1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2023 Google Corporation 4 */ 5 6 #include <linux/devcoredump.h> 7 8 #include <linux/unaligned.h> 9 #include <net/bluetooth/bluetooth.h> 10 #include <net/bluetooth/hci_core.h> 11 12 enum hci_devcoredump_pkt_type { 13 HCI_DEVCOREDUMP_PKT_INIT, 14 HCI_DEVCOREDUMP_PKT_SKB, 15 HCI_DEVCOREDUMP_PKT_PATTERN, 16 HCI_DEVCOREDUMP_PKT_COMPLETE, 17 HCI_DEVCOREDUMP_PKT_ABORT, 18 }; 19 20 struct hci_devcoredump_skb_cb { 21 u16 pkt_type; 22 }; 23 24 struct hci_devcoredump_skb_pattern { 25 u8 pattern; 26 u32 len; 27 } __packed; 28 29 #define hci_dmp_cb(skb) ((struct hci_devcoredump_skb_cb *)((skb)->cb)) 30 31 #define DBG_UNEXPECTED_STATE() \ 32 bt_dev_dbg(hdev, \ 33 "Unexpected packet (%d) for state %s.", \ 34 hci_dmp_cb(skb)->pkt_type, \ 35 hci_devcd_state_name(hdev->dump.state)) 36 37 static int hci_devcd_update_hdr_state(char *buf, size_t size, int state) 38 { 39 int len = 0; 40 41 if (!buf) 42 return 0; 43 44 len = scnprintf(buf, size, "Bluetooth devcoredump\nState: %d\n", state); 45 46 return len + 1; /* scnprintf adds \0 at the end upon state rewrite */ 47 } 48 49 /* Call with hci_dev_lock only. */ 50 static int hci_devcd_update_state(struct hci_dev *hdev, int state) 51 { 52 bt_dev_dbg(hdev, "Updating devcoredump state from %s to %s.", 53 hci_devcd_state_name(hdev->dump.state), 54 hci_devcd_state_name(state)); 55 56 hdev->dump.state = state; 57 58 return hci_devcd_update_hdr_state(hdev->dump.head, 59 hdev->dump.alloc_size, state); 60 } 61 62 static int hci_devcd_mkheader(struct hci_dev *hdev, struct sk_buff *skb) 63 { 64 char hdr[80]; 65 int hdr_len; 66 67 hdr_len = hci_devcd_update_hdr_state(hdr, sizeof(hdr), 68 HCI_DEVCOREDUMP_IDLE); 69 skb_put_data(skb, hdr, hdr_len); 70 71 if (hdev->dump.dmp_hdr) 72 hdev->dump.dmp_hdr(hdev, skb); 73 74 skb_put_data(skb, HCI_DEVCD_HDR_END_MARKER, strlen(HCI_DEVCD_HDR_END_MARKER)); 75 76 return skb->len; 77 } 78 79 /* Do not call with hci_dev_lock since this calls driver code. */ 80 static void hci_devcd_notify(struct hci_dev *hdev, int state) 81 { 82 if (hdev->dump.notify_change) 83 hdev->dump.notify_change(hdev, state); 84 } 85 86 /* Call with hci_dev_lock only. */ 87 void hci_devcd_reset(struct hci_dev *hdev) 88 { 89 hdev->dump.head = NULL; 90 hdev->dump.tail = NULL; 91 hdev->dump.alloc_size = 0; 92 93 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 94 95 cancel_delayed_work(&hdev->dump.dump_timeout); 96 skb_queue_purge(&hdev->dump.dump_q); 97 } 98 99 /* Call with hci_dev_lock only. */ 100 static void hci_devcd_free(struct hci_dev *hdev) 101 { 102 vfree(hdev->dump.head); 103 104 hci_devcd_reset(hdev); 105 } 106 107 /* Call with hci_dev_lock only. */ 108 static int hci_devcd_alloc(struct hci_dev *hdev, u32 size) 109 { 110 hdev->dump.head = vmalloc(size); 111 if (!hdev->dump.head) 112 return -ENOMEM; 113 114 hdev->dump.alloc_size = size; 115 hdev->dump.tail = hdev->dump.head; 116 hdev->dump.end = hdev->dump.head + size; 117 118 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); 119 120 return 0; 121 } 122 123 /* Call with hci_dev_lock only. */ 124 static bool hci_devcd_copy(struct hci_dev *hdev, char *buf, u32 size) 125 { 126 if (hdev->dump.tail + size > hdev->dump.end) 127 return false; 128 129 memcpy(hdev->dump.tail, buf, size); 130 hdev->dump.tail += size; 131 132 return true; 133 } 134 135 /* Call with hci_dev_lock only. */ 136 static bool hci_devcd_memset(struct hci_dev *hdev, u8 pattern, u32 len) 137 { 138 if (hdev->dump.tail + len > hdev->dump.end) 139 return false; 140 141 memset(hdev->dump.tail, pattern, len); 142 hdev->dump.tail += len; 143 144 return true; 145 } 146 147 /* Call with hci_dev_lock only. */ 148 static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size) 149 { 150 struct sk_buff *skb; 151 int dump_hdr_size; 152 int err = 0; 153 154 skb = alloc_skb(HCI_DEVCD_HDR_SIZE_MAX, GFP_ATOMIC); 155 if (!skb) 156 return -ENOMEM; 157 158 dump_hdr_size = hci_devcd_mkheader(hdev, skb); 159 160 if (hci_devcd_alloc(hdev, dump_hdr_size + dump_size)) { 161 err = -ENOMEM; 162 goto hdr_free; 163 } 164 165 /* Insert the device header */ 166 if (!hci_devcd_copy(hdev, skb->data, skb->len)) { 167 bt_dev_err(hdev, "Failed to insert header"); 168 hci_devcd_free(hdev); 169 170 err = -ENOMEM; 171 goto hdr_free; 172 } 173 174 hdr_free: 175 kfree_skb(skb); 176 177 return err; 178 } 179 180 static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) 181 { 182 u32 dump_size; 183 184 if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { 185 DBG_UNEXPECTED_STATE(); 186 return; 187 } 188 189 if (skb->len != sizeof(dump_size)) { 190 bt_dev_dbg(hdev, "Invalid dump init pkt"); 191 return; 192 } 193 194 dump_size = get_unaligned_le32(skb_pull_data(skb, 4)); 195 if (!dump_size) { 196 bt_dev_err(hdev, "Zero size dump init pkt"); 197 return; 198 } 199 200 if (hci_devcd_prepare(hdev, dump_size)) { 201 bt_dev_err(hdev, "Failed to prepare for dump"); 202 return; 203 } 204 205 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ACTIVE); 206 queue_delayed_work(hdev->workqueue, &hdev->dump.dump_timeout, 207 hdev->dump.timeout); 208 } 209 210 static void hci_devcd_handle_pkt_skb(struct hci_dev *hdev, struct sk_buff *skb) 211 { 212 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 213 DBG_UNEXPECTED_STATE(); 214 return; 215 } 216 217 if (!hci_devcd_copy(hdev, skb->data, skb->len)) 218 bt_dev_dbg(hdev, "Failed to insert skb"); 219 } 220 221 static void hci_devcd_handle_pkt_pattern(struct hci_dev *hdev, 222 struct sk_buff *skb) 223 { 224 struct hci_devcoredump_skb_pattern *pattern; 225 226 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 227 DBG_UNEXPECTED_STATE(); 228 return; 229 } 230 231 if (skb->len != sizeof(*pattern)) { 232 bt_dev_dbg(hdev, "Invalid pattern skb"); 233 return; 234 } 235 236 pattern = skb_pull_data(skb, sizeof(*pattern)); 237 238 if (!hci_devcd_memset(hdev, pattern->pattern, pattern->len)) 239 bt_dev_dbg(hdev, "Failed to set pattern"); 240 } 241 242 static void hci_devcd_dump(struct hci_dev *hdev) 243 { 244 struct sk_buff *skb; 245 u32 size; 246 247 bt_dev_dbg(hdev, "state %s", hci_devcd_state_name(hdev->dump.state)); 248 249 size = hdev->dump.tail - hdev->dump.head; 250 251 /* Send a copy to monitor as a diagnostic packet */ 252 skb = bt_skb_alloc(size, GFP_ATOMIC); 253 if (skb) { 254 skb_put_data(skb, hdev->dump.head, size); 255 hci_recv_diag(hdev, skb); 256 } 257 258 /* Emit a devcoredump with the available data */ 259 dev_coredumpv(&hdev->dev, hdev->dump.head, size, GFP_KERNEL); 260 } 261 262 static void hci_devcd_handle_pkt_complete(struct hci_dev *hdev, 263 struct sk_buff *skb) 264 { 265 u32 dump_size; 266 267 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 268 DBG_UNEXPECTED_STATE(); 269 return; 270 } 271 272 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_DONE); 273 dump_size = hdev->dump.tail - hdev->dump.head; 274 275 bt_dev_dbg(hdev, "complete with size %u (expect %zu)", dump_size, 276 hdev->dump.alloc_size); 277 278 hci_devcd_dump(hdev); 279 } 280 281 static void hci_devcd_handle_pkt_abort(struct hci_dev *hdev, 282 struct sk_buff *skb) 283 { 284 u32 dump_size; 285 286 if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { 287 DBG_UNEXPECTED_STATE(); 288 return; 289 } 290 291 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ABORT); 292 dump_size = hdev->dump.tail - hdev->dump.head; 293 294 bt_dev_dbg(hdev, "aborted with size %u (expect %zu)", dump_size, 295 hdev->dump.alloc_size); 296 297 hci_devcd_dump(hdev); 298 } 299 300 /* Bluetooth devcoredump state machine. 301 * 302 * Devcoredump states: 303 * 304 * HCI_DEVCOREDUMP_IDLE: The default state. 305 * 306 * HCI_DEVCOREDUMP_ACTIVE: A devcoredump will be in this state once it has 307 * been initialized using hci_devcd_init(). Once active, the driver 308 * can append data using hci_devcd_append() or insert a pattern 309 * using hci_devcd_append_pattern(). 310 * 311 * HCI_DEVCOREDUMP_DONE: Once the dump collection is complete, the drive 312 * can signal the completion using hci_devcd_complete(). A 313 * devcoredump is generated indicating the completion event and 314 * then the state machine is reset to the default state. 315 * 316 * HCI_DEVCOREDUMP_ABORT: The driver can cancel ongoing dump collection in 317 * case of any error using hci_devcd_abort(). A devcoredump is 318 * still generated with the available data indicating the abort 319 * event and then the state machine is reset to the default state. 320 * 321 * HCI_DEVCOREDUMP_TIMEOUT: A timeout timer for HCI_DEVCOREDUMP_TIMEOUT sec 322 * is started during devcoredump initialization. Once the timeout 323 * occurs, the driver is notified, a devcoredump is generated with 324 * the available data indicating the timeout event and then the 325 * state machine is reset to the default state. 326 * 327 * The driver must register using hci_devcd_register() before using the hci 328 * devcoredump APIs. 329 */ 330 void hci_devcd_rx(struct work_struct *work) 331 { 332 struct hci_dev *hdev = container_of(work, struct hci_dev, dump.dump_rx); 333 struct sk_buff *skb; 334 int start_state; 335 336 while ((skb = skb_dequeue(&hdev->dump.dump_q))) { 337 /* Return if timeout occurs. The timeout handler function 338 * hci_devcd_timeout() will report the available dump data. 339 */ 340 if (hdev->dump.state == HCI_DEVCOREDUMP_TIMEOUT) { 341 kfree_skb(skb); 342 return; 343 } 344 345 hci_dev_lock(hdev); 346 start_state = hdev->dump.state; 347 348 switch (hci_dmp_cb(skb)->pkt_type) { 349 case HCI_DEVCOREDUMP_PKT_INIT: 350 hci_devcd_handle_pkt_init(hdev, skb); 351 break; 352 353 case HCI_DEVCOREDUMP_PKT_SKB: 354 hci_devcd_handle_pkt_skb(hdev, skb); 355 break; 356 357 case HCI_DEVCOREDUMP_PKT_PATTERN: 358 hci_devcd_handle_pkt_pattern(hdev, skb); 359 break; 360 361 case HCI_DEVCOREDUMP_PKT_COMPLETE: 362 hci_devcd_handle_pkt_complete(hdev, skb); 363 break; 364 365 case HCI_DEVCOREDUMP_PKT_ABORT: 366 hci_devcd_handle_pkt_abort(hdev, skb); 367 break; 368 369 default: 370 bt_dev_dbg(hdev, "Unknown packet (%d) for state %s.", 371 hci_dmp_cb(skb)->pkt_type, 372 hci_devcd_state_name(hdev->dump.state)); 373 break; 374 } 375 376 hci_dev_unlock(hdev); 377 kfree_skb(skb); 378 379 /* Notify the driver about any state changes before resetting 380 * the state machine 381 */ 382 if (start_state != hdev->dump.state) 383 hci_devcd_notify(hdev, hdev->dump.state); 384 385 /* Reset the state machine if the devcoredump is complete */ 386 hci_dev_lock(hdev); 387 if (hdev->dump.state == HCI_DEVCOREDUMP_DONE || 388 hdev->dump.state == HCI_DEVCOREDUMP_ABORT) 389 hci_devcd_reset(hdev); 390 hci_dev_unlock(hdev); 391 } 392 } 393 394 void hci_devcd_timeout(struct work_struct *work) 395 { 396 struct hci_dev *hdev = container_of(work, struct hci_dev, 397 dump.dump_timeout.work); 398 u32 dump_size; 399 400 hci_devcd_notify(hdev, HCI_DEVCOREDUMP_TIMEOUT); 401 402 hci_dev_lock(hdev); 403 404 cancel_work(&hdev->dump.dump_rx); 405 406 hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_TIMEOUT); 407 408 dump_size = hdev->dump.tail - hdev->dump.head; 409 bt_dev_dbg(hdev, "timeout with size %u (expect %zu)", dump_size, 410 hdev->dump.alloc_size); 411 412 hci_devcd_dump(hdev); 413 414 hci_devcd_reset(hdev); 415 416 hci_dev_unlock(hdev); 417 } 418 419 int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump, 420 dmp_hdr_t dmp_hdr, notify_change_t notify_change) 421 { 422 /* Driver must implement coredump() and dmp_hdr() functions for 423 * bluetooth devcoredump. The coredump() should trigger a coredump 424 * event on the controller when the device's coredump sysfs entry is 425 * written to. The dmp_hdr() should create a dump header to identify 426 * the controller/fw/driver info. 427 */ 428 if (!coredump || !dmp_hdr) 429 return -EINVAL; 430 431 hci_dev_lock(hdev); 432 hdev->dump.coredump = coredump; 433 hdev->dump.dmp_hdr = dmp_hdr; 434 hdev->dump.notify_change = notify_change; 435 hdev->dump.supported = true; 436 hdev->dump.timeout = DEVCOREDUMP_TIMEOUT; 437 hci_dev_unlock(hdev); 438 439 return 0; 440 } 441 EXPORT_SYMBOL(hci_devcd_register); 442 443 static inline bool hci_devcd_enabled(struct hci_dev *hdev) 444 { 445 return hdev->dump.supported; 446 } 447 448 int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) 449 { 450 struct sk_buff *skb; 451 452 if (!hci_devcd_enabled(hdev)) 453 return -EOPNOTSUPP; 454 455 skb = alloc_skb(sizeof(dump_size), GFP_ATOMIC); 456 if (!skb) 457 return -ENOMEM; 458 459 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; 460 put_unaligned_le32(dump_size, skb_put(skb, 4)); 461 462 skb_queue_tail(&hdev->dump.dump_q, skb); 463 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 464 465 return 0; 466 } 467 EXPORT_SYMBOL(hci_devcd_init); 468 469 int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb) 470 { 471 if (!skb) 472 return -ENOMEM; 473 474 if (!hci_devcd_enabled(hdev)) { 475 kfree_skb(skb); 476 return -EOPNOTSUPP; 477 } 478 479 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_SKB; 480 481 skb_queue_tail(&hdev->dump.dump_q, skb); 482 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 483 484 return 0; 485 } 486 EXPORT_SYMBOL(hci_devcd_append); 487 488 int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len) 489 { 490 struct hci_devcoredump_skb_pattern p; 491 struct sk_buff *skb; 492 493 if (!hci_devcd_enabled(hdev)) 494 return -EOPNOTSUPP; 495 496 skb = alloc_skb(sizeof(p), GFP_ATOMIC); 497 if (!skb) 498 return -ENOMEM; 499 500 p.pattern = pattern; 501 p.len = len; 502 503 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_PATTERN; 504 skb_put_data(skb, &p, sizeof(p)); 505 506 skb_queue_tail(&hdev->dump.dump_q, skb); 507 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 508 509 return 0; 510 } 511 EXPORT_SYMBOL(hci_devcd_append_pattern); 512 513 int hci_devcd_complete(struct hci_dev *hdev) 514 { 515 struct sk_buff *skb; 516 517 if (!hci_devcd_enabled(hdev)) 518 return -EOPNOTSUPP; 519 520 skb = alloc_skb(0, GFP_ATOMIC); 521 if (!skb) 522 return -ENOMEM; 523 524 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_COMPLETE; 525 526 skb_queue_tail(&hdev->dump.dump_q, skb); 527 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 528 529 return 0; 530 } 531 EXPORT_SYMBOL(hci_devcd_complete); 532 533 int hci_devcd_abort(struct hci_dev *hdev) 534 { 535 struct sk_buff *skb; 536 537 if (!hci_devcd_enabled(hdev)) 538 return -EOPNOTSUPP; 539 540 skb = alloc_skb(0, GFP_ATOMIC); 541 if (!skb) 542 return -ENOMEM; 543 544 hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_ABORT; 545 546 skb_queue_tail(&hdev->dump.dump_q, skb); 547 queue_work(hdev->workqueue, &hdev->dump.dump_rx); 548 549 return 0; 550 } 551 EXPORT_SYMBOL(hci_devcd_abort); 552 553 const char *hci_devcd_state_name(enum devcoredump_state state) 554 { 555 const char *state_name = "Unknown"; 556 557 switch (state) { 558 case HCI_DEVCOREDUMP_IDLE: 559 state_name = "IDLE"; 560 break; 561 case HCI_DEVCOREDUMP_ACTIVE: 562 state_name = "ACTIVE"; 563 break; 564 case HCI_DEVCOREDUMP_DONE: 565 state_name = "DONE"; 566 break; 567 case HCI_DEVCOREDUMP_ABORT: 568 state_name = "ABORT"; 569 break; 570 case HCI_DEVCOREDUMP_TIMEOUT: 571 state_name = "TIMEOUT"; 572 break; 573 default: 574 break; 575 } 576 577 return state_name; 578 } 579 EXPORT_SYMBOL(hci_devcd_state_name); 580