| // SPDX-License-Identifier: GPL-2.0-only |
| /* |
| * Copyright (C) 2023 Google Corporation |
| */ |
| |
| #include <linux/devcoredump.h> |
| |
| #include <asm/unaligned.h> |
| #include <net/bluetooth/bluetooth.h> |
| #include <net/bluetooth/hci_core.h> |
| |
| enum hci_devcoredump_pkt_type { |
| HCI_DEVCOREDUMP_PKT_INIT, |
| HCI_DEVCOREDUMP_PKT_SKB, |
| HCI_DEVCOREDUMP_PKT_PATTERN, |
| HCI_DEVCOREDUMP_PKT_COMPLETE, |
| HCI_DEVCOREDUMP_PKT_ABORT, |
| }; |
| |
| struct hci_devcoredump_skb_cb { |
| u16 pkt_type; |
| }; |
| |
| struct hci_devcoredump_skb_pattern { |
| u8 pattern; |
| u32 len; |
| } __packed; |
| |
| #define hci_dmp_cb(skb) ((struct hci_devcoredump_skb_cb *)((skb)->cb)) |
| |
| #define DBG_UNEXPECTED_STATE() \ |
| bt_dev_dbg(hdev, \ |
| "Unexpected packet (%d) for state (%d). ", \ |
| hci_dmp_cb(skb)->pkt_type, hdev->dump.state) |
| |
| #define MAX_DEVCOREDUMP_HDR_SIZE 512 /* bytes */ |
| |
| static int hci_devcd_update_hdr_state(char *buf, size_t size, int state) |
| { |
| int len = 0; |
| |
| if (!buf) |
| return 0; |
| |
| len = scnprintf(buf, size, "Bluetooth devcoredump\nState: %d\n", state); |
| |
| return len + 1; /* scnprintf adds \0 at the end upon state rewrite */ |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static int hci_devcd_update_state(struct hci_dev *hdev, int state) |
| { |
| bt_dev_dbg(hdev, "Updating devcoredump state from %d to %d.", |
| hdev->dump.state, state); |
| |
| hdev->dump.state = state; |
| |
| return hci_devcd_update_hdr_state(hdev->dump.head, |
| hdev->dump.alloc_size, state); |
| } |
| |
| static int hci_devcd_mkheader(struct hci_dev *hdev, struct sk_buff *skb) |
| { |
| char dump_start[] = "--- Start dump ---\n"; |
| char hdr[80]; |
| int hdr_len; |
| |
| hdr_len = hci_devcd_update_hdr_state(hdr, sizeof(hdr), |
| HCI_DEVCOREDUMP_IDLE); |
| skb_put_data(skb, hdr, hdr_len); |
| |
| if (hdev->dump.dmp_hdr) |
| hdev->dump.dmp_hdr(hdev, skb); |
| |
| skb_put_data(skb, dump_start, strlen(dump_start)); |
| |
| return skb->len; |
| } |
| |
| /* Do not call with hci_dev_lock since this calls driver code. */ |
| static void hci_devcd_notify(struct hci_dev *hdev, int state) |
| { |
| if (hdev->dump.notify_change) |
| hdev->dump.notify_change(hdev, state); |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| void hci_devcd_reset(struct hci_dev *hdev) |
| { |
| hdev->dump.head = NULL; |
| hdev->dump.tail = NULL; |
| hdev->dump.alloc_size = 0; |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); |
| |
| cancel_delayed_work(&hdev->dump.dump_timeout); |
| skb_queue_purge(&hdev->dump.dump_q); |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static void hci_devcd_free(struct hci_dev *hdev) |
| { |
| if (hdev->dump.head) |
| vfree(hdev->dump.head); |
| |
| hci_devcd_reset(hdev); |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static int hci_devcd_alloc(struct hci_dev *hdev, u32 size) |
| { |
| hdev->dump.head = vmalloc(size); |
| if (!hdev->dump.head) |
| return -ENOMEM; |
| |
| hdev->dump.alloc_size = size; |
| hdev->dump.tail = hdev->dump.head; |
| hdev->dump.end = hdev->dump.head + size; |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_IDLE); |
| |
| return 0; |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static bool hci_devcd_copy(struct hci_dev *hdev, char *buf, u32 size) |
| { |
| if (hdev->dump.tail + size > hdev->dump.end) |
| return false; |
| |
| memcpy(hdev->dump.tail, buf, size); |
| hdev->dump.tail += size; |
| |
| return true; |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static bool hci_devcd_memset(struct hci_dev *hdev, u8 pattern, u32 len) |
| { |
| if (hdev->dump.tail + len > hdev->dump.end) |
| return false; |
| |
| memset(hdev->dump.tail, pattern, len); |
| hdev->dump.tail += len; |
| |
| return true; |
| } |
| |
| /* Call with hci_dev_lock only. */ |
| static int hci_devcd_prepare(struct hci_dev *hdev, u32 dump_size) |
| { |
| struct sk_buff *skb; |
| int dump_hdr_size; |
| int err = 0; |
| |
| skb = alloc_skb(MAX_DEVCOREDUMP_HDR_SIZE, GFP_ATOMIC); |
| if (!skb) |
| return -ENOMEM; |
| |
| dump_hdr_size = hci_devcd_mkheader(hdev, skb); |
| |
| if (hci_devcd_alloc(hdev, dump_hdr_size + dump_size)) { |
| err = -ENOMEM; |
| goto hdr_free; |
| } |
| |
| /* Insert the device header */ |
| if (!hci_devcd_copy(hdev, skb->data, skb->len)) { |
| bt_dev_err(hdev, "Failed to insert header"); |
| hci_devcd_free(hdev); |
| |
| err = -ENOMEM; |
| goto hdr_free; |
| } |
| |
| hdr_free: |
| kfree_skb(skb); |
| |
| return err; |
| } |
| |
| static void hci_devcd_handle_pkt_init(struct hci_dev *hdev, struct sk_buff *skb) |
| { |
| u32 dump_size; |
| |
| if (hdev->dump.state != HCI_DEVCOREDUMP_IDLE) { |
| DBG_UNEXPECTED_STATE(); |
| return; |
| } |
| |
| if (skb->len != sizeof(dump_size)) { |
| bt_dev_dbg(hdev, "Invalid dump init pkt"); |
| return; |
| } |
| |
| dump_size = get_unaligned_le32(skb_pull_data(skb, 4)); |
| if (!dump_size) { |
| bt_dev_err(hdev, "Zero size dump init pkt"); |
| return; |
| } |
| |
| if (hci_devcd_prepare(hdev, dump_size)) { |
| bt_dev_err(hdev, "Failed to prepare for dump"); |
| return; |
| } |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ACTIVE); |
| queue_delayed_work(hdev->workqueue, &hdev->dump.dump_timeout, |
| hdev->dump.timeout); |
| } |
| |
| static void hci_devcd_handle_pkt_skb(struct hci_dev *hdev, struct sk_buff *skb) |
| { |
| if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { |
| DBG_UNEXPECTED_STATE(); |
| return; |
| } |
| |
| if (!hci_devcd_copy(hdev, skb->data, skb->len)) |
| bt_dev_dbg(hdev, "Failed to insert skb"); |
| } |
| |
| static void hci_devcd_handle_pkt_pattern(struct hci_dev *hdev, |
| struct sk_buff *skb) |
| { |
| struct hci_devcoredump_skb_pattern *pattern; |
| |
| if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { |
| DBG_UNEXPECTED_STATE(); |
| return; |
| } |
| |
| if (skb->len != sizeof(*pattern)) { |
| bt_dev_dbg(hdev, "Invalid pattern skb"); |
| return; |
| } |
| |
| pattern = skb_pull_data(skb, sizeof(*pattern)); |
| |
| if (!hci_devcd_memset(hdev, pattern->pattern, pattern->len)) |
| bt_dev_dbg(hdev, "Failed to set pattern"); |
| } |
| |
| static void hci_devcd_handle_pkt_complete(struct hci_dev *hdev, |
| struct sk_buff *skb) |
| { |
| u32 dump_size; |
| |
| if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { |
| DBG_UNEXPECTED_STATE(); |
| return; |
| } |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_DONE); |
| dump_size = hdev->dump.tail - hdev->dump.head; |
| |
| bt_dev_dbg(hdev, "complete with size %u (expect %zu)", dump_size, |
| hdev->dump.alloc_size); |
| |
| dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); |
| } |
| |
| static void hci_devcd_handle_pkt_abort(struct hci_dev *hdev, |
| struct sk_buff *skb) |
| { |
| u32 dump_size; |
| |
| if (hdev->dump.state != HCI_DEVCOREDUMP_ACTIVE) { |
| DBG_UNEXPECTED_STATE(); |
| return; |
| } |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_ABORT); |
| dump_size = hdev->dump.tail - hdev->dump.head; |
| |
| bt_dev_dbg(hdev, "aborted with size %u (expect %zu)", dump_size, |
| hdev->dump.alloc_size); |
| |
| /* Emit a devcoredump with the available data */ |
| dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); |
| } |
| |
| /* Bluetooth devcoredump state machine. |
| * |
| * Devcoredump states: |
| * |
| * HCI_DEVCOREDUMP_IDLE: The default state. |
| * |
| * HCI_DEVCOREDUMP_ACTIVE: A devcoredump will be in this state once it has |
| * been initialized using hci_devcd_init(). Once active, the driver |
| * can append data using hci_devcd_append() or insert a pattern |
| * using hci_devcd_append_pattern(). |
| * |
| * HCI_DEVCOREDUMP_DONE: Once the dump collection is complete, the drive |
| * can signal the completion using hci_devcd_complete(). A |
| * devcoredump is generated indicating the completion event and |
| * then the state machine is reset to the default state. |
| * |
| * HCI_DEVCOREDUMP_ABORT: The driver can cancel ongoing dump collection in |
| * case of any error using hci_devcd_abort(). A devcoredump is |
| * still generated with the available data indicating the abort |
| * event and then the state machine is reset to the default state. |
| * |
| * HCI_DEVCOREDUMP_TIMEOUT: A timeout timer for HCI_DEVCOREDUMP_TIMEOUT sec |
| * is started during devcoredump initialization. Once the timeout |
| * occurs, the driver is notified, a devcoredump is generated with |
| * the available data indicating the timeout event and then the |
| * state machine is reset to the default state. |
| * |
| * The driver must register using hci_devcd_register() before using the hci |
| * devcoredump APIs. |
| */ |
| void hci_devcd_rx(struct work_struct *work) |
| { |
| struct hci_dev *hdev = container_of(work, struct hci_dev, dump.dump_rx); |
| struct sk_buff *skb; |
| int start_state; |
| |
| while ((skb = skb_dequeue(&hdev->dump.dump_q))) { |
| /* Return if timeout occurs. The timeout handler function |
| * hci_devcd_timeout() will report the available dump data. |
| */ |
| if (hdev->dump.state == HCI_DEVCOREDUMP_TIMEOUT) { |
| kfree_skb(skb); |
| return; |
| } |
| |
| hci_dev_lock(hdev); |
| start_state = hdev->dump.state; |
| |
| switch (hci_dmp_cb(skb)->pkt_type) { |
| case HCI_DEVCOREDUMP_PKT_INIT: |
| hci_devcd_handle_pkt_init(hdev, skb); |
| break; |
| |
| case HCI_DEVCOREDUMP_PKT_SKB: |
| hci_devcd_handle_pkt_skb(hdev, skb); |
| break; |
| |
| case HCI_DEVCOREDUMP_PKT_PATTERN: |
| hci_devcd_handle_pkt_pattern(hdev, skb); |
| break; |
| |
| case HCI_DEVCOREDUMP_PKT_COMPLETE: |
| hci_devcd_handle_pkt_complete(hdev, skb); |
| break; |
| |
| case HCI_DEVCOREDUMP_PKT_ABORT: |
| hci_devcd_handle_pkt_abort(hdev, skb); |
| break; |
| |
| default: |
| bt_dev_dbg(hdev, "Unknown packet (%d) for state (%d). ", |
| hci_dmp_cb(skb)->pkt_type, hdev->dump.state); |
| break; |
| } |
| |
| hci_dev_unlock(hdev); |
| kfree_skb(skb); |
| |
| /* Notify the driver about any state changes before resetting |
| * the state machine |
| */ |
| if (start_state != hdev->dump.state) |
| hci_devcd_notify(hdev, hdev->dump.state); |
| |
| /* Reset the state machine if the devcoredump is complete */ |
| hci_dev_lock(hdev); |
| if (hdev->dump.state == HCI_DEVCOREDUMP_DONE || |
| hdev->dump.state == HCI_DEVCOREDUMP_ABORT) |
| hci_devcd_reset(hdev); |
| hci_dev_unlock(hdev); |
| } |
| } |
| EXPORT_SYMBOL(hci_devcd_rx); |
| |
| void hci_devcd_timeout(struct work_struct *work) |
| { |
| struct hci_dev *hdev = container_of(work, struct hci_dev, |
| dump.dump_timeout.work); |
| u32 dump_size; |
| |
| hci_devcd_notify(hdev, HCI_DEVCOREDUMP_TIMEOUT); |
| |
| hci_dev_lock(hdev); |
| |
| cancel_work(&hdev->dump.dump_rx); |
| |
| hci_devcd_update_state(hdev, HCI_DEVCOREDUMP_TIMEOUT); |
| |
| dump_size = hdev->dump.tail - hdev->dump.head; |
| bt_dev_dbg(hdev, "timeout with size %u (expect %zu)", dump_size, |
| hdev->dump.alloc_size); |
| |
| /* Emit a devcoredump with the available data */ |
| dev_coredumpv(&hdev->dev, hdev->dump.head, dump_size, GFP_KERNEL); |
| |
| hci_devcd_reset(hdev); |
| |
| hci_dev_unlock(hdev); |
| } |
| EXPORT_SYMBOL(hci_devcd_timeout); |
| |
| int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump, |
| dmp_hdr_t dmp_hdr, notify_change_t notify_change) |
| { |
| /* Driver must implement coredump() and dmp_hdr() functions for |
| * bluetooth devcoredump. The coredump() should trigger a coredump |
| * event on the controller when the device's coredump sysfs entry is |
| * written to. The dmp_hdr() should create a dump header to identify |
| * the controller/fw/driver info. |
| */ |
| if (!coredump || !dmp_hdr) |
| return -EINVAL; |
| |
| hci_dev_lock(hdev); |
| hdev->dump.coredump = coredump; |
| hdev->dump.dmp_hdr = dmp_hdr; |
| hdev->dump.notify_change = notify_change; |
| hdev->dump.supported = true; |
| hdev->dump.timeout = DEVCOREDUMP_TIMEOUT; |
| hci_dev_unlock(hdev); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_register); |
| |
| static inline bool hci_devcd_enabled(struct hci_dev *hdev) |
| { |
| return hdev->dump.supported; |
| } |
| |
| int hci_devcd_init(struct hci_dev *hdev, u32 dump_size) |
| { |
| struct sk_buff *skb; |
| |
| if (!hci_devcd_enabled(hdev)) |
| return -EOPNOTSUPP; |
| |
| skb = alloc_skb(sizeof(dump_size), GFP_ATOMIC); |
| if (!skb) |
| return -ENOMEM; |
| |
| hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_INIT; |
| put_unaligned_le32(dump_size, skb_put(skb, 4)); |
| |
| skb_queue_tail(&hdev->dump.dump_q, skb); |
| queue_work(hdev->workqueue, &hdev->dump.dump_rx); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_init); |
| |
| int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb) |
| { |
| if (!skb) |
| return -ENOMEM; |
| |
| if (!hci_devcd_enabled(hdev)) { |
| kfree_skb(skb); |
| return -EOPNOTSUPP; |
| } |
| |
| hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_SKB; |
| |
| skb_queue_tail(&hdev->dump.dump_q, skb); |
| queue_work(hdev->workqueue, &hdev->dump.dump_rx); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_append); |
| |
| int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len) |
| { |
| struct hci_devcoredump_skb_pattern p; |
| struct sk_buff *skb; |
| |
| if (!hci_devcd_enabled(hdev)) |
| return -EOPNOTSUPP; |
| |
| skb = alloc_skb(sizeof(p), GFP_ATOMIC); |
| if (!skb) |
| return -ENOMEM; |
| |
| p.pattern = pattern; |
| p.len = len; |
| |
| hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_PATTERN; |
| skb_put_data(skb, &p, sizeof(p)); |
| |
| skb_queue_tail(&hdev->dump.dump_q, skb); |
| queue_work(hdev->workqueue, &hdev->dump.dump_rx); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_append_pattern); |
| |
| int hci_devcd_complete(struct hci_dev *hdev) |
| { |
| struct sk_buff *skb; |
| |
| if (!hci_devcd_enabled(hdev)) |
| return -EOPNOTSUPP; |
| |
| skb = alloc_skb(0, GFP_ATOMIC); |
| if (!skb) |
| return -ENOMEM; |
| |
| hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_COMPLETE; |
| |
| skb_queue_tail(&hdev->dump.dump_q, skb); |
| queue_work(hdev->workqueue, &hdev->dump.dump_rx); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_complete); |
| |
| int hci_devcd_abort(struct hci_dev *hdev) |
| { |
| struct sk_buff *skb; |
| |
| if (!hci_devcd_enabled(hdev)) |
| return -EOPNOTSUPP; |
| |
| skb = alloc_skb(0, GFP_ATOMIC); |
| if (!skb) |
| return -ENOMEM; |
| |
| hci_dmp_cb(skb)->pkt_type = HCI_DEVCOREDUMP_PKT_ABORT; |
| |
| skb_queue_tail(&hdev->dump.dump_q, skb); |
| queue_work(hdev->workqueue, &hdev->dump.dump_rx); |
| |
| return 0; |
| } |
| EXPORT_SYMBOL(hci_devcd_abort); |