109 static int hci_devcd_alloc(struct hci_dev *hdev, u32 size) 110 { 111 hdev->dump.head = vmalloc(size); 112 if (!hdev->dump.head) 113 return -ENOMEM; 114 115 hdev->dump.alloc_size = size; 116 hdev->dump.tail = hdev->dump.head; 117 hdev->dump.end = hdev->dump.head + size; 118 119 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 120 121 return 0; 122 } 123 124 /* Call with hci_dev_lock only. */ 125 static bool hci_devcd_copy(struct hci_dev *hdev, char *buf, u32 size) 126 { 127 if (hdev->dump.tail + size > hdev->dump.end) 128 return false; 129 130 memcpy(hdev->dump.tail, buf, size); 131 hdev->dump.tail += size; 132 133 return true; 134 } 135 136 /* Call with hci_dev_lock only. */ 137 static bool hci_devcd_memset(struct hci_dev *hdev, u8 pattern, u32 len) 138 { 139 if (hdev->dump.tail + len > hdev->dump.end) 140 return false; 141 142 memset(hdev->dump.tail, pattern, len); 143 hdev->dump.tail += len; 144 145 return true; 146 } 147 148 /* Call with hci_dev_lock only. */ 149 static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size) 150 { 151 struct sk_buff *skb; 152 int dump_hdr_size; 153 int err = 0; 154 155 skb = alloc_skb(MAX_DEVCOREDUMP_HDR_SIZE, GFP_ATOMIC); 156 if (!skb) 157 return -ENOMEM; 158 159 dump_hdr_size = hci_devcd_mkheader(hdev, skb); 160 161 if (hci_devcd_alloc(hdev, dump_hdr_size + dump_size)) { 162 err = -ENOMEM; 163 goto hdr_free; 164 } 165 166 /* Insert the device header */ 167 if (!hci_devcd_copy(hdev, skb->data, skb->len)) { 168 bt_dev_err(hdev, "Failed to insert header"); 169 hci_devcd_free(hdev); 170 171 err = -ENOMEM; 172 goto hdr_free; 173 } 174 175 hdr_free: 176 kfree_skb(skb); 177 178 return err; 179 } 180 181 static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) 182 { 183 u32 dump_size; 184 185 if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { 186 DBG_UNEXPECTED_STATE(); 187 return; 188 } 189 190 if (skb->len != sizeof(dump_size)) { 191 bt_dev_dbg(hdev, "Invalid dump init pkt"); 192 return; 193 } 194 195 dump_size = get_unaligned_le32(skb_pull_data(skb, 4)); 196 if (!dump_size) { 197 bt_dev_err(hdev, "Zero size dump init pkt"); 198 return; 199 } 200 201 if (hci_devcd_prepare(hdev, dump_size)) { 202 bt_dev_err(hdev, "Failed to prepare for dump"); 203 return; 204 } 205 206 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ACTIVE); 207 queue_delayed_work(hdev->workqueue, &hdev->dump.dump_timeout, 208 hdev->dump.timeout); 209 } 210 211 static void hci_devcd_handle_pkt_skb(struct hci_dev *hdev, struct sk_buff *skb) 212 { 213 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 214 DBG_UNEXPECTED_STATE(); 215 return; 216 } 217 218 if (!hci_devcd_copy(hdev, skb->data, skb->len)) 219 bt_dev_dbg(hdev, "Failed to insert skb"); 220 } 221 222 static void hci_devcd_handle_pkt_pattern(struct hci_dev *hdev, 223 struct sk_buff *skb) 224 { 225 struct hci_devcoredump_skb_pattern *pattern; 226 227 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 228 DBG_UNEXPECTED_STATE(); 229 return; 230 } 231 232 if (skb->len != sizeof(*pattern)) { 233 bt_dev_dbg(hdev, "Invalid pattern skb"); 234 return; 235 } 236 237 pattern = skb_pull_data(skb, sizeof(*pattern)); 238 239 if (!hci_devcd_memset(hdev, pattern->pattern, pattern->len)) 240 bt_dev_dbg(hdev, "Failed to set pattern"); 241 } 242 243 static void hci_devcd_handle_pkt_complete(struct hci_dev *hdev, 244 struct sk_buff *skb) 245 { 246 u32 dump_size; 247 248 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 249 DBG_UNEXPECTED_STATE(); 250 return; 251 } 252 253 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_DONE); 254 dump_size = hdev->dump.tail - hdev->dump.head; 255 256 bt_dev_dbg(hdev, "complete with size %u (expect %zu)", dump_size, 257 hdev->dump.alloc_size); 258 259 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 260 } 261 262 static void hci_devcd_handle_pkt_abort(struct hci_dev *hdev, 263 struct sk_buff *skb) 264 { 265 u32 dump_size; 266 267 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 268 DBG_UNEXPECTED_STATE(); 269 return; 270 } 271 272 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ABORT); 273 dump_size = hdev->dump.tail - hdev->dump.head; 274 275 bt_dev_dbg(hdev, "aborted with size %u (expect %zu)", dump_size, 276 hdev->dump.alloc_size); 277 278 /* Emit a devcoredump with the available data */ 279 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 280 } 281 282 /* Bluetooth devcoredump state machine. 283 * 284 * Devcoredump states: 285 * 286 * HCI_DEVCOREDUMP_IDLE: The default state. 287 * 288 * HCI_DEVCOREDUMP_ACTIVE: A devcoredump will be in this state once it has 289 * been initialized using hci_devcd_init(). Once active, the driver 290 * can append data using hci_devcd_append() or insert a pattern 291 * using hci_devcd_append_pattern(). 292 * 293 * HCI_DEVCOREDUMP_DONE: Once the dump collection is complete, the drive 294 * can signal the completion using hci_devcd_complete(). A 295 * devcoredump is generated indicating the completion event and 296 * then the state machine is reset to the default state. 297 * 298 * HCI_DEVCOREDUMP_ABORT: The driver can cancel ongoing dump collection in 299 * case of any error using hci_devcd_abort(). A devcoredump is 300 * still generated with the available data indicating the abort 301 * event and then the state machine is reset to the default state. 302 * 303 * HCI_DEVCOREDUMP_TIMEOUT: A timeout timer for HCI_DEVCOREDUMP_TIMEOUT sec 304 * is started during devcoredump initialization. Once the timeout 305 * occurs, the driver is notified, a devcoredump is generated with 306 * the available data indicating the timeout event and then the 307 * state machine is reset to the default state. 308 * 309 * The driver must register using hci_devcd_register() before using the hci 310 * devcoredump APIs. 311 */ 312 void hci_devcd_rx(struct work_struct *work) 313 { 314 struct hci_dev *hdev = container_of(work, struct hci_dev, dump.dump_rx); 315 struct sk_buff *skb; 316 int start_state; 317 318 while ((skb = skb_dequeue(&hdev->dump.dump_q))) { 319 /* Return if timeout occurs. The timeout handler function 320 * hci_devcd_timeout() will report the available dump data. 321 */ 322 if (hdev->dump.state == HCI_DEVCOREDUMP_TIMEOUT) { 323 kfree_skb(skb); 324 return; 325 } 326 327 hci_dev_lock(hdev); 328 start_state = hdev->dump.state; 329 330 switch (hci_dmp_cb(skb)->pkt_type) { 331 case HCI_DEVCOREDUMP_PKT_INIT: 332 hci_devcd_handle_pkt_init(hdev, skb); 333 break; 334 335 case HCI_DEVCOREDUMP_PKT_SKB: 336 hci_devcd_handle_pkt_skb(hdev, skb); 337 break; 338 339 case HCI_DEVCOREDUMP_PKT_PATTERN: 340 hci_devcd_handle_pkt_pattern(hdev, skb); 341 break; 342 343 case HCI_DEVCOREDUMP_PKT_COMPLETE: 344 hci_devcd_handle_pkt_complete(hdev, skb); 345 break; 346 347 case HCI_DEVCOREDUMP_PKT_ABORT: 348 hci_devcd_handle_pkt_abort(hdev, skb); 349 break; 350 351 default: 352 bt_dev_dbg(hdev, "Unknown packet (%d) for state (%d). ", 353 hci_dmp_cb(skb)->pkt_type, hdev->dump.state); 354 break; 355 } 356 357 hci_dev_unlock(hdev); 358 kfree_skb(skb); 359 360 /* Notify the driver about any state changes before resetting 361 * the state machine 362 */ 363 if (start_state != hdev->dump.state) 364 hci_devcd_notify(hdev, hdev->dump.state); 365 366 /* Reset the state machine if the devcoredump is complete */ 367 hci_dev_lock(hdev); 368 if (hdev->dump.state == HCI_DEVCOREDUMP_DONE || 369 hdev->dump.state == HCI_DEVCOREDUMP_ABORT) 370 hci_devcd_reset(hdev); 371 hci_dev_unlock(hdev); 372 } 373 } 374 EXPORT_SYMBOL(hci_devcd_rx); 375 376 void hci_devcd_timeout(struct work_struct *work) 377 { 378 struct hci_dev *hdev = container_of(work, struct hci_dev, 379 dump.dump_timeout.work); 380 u32 dump_size; 381 382 hci_devcd_notify(hdev, HCI_DEVCOREDUMP_TIMEOUT); 383 384 hci_dev_lock(hdev); 385 386 cancel_work(&hdev->dump.dump_rx); 387 388 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_TIMEOUT); 389 390 dump_size = hdev->dump.tail - hdev->dump.head; 391 bt_dev_dbg(hdev, "timeout with size %u (expect %zu)", dump_size, 392 hdev->dump.alloc_size); 393 394 /* Emit a devcoredump with the available data */ 395 dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); 396 397 hci_devcd_reset(hdev); 398 399 hci_dev_unlock(hdev); 400 } 401 EXPORT_SYMBOL(hci_devcd_timeout); 402 403 int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump, 404 dmp_hdr_t dmp_hdr, notify_change_t notify_change) 405 { 406 /* Driver must implement coredump() and dmp_hdr() functions for 407 * bluetooth devcoredump. The coredump() should trigger a coredump 408 * event on the controller when the device's coredump sysfs entry is 409 * written to. The dmp_hdr() should create a dump header to identify 410 * the controller/fw/driver info. 411 */ 412 if (!coredump || !dmp_hdr) 413 return -EINVAL; 414 415 hci_dev_lock(hdev); 416 hdev->dump.coredump = coredump; 417 hdev->dump.dmp_hdr = dmp_hdr; 418 hdev->dump.notify_change = notify_change; 419 hdev->dump.supported = true; 420 hdev->dump.timeout = DEVCOREDUMP_TIMEOUT; 421 hci_dev_unlock(hdev); 422 423 return 0; 424 } 425 EXPORT_SYMBOL(hci_devcd_register); 426 427 static inline bool hci_devcd_enabled(struct hci_dev *hdev) 428 { 429 return hdev->dump.supported; 430 } 431 432 int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) 433 { 434 struct sk_buff *skb; 435 436 if (!hci_devcd_enabled(hdev)) 437 return -EOPNOTSUPP; 438 439 skb = alloc_skb(sizeof(dump_size), GFP_ATOMIC); 440 if (!skb) 441 return -ENOMEM; 442 443 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; 444 put_unaligned_le32(dump_size, skb_put(skb, 4)); 445 446 skb_queue_tail(&hdev->dump.dump_q, skb); 447 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 448 449 return 0; 450 } 451 EXPORT_SYMBOL(hci_devcd_init); 452 453 int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb) 454 { 455 if (!skb) 456 return -ENOMEM; 457 458 if (!hci_devcd_enabled(hdev)) { 459 kfree_skb(skb); 460 return -EOPNOTSUPP; 461 } 462 463 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_SKB; 464 465 skb_queue_tail(&hdev->dump.dump_q, skb); 466 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 467 468 return 0; 469 } 470 EXPORT_SYMBOL(hci_devcd_append); 471 472 int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len) 473 { 474 struct hci_devcoredump_skb_pattern p; 475 struct sk_buff *skb; 476 477 if (!hci_devcd_enabled(hdev)) 478 return -EOPNOTSUPP; 479 480 skb = alloc_skb(sizeof(p), GFP_ATOMIC); 481 if (!skb) 482 return -ENOMEM; 483 484 p.pattern = pattern; 485 p.len = len; 486 487 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_PATTERN; 488 skb_put_data(skb, &p, sizeof(p)); 489 490 skb_queue_tail(&hdev->dump.dump_q, skb); 491 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 492 493 return 0; 494 } 495 EXPORT_SYMBOL(hci_devcd_append_pattern); 496 497 int hci_devcd_complete(struct hci_dev *hdev) 498 { 499 struct sk_buff *skb; 500 501 if (!hci_devcd_enabled(hdev)) 502 return -EOPNOTSUPP; 503 504 skb = alloc_skb(0, GFP_ATOMIC); 505 if (!skb) 506 return -ENOMEM; 507 508 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_COMPLETE; 509 510 skb_queue_tail(&hdev->dump.dump_q, skb); 511 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 512 513 return 0; 514 } 515 EXPORT_SYMBOL(hci_devcd_complete); 516 517 int hci_devcd_abort(struct hci_dev *hdev) 518 { 519 struct sk_buff *skb; 520 521 if (!hci_devcd_enabled(hdev)) 522 return -EOPNOTSUPP; 523 524 skb = alloc_skb(0, GFP_ATOMIC); 525 if (!skb) 526 return -ENOMEM; 527 528 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_ABORT; 529 530 skb_queue_tail(&hdev->dump.dump_q, skb); 531 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 532 533 return 0; 534 } 535 EXPORT_SYMBOL(hci_devcd_abort); 536