From: "K, Kiran" <kiran.k@intel.com>
To: Marcel Holtmann <marcel@holtmann.org>
Cc: BlueZ <linux-bluetooth@vger.kernel.org>,
"Srivatsa, Ravishankar" <ravishankar.srivatsa@intel.com>,
"Tumkur Narayan, Chethan" <chethan.tumkur.narayan@intel.com>
Subject: RE: [PATCH v1] Bluetooth: Fix race condition in handling NOP command
Date: Thu, 12 Aug 2021 10:55:35 +0000 [thread overview]
Message-ID: <DM8PR11MB55733AD00D7FB779732063B4F5F99@DM8PR11MB5573.namprd11.prod.outlook.com> (raw)
In-Reply-To: <DM8PR11MB55738B15758672E2982D748AF5F39@DM8PR11MB5573.namprd11.prod.outlook.com>
Hi Marcel,
> -----Original Message-----
> From: K, Kiran
> Sent: Friday, August 6, 2021 8:14 PM
> To: 'Marcel Holtmann' <marcel@holtmann.org>
> Cc: BlueZ <linux-bluetooth@vger.kernel.org>; Srivatsa, Ravishankar
> <ravishankar.srivatsa@intel.com>; Tumkur Narayan, Chethan
> <chethan.tumkur.narayan@intel.com>
> Subject: RE: [PATCH v1] Bluetooth: Fix race condition in handling NOP
> command
>
> Hi Marcel,
>
> > -----Original Message-----
> > From: Marcel Holtmann <marcel@holtmann.org>
> > Sent: Thursday, August 5, 2021 6:41 PM
> > To: K, Kiran <kiran.k@intel.com>
> > Cc: BlueZ <linux-bluetooth@vger.kernel.org>; Srivatsa, Ravishankar
> > <ravishankar.srivatsa@intel.com>; Tumkur Narayan, Chethan
> > <chethan.tumkur.narayan@intel.com>
> > Subject: Re: [PATCH v1] Bluetooth: Fix race condition in handling NOP
> > command
> >
> > Hi Kiran,
> >
> > > For NOP command, need to cancel work scheduled on cmd_timer, on
> > > receiving command status or commmand complete event.
> > >
> > > Below use case might lead to race condition multiple when NOP
> > > commands are queued sequentially:
> > >
> > > hci_cmd_work() {
> > > if (atomic_read(&hdev->cmd_cnt) {
> > > .
> > > .
> > > .
> > > atomic_dec(&hdev->cmd_cnt);
> > > hci_send_frame(hdev,...);
> > > schedule_delayed_work(&hdev->cmd_timer,...);
> > > }
> > > }
> > >
> > > On receiving event for first NOP, the work scheduled on
> > > hdev->cmd_timer is not cancelled and second NOP is dequeued and
> > > hdev->sent
> > to controller.
> > >
> > > While waiting for an event for second NOP command, work scheduled on
> > > cmd_timer for first NOP can get scheduled, resulting in sending
> > > third NOP command not waiting for an event for second NOP. This
> > > might cause issues at controller side (like memory overrun,
> > > controller going
> > > unresponsive) resulting in hci tx timeouts, hardware errors etc.
> > >
> > > Signed-off-by: Kiran K <kiran.k@intel.com>
> > > Reviewed-by: Chethan T N <chethan.tumkur.narayan@intel.com>
> > > Reviewed-by: Srivatsa Ravishankar <ravishankar.srivatsa@intel.com>
> > > ---
> > > net/bluetooth/hci_event.c | 3 +--
> > > 1 file changed, 1 insertion(+), 2 deletions(-)
> > >
> > > diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> > > index ea7fc09478be..14dfbdc8b81b 100644
> > > --- a/net/bluetooth/hci_event.c
> > > +++ b/net/bluetooth/hci_event.c
> > > @@ -3271,8 +3271,7 @@ static void hci_remote_features_evt(struct
> > > hci_dev *hdev, static inline void handle_cmd_cnt_and_timer(struct
> > > hci_dev
> > *hdev,
> > > u16 opcode, u8 ncmd)
> > > {
> > > - if (opcode != HCI_OP_NOP)
> > > - cancel_delayed_work(&hdev->cmd_timer);
> > > + cancel_delayed_work(&hdev->cmd_timer);
> > >
> > > if (!test_bit(HCI_RESET, &hdev->flags)) {
> > > if (ncmd) {
> >
> > so this is conflicting with the patch introducing the ncmd timeout handling.
> >
> My patch specifically addresses the issue observed in case of NOP command.
> It prevents the issue by handling NOP same as any other SIG command.
>
> It looks commit de75cd0d9b2f3250d5f25846bb5632ccce6275f4 tries to
> recover when controller goes bad.
>
Do you have any further comments here ? Waiting for your input.
> > commit de75cd0d9b2f3250d5f25846bb5632ccce6275f4
> > Author: Manish Mandlik <mmandlik@google.com>
> > Date: Thu Apr 29 10:24:22 2021 -0700
> >
> > Bluetooth: Add ncmd=0 recovery handling
> >
> > During command status or command complete event, the controller
> > may set
> > ncmd=0 indicating that it is not accepting any more commands. In such a
> > case, host holds off sending any more commands to the controller. If the
> > controller doesn't recover from such condition, host will wait forever,
> > until the user decides that the Bluetooth is broken and may power cycles
> > the Bluetooth.
> >
> > This patch triggers the hardware error to reset the controller and
> > driver when it gets into such state as there is no other wat out.
> >
> > Nowhere in your commit description you are addressing why is this the
> > right to do.
> >
>
> Will fix it in the next version if you are OK with the current fix. Please let me
> know.
>
> > Regards
> >
> > Marcel
>
> Thanks,
> Kiran
Thanks,
Kiran
next prev parent reply other threads:[~2021-08-12 10:55 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-04 17:39 [PATCH v1] Bluetooth: Fix race condition in handling NOP command Kiran K
2021-08-04 18:13 ` [v1] " bluez.test.bot
2021-08-05 13:11 ` [PATCH v1] " Marcel Holtmann
2021-08-06 14:44 ` K, Kiran
2021-08-12 10:55 ` K, Kiran [this message]
2021-08-12 17:31 ` Luiz Augusto von Dentz
[not found] ` <CAGPPCLDsqa6Ae3rMOXaVAOsnvPTF3b-5ybdPbD2LptcMaCfhWA@mail.gmail.com>
2021-08-15 23:29 ` K, Kiran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DM8PR11MB55733AD00D7FB779732063B4F5F99@DM8PR11MB5573.namprd11.prod.outlook.com \
--to=kiran.k@intel.com \
--cc=chethan.tumkur.narayan@intel.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=ravishankar.srivatsa@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).