Re: [PATCH v2 12/14] Bluetooth: Update background scan and report device based on advertisement monitors

Re: [PATCH v2 12/14] Bluetooth: Update background scan and report device based on advertisement monitors

[Marek Szyprowski]

Hi

On 17.06.2020 16:39, Marcel Holtmann wrote:
> From: Miao-chen Chou <mcchou@chromium.org>
>
> This calls hci_update_background_scan() when there is any update on the
> advertisement monitors. If there is at least one advertisement monitor,
> the filtering policy of scan parameters should be 0x00. This also reports
> device found mgmt events if there is at least one monitor.
>
> The following cases were tested with btmgmt advmon-* commands.
> (1) add a ADV monitor and observe that the passive scanning is
> triggered.
> (2) remove the last ADV monitor and observe that the passive scanning is
> terminated.
> (3) with a LE peripheral paired, repeat (1) and observe the passive
> scanning continues.
> (4) with a LE peripheral paired, repeat (2) and observe the passive
> scanning continues.
> (5) with a ADV monitor, suspend/resume the host and observe the passive
> scanning continues.
>
> Signed-off-by: Miao-chen Chou <mcchou@chromium.org>
> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

This patch landed recently in linux-next as commit 8208f5a9d435 
("Bluetooth: Update background scan and report device based on 
advertisement monitors").

It causes a regression, a kernel oops during system suspend/resume cycle 
on Samsung Exynos5250 based Snow Chromebook:

8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = 86c149f5
[00000000] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in: cmac cros_ec_sysfs cros_ec_lightbar cros_ec_debugfs 
cros_ec_chardev cros_ec_keyb cros_ec_dev snd_soc_hdmi_codec cros_ec_i2c 
cros_ec snd_soc_snow snd_soc_i2s snd_soc_idma snd_soc_s3c_dma exynosdrm 
analogix_dp exynos_gsc v4l2_mem2mem snd_soc_max98095 snd_soc_core 
ac97_bus snd_pcm_dmaengine snd_pcm snd_timer nxp_ptn3460 snd soundcore 
pwm_samsung spi_s3c64xx cyapatp crc_itu_t mwifiex_sdio mwifiex 
sha256_generic libsha256 sha256_arm btmrvl_sdio btmrvl cfg80211 
bluetooth s5p_mfc governor_simpleondemand videobuf2_dma_contig 
videobuf2_memops videobuf2_v4l2 ecdh_generic ecc videobuf2_common 
videodev phy_exynos_usb2 ohci_exynos panfrost gpu_sched mc s3c2410_wdt 
s5p_sss s5p_cec exynos_rng rtc_s3c i2c_arb_gpio_challenge
CPU: 1 PID: 16 Comm: kworker/1:0 Not tainted 
5.7.0-rc7-02995-g8208f5a9d435 #8564
Hardware name: Samsung Exynos (Flattened Device Tree)
Workqueue: events_freezable mmc_rescan
PC is at __queue_work+0x6c/0x4e8
LR is at __queue_work+0x68/0x4e8
pc : [<c03619d8>]    lr : [<c03619d4>]    psr: 60000093
...
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 10c5387d  Table: 6be2406a  DAC: 00000051
Process kworker/1:0 (pid: 16, stack limit = 0xf9898f75)
Stack: (0xee117de0 to 0xee118000)
...
[<c03619d8>] (__queue_work) from [<c0361e94>] (queue_work_on+0x40/0x4c)
[<c0361e94>] (queue_work_on) from [<bf17dd0c>] 
(hci_adv_monitors_clear+0x74/0x90 [bluetooth])
[<bf17dd0c>] (hci_adv_monitors_clear [bluetooth]) from [<bf17e138>] 
(hci_unregister_dev+0x158/0x224 [bluetooth])
[<bf17e138>] (hci_unregister_dev [bluetooth]) from [<bf1d1638>] 
(btmrvl_remove_card+0x58/0x7c [btmrvl])
[<bf1d1638>] (btmrvl_remove_card [btmrvl]) from [<c0d09698>] 
(sdio_bus_remove+0x30/0x11c)
[<c0d09698>] (sdio_bus_remove) from [<c09d534c>] 
(device_release_driver_internal+0xe8/0x1ac)
[<c09d534c>] (device_release_driver_internal) from [<c09d3e18>] 
(bus_remove_device+0xcc/0xf8)
[<c09d3e18>] (bus_remove_device) from [<c09cfa3c>] (device_del+0x15c/0x384)
[<c09cfa3c>] (device_del) from [<c0d098b8>] (sdio_remove_func+0x20/0x34)
[<c0d098b8>] (sdio_remove_func) from [<c0d075bc>] 
(mmc_sdio_remove+0x38/0x64)
[<c0d075bc>] (mmc_sdio_remove) from [<c0d08858>] (mmc_sdio_detect+0x6c/0xf8)
[<c0d08858>] (mmc_sdio_detect) from [<c0cff6f0>] (mmc_rescan+0x1d0/0x42c)
[<c0cff6f0>] (mmc_rescan) from [<c0362454>] (process_one_work+0x178/0x4ac)
[<c0362454>] (process_one_work) from [<c0362b44>] (worker_thread+0x2c/0x530)
[<c0362b44>] (worker_thread) from [<c0368610>] (kthread+0x12c/0x158)
[<c0368610>] (kthread) from [<c03001a8>] (ret_from_fork+0x14/0x2c)
Exception stack(0xee117fb0 to 0xee117ff8)
...
---[ end trace 0ec00d142e0a49cf ]---

This board uses btmrvl_sdio bluetooth driver if that helps. Reverting 
this commit in linux-next 20200629 'fixes' the issue.

I can do more tests if needed on this hardware, just let me know how can 
I help and what to do.

> ---
>   include/net/bluetooth/hci_core.h |  1 +
>   net/bluetooth/hci_core.c         | 13 +++++++++++++
>   net/bluetooth/hci_event.c        |  5 +++--
>   net/bluetooth/hci_request.c      | 17 ++++++++++++++---
>   net/bluetooth/mgmt.c             |  5 ++++-
>   5 files changed, 35 insertions(+), 6 deletions(-)

 > ...

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland

Re: [PATCH v2 12/14] Bluetooth: Update background scan and report device based on advertisement monitors

[Marcel Holtmann]

Hi Marek,

>> This calls hci_update_background_scan() when there is any update on the
>> advertisement monitors. If there is at least one advertisement monitor,
>> the filtering policy of scan parameters should be 0x00. This also reports
>> device found mgmt events if there is at least one monitor.
>> 
>> The following cases were tested with btmgmt advmon-* commands.
>> (1) add a ADV monitor and observe that the passive scanning is
>> triggered.
>> (2) remove the last ADV monitor and observe that the passive scanning is
>> terminated.
>> (3) with a LE peripheral paired, repeat (1) and observe the passive
>> scanning continues.
>> (4) with a LE peripheral paired, repeat (2) and observe the passive
>> scanning continues.
>> (5) with a ADV monitor, suspend/resume the host and observe the passive
>> scanning continues.
>> 
>> Signed-off-by: Miao-chen Chou <mcchou@chromium.org>
>> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
> 
> This patch landed recently in linux-next as commit 8208f5a9d435 
> ("Bluetooth: Update background scan and report device based on 
> advertisement monitors").
> 
> It causes a regression, a kernel oops during system suspend/resume cycle 
> on Samsung Exynos5250 based Snow Chromebook:
> 
> 8<--- cut here ---
> Unable to handle kernel NULL pointer dereference at virtual address 00000000
> pgd = 86c149f5
> [00000000] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in: cmac cros_ec_sysfs cros_ec_lightbar cros_ec_debugfs 
> cros_ec_chardev cros_ec_keyb cros_ec_dev snd_soc_hdmi_codec cros_ec_i2c 
> cros_ec snd_soc_snow snd_soc_i2s snd_soc_idma snd_soc_s3c_dma exynosdrm 
> analogix_dp exynos_gsc v4l2_mem2mem snd_soc_max98095 snd_soc_core 
> ac97_bus snd_pcm_dmaengine snd_pcm snd_timer nxp_ptn3460 snd soundcore 
> pwm_samsung spi_s3c64xx cyapatp crc_itu_t mwifiex_sdio mwifiex 
> sha256_generic libsha256 sha256_arm btmrvl_sdio btmrvl cfg80211 
> bluetooth s5p_mfc governor_simpleondemand videobuf2_dma_contig 
> videobuf2_memops videobuf2_v4l2 ecdh_generic ecc videobuf2_common 
> videodev phy_exynos_usb2 ohci_exynos panfrost gpu_sched mc s3c2410_wdt 
> s5p_sss s5p_cec exynos_rng rtc_s3c i2c_arb_gpio_challenge
> CPU: 1 PID: 16 Comm: kworker/1:0 Not tainted 
> 5.7.0-rc7-02995-g8208f5a9d435 #8564
> Hardware name: Samsung Exynos (Flattened Device Tree)
> Workqueue: events_freezable mmc_rescan
> PC is at __queue_work+0x6c/0x4e8
> LR is at __queue_work+0x68/0x4e8
> pc : [<c03619d8>]    lr : [<c03619d4>]    psr: 60000093
> ...
> Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
> Control: 10c5387d  Table: 6be2406a  DAC: 00000051
> Process kworker/1:0 (pid: 16, stack limit = 0xf9898f75)
> Stack: (0xee117de0 to 0xee118000)
> ...
> [<c03619d8>] (__queue_work) from [<c0361e94>] (queue_work_on+0x40/0x4c)
> [<c0361e94>] (queue_work_on) from [<bf17dd0c>] 
> (hci_adv_monitors_clear+0x74/0x90 [bluetooth])
> [<bf17dd0c>] (hci_adv_monitors_clear [bluetooth]) from [<bf17e138>] 
> (hci_unregister_dev+0x158/0x224 [bluetooth])
> [<bf17e138>] (hci_unregister_dev [bluetooth]) from [<bf1d1638>] 
> (btmrvl_remove_card+0x58/0x7c [btmrvl])
> [<bf1d1638>] (btmrvl_remove_card [btmrvl]) from [<c0d09698>] 
> (sdio_bus_remove+0x30/0x11c)
> [<c0d09698>] (sdio_bus_remove) from [<c09d534c>] 
> (device_release_driver_internal+0xe8/0x1ac)
> [<c09d534c>] (device_release_driver_internal) from [<c09d3e18>] 
> (bus_remove_device+0xcc/0xf8)
> [<c09d3e18>] (bus_remove_device) from [<c09cfa3c>] (device_del+0x15c/0x384)
> [<c09cfa3c>] (device_del) from [<c0d098b8>] (sdio_remove_func+0x20/0x34)
> [<c0d098b8>] (sdio_remove_func) from [<c0d075bc>] 
> (mmc_sdio_remove+0x38/0x64)
> [<c0d075bc>] (mmc_sdio_remove) from [<c0d08858>] (mmc_sdio_detect+0x6c/0xf8)
> [<c0d08858>] (mmc_sdio_detect) from [<c0cff6f0>] (mmc_rescan+0x1d0/0x42c)
> [<c0cff6f0>] (mmc_rescan) from [<c0362454>] (process_one_work+0x178/0x4ac)
> [<c0362454>] (process_one_work) from [<c0362b44>] (worker_thread+0x2c/0x530)
> [<c0362b44>] (worker_thread) from [<c0368610>] (kthread+0x12c/0x158)
> [<c0368610>] (kthread) from [<c03001a8>] (ret_from_fork+0x14/0x2c)
> Exception stack(0xee117fb0 to 0xee117ff8)
> ...
> ---[ end trace 0ec00d142e0a49cf ]---
> 
> This board uses btmrvl_sdio bluetooth driver if that helps. Reverting 
> this commit in linux-next 20200629 'fixes' the issue.
> 
> I can do more tests if needed on this hardware, just let me know how can 
> I help and what to do.

can you check latest bluetooth-next. I think that we applied a fix for it.

Regards

Marcel

Re: [PATCH v2 12/14] Bluetooth: Update background scan and report device based on advertisement monitors

[Marek Szyprowski]

Hi Marcel,

On 30.06.2020 08:49, Marcel Holtmann wrote:
>>> This calls hci_update_background_scan() when there is any update on the
>>> advertisement monitors. If there is at least one advertisement monitor,
>>> the filtering policy of scan parameters should be 0x00. This also reports
>>> device found mgmt events if there is at least one monitor.
>>>
>>> The following cases were tested with btmgmt advmon-* commands.
>>> (1) add a ADV monitor and observe that the passive scanning is
>>> triggered.
>>> (2) remove the last ADV monitor and observe that the passive scanning is
>>> terminated.
>>> (3) with a LE peripheral paired, repeat (1) and observe the passive
>>> scanning continues.
>>> (4) with a LE peripheral paired, repeat (2) and observe the passive
>>> scanning continues.
>>> (5) with a ADV monitor, suspend/resume the host and observe the passive
>>> scanning continues.
>>>
>>> Signed-off-by: Miao-chen Chou <mcchou@chromium.org>
>>> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
>> This patch landed recently in linux-next as commit 8208f5a9d435
>> ("Bluetooth: Update background scan and report device based on
>> advertisement monitors").
>>
>> It causes a regression, a kernel oops during system suspend/resume cycle
>> on Samsung Exynos5250 based Snow Chromebook:
>>
>> 8<--- cut here ---
>> Unable to handle kernel NULL pointer dereference at virtual address 00000000
>> pgd = 86c149f5
>> [00000000] *pgd=00000000
>> Internal error: Oops: 5 [#1] SMP ARM
>> Modules linked in: cmac cros_ec_sysfs cros_ec_lightbar cros_ec_debugfs
>> cros_ec_chardev cros_ec_keyb cros_ec_dev snd_soc_hdmi_codec cros_ec_i2c
>> cros_ec snd_soc_snow snd_soc_i2s snd_soc_idma snd_soc_s3c_dma exynosdrm
>> analogix_dp exynos_gsc v4l2_mem2mem snd_soc_max98095 snd_soc_core
>> ac97_bus snd_pcm_dmaengine snd_pcm snd_timer nxp_ptn3460 snd soundcore
>> pwm_samsung spi_s3c64xx cyapatp crc_itu_t mwifiex_sdio mwifiex
>> sha256_generic libsha256 sha256_arm btmrvl_sdio btmrvl cfg80211
>> bluetooth s5p_mfc governor_simpleondemand videobuf2_dma_contig
>> videobuf2_memops videobuf2_v4l2 ecdh_generic ecc videobuf2_common
>> videodev phy_exynos_usb2 ohci_exynos panfrost gpu_sched mc s3c2410_wdt
>> s5p_sss s5p_cec exynos_rng rtc_s3c i2c_arb_gpio_challenge
>> CPU: 1 PID: 16 Comm: kworker/1:0 Not tainted
>> 5.7.0-rc7-02995-g8208f5a9d435 #8564
>> Hardware name: Samsung Exynos (Flattened Device Tree)
>> Workqueue: events_freezable mmc_rescan
>> PC is at __queue_work+0x6c/0x4e8
>> LR is at __queue_work+0x68/0x4e8
>> pc : [<c03619d8>]    lr : [<c03619d4>]    psr: 60000093
>> ...
>> Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
>> Control: 10c5387d  Table: 6be2406a  DAC: 00000051
>> Process kworker/1:0 (pid: 16, stack limit = 0xf9898f75)
>> Stack: (0xee117de0 to 0xee118000)
>> ...
>> [<c03619d8>] (__queue_work) from [<c0361e94>] (queue_work_on+0x40/0x4c)
>> [<c0361e94>] (queue_work_on) from [<bf17dd0c>]
>> (hci_adv_monitors_clear+0x74/0x90 [bluetooth])
>> [<bf17dd0c>] (hci_adv_monitors_clear [bluetooth]) from [<bf17e138>]
>> (hci_unregister_dev+0x158/0x224 [bluetooth])
>> [<bf17e138>] (hci_unregister_dev [bluetooth]) from [<bf1d1638>]
>> (btmrvl_remove_card+0x58/0x7c [btmrvl])
>> [<bf1d1638>] (btmrvl_remove_card [btmrvl]) from [<c0d09698>]
>> (sdio_bus_remove+0x30/0x11c)
>> [<c0d09698>] (sdio_bus_remove) from [<c09d534c>]
>> (device_release_driver_internal+0xe8/0x1ac)
>> [<c09d534c>] (device_release_driver_internal) from [<c09d3e18>]
>> (bus_remove_device+0xcc/0xf8)
>> [<c09d3e18>] (bus_remove_device) from [<c09cfa3c>] (device_del+0x15c/0x384)
>> [<c09cfa3c>] (device_del) from [<c0d098b8>] (sdio_remove_func+0x20/0x34)
>> [<c0d098b8>] (sdio_remove_func) from [<c0d075bc>]
>> (mmc_sdio_remove+0x38/0x64)
>> [<c0d075bc>] (mmc_sdio_remove) from [<c0d08858>] (mmc_sdio_detect+0x6c/0xf8)
>> [<c0d08858>] (mmc_sdio_detect) from [<c0cff6f0>] (mmc_rescan+0x1d0/0x42c)
>> [<c0cff6f0>] (mmc_rescan) from [<c0362454>] (process_one_work+0x178/0x4ac)
>> [<c0362454>] (process_one_work) from [<c0362b44>] (worker_thread+0x2c/0x530)
>> [<c0362b44>] (worker_thread) from [<c0368610>] (kthread+0x12c/0x158)
>> [<c0368610>] (kthread) from [<c03001a8>] (ret_from_fork+0x14/0x2c)
>> Exception stack(0xee117fb0 to 0xee117ff8)
>> ...
>> ---[ end trace 0ec00d142e0a49cf ]---
>>
>> This board uses btmrvl_sdio bluetooth driver if that helps. Reverting
>> this commit in linux-next 20200629 'fixes' the issue.
>>
>> I can do more tests if needed on this hardware, just let me know how can
>> I help and what to do.
> can you check latest bluetooth-next. I think that we applied a fix for it.

Indeed. Commit f2790f025a0e ("Bluetooth: fix kernel null pointer 
dereference error on suspend") fixed the issue.

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland