linux-kernel - Re: [PATCH 1/2] Bluetooth: btusb: Record debug log for Mediatek Chip.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <35B0FA64-903D-4747-8D39-4FA48D30A680@holtmann.org>
Date:   Wed, 9 Jun 2021 21:17:52 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     mark-yw.chen@...iatek.com
Cc:     Johan Hedberg <johan.hedberg@...il.com>, chris.lu@...iatek.com,
        will-cy.lee@...iatek.com, Sean Wang <sean.wang@...iatek.com>,
        Bluez mailing list <linux-bluetooth@...r.kernel.org>,
        linux-mediatek@...ts.infradead.org,
        open list <linux-kernel@...r.kernel.org>,
        michaelfsun@...gle.com, shawnku@...gle.com, jemele@...gle.com
Subject: Re: [PATCH 1/2] Bluetooth: btusb: Record debug log for Mediatek Chip.

Hi Mark,

> 1. Add btusb_recv_bulk_mtk to receive debug log.
> 2. Send the debug log via hci_recv_diag channel.
> 3. The upper layerd use hci_channel_minitor to receive
>   these packets.
> 
> Signed-off-by: mark-yw.chen <mark-yw.chen@...iatek.com>
> ---
> drivers/bluetooth/btusb.c | 67 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 67 insertions(+)
> 
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index b015dcecfb13..2a55ae0a5f8c 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -3851,6 +3851,72 @@ static int btusb_mtk_shutdown(struct hci_dev *hdev)
> 	return 0;
> }
> 
> +static int btusb_recv_bulk_mtk(struct btusb_data *data, void *buffer, int count)
> +{
> +	struct sk_buff *skb;
> +	unsigned long flags;
> +	int err = 0;
> +
> +	spin_lock_irqsave(&data->rxlock, flags);
> +	skb = data->acl_skb;
> +
> +	while (count) {
> +		int len;
> +
> +		if (!skb) {
> +			skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
> +			if (!skb) {
> +				err = -ENOMEM;
> +				break;
> +			}
> +
> +			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
> +			hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
> +		}
> +
> +		len = min_t(uint, hci_skb_expect(skb), count);
> +		skb_put_data(skb, buffer, len);
> +
> +		count -= len;
> +		buffer += len;
> +		hci_skb_expect(skb) -= len;
> +
> +		if (skb->len == HCI_ACL_HDR_SIZE) {
> +			__le16 dlen = hci_acl_hdr(skb)->dlen;
> +
> +			/* Complete ACL header */
> +			hci_skb_expect(skb) = __le16_to_cpu(dlen);
> +
> +			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
> +				kfree_skb(skb);
> +				skb = NULL;
> +
> +				err = -EILSEQ;
> +				break;
> +			}
> +		}
> +
> +		if (!hci_skb_expect(skb)) {
> +			/* Complete frame */
> +			if (skb->data[0] == 0x6f && skb->data[1] == 0xfc) {
> +				usb_disable_autosuspend(data->udev);
> +				hci_recv_diag(data->hdev, skb);
> +			} else if ((skb->data[0] == 0xfe || skb->data[0] == 0xff) &&
> +				   skb->data[1] == 0x05) {
> +				hci_recv_diag(data->hdev, skb);
> +			} else {
> +				hci_recv_frame(data->hdev, skb);
> +			}
> +			skb = NULL;
> +		}
> +	}
> +
> +	data->acl_skb = skb;
> +	spin_unlock_irqrestore(&data->rxlock, flags);
> +
> +	return err;
> +}
> +
> MODULE_FIRMWARE(FIRMWARE_MT7663);
> MODULE_FIRMWARE(FIRMWARE_MT7668);
> 
> @@ -4669,6 +4735,7 @@ static int btusb_probe(struct usb_interface *intf,
> 		hdev->setup = btusb_mtk_setup;
> 		hdev->shutdown = btusb_mtk_shutdown;
> 		hdev->manufacturer = 70;
> +		data->recv_bulk = btusb_recv_bulk_mtk;
> 		set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);

NO. The recv_bulk was meant for cases when bulk was faster and needed to redirected as interrupt/event data. Doing a complete copy of btusb_recv_bulk is not acceptable. You need to introduce data->recv_acl.

Regards

Marcel