You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mynewt.apache.org by ja...@apache.org on 2019/07/24 08:22:34 UTC
[mynewt-nimble] branch 1_2_0_dev updated (0678bae -> a7ebf29)
This is an automated email from the ASF dual-hosted git repository.
janc pushed a change to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git.
from 0678bae Apache NimBLE 1.2.0 release
new 0c67261 nimble/ll: Fix dtm stop
new d751f05 nimble/mesh: Fix null pointer access on prov_init
new 6039e4a nimble/ll: Enlarge critical section when stoping scanning
new 7d2ba57 nimble/ll: Remove pointer to unreferenced aux_data
new 45d28fd nimble/phy: Fix memblock overwrite on PDU copy
new a7ebf29 nimble/ll: Workaround and traces for the possible race scenario
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
nimble/controller/src/ble_ll_conn.c | 31 +++++++++++++++++++++++++++++++
nimble/controller/src/ble_ll_dtm.c | 4 +---
nimble/controller/src/ble_ll_scan.c | 6 +++---
nimble/drivers/nrf51/src/ble_phy.c | 13 ++++++++-----
nimble/drivers/nrf52/src/ble_phy.c | 5 ++++-
nimble/host/mesh/src/proxy.c | 4 +++-
6 files changed, 50 insertions(+), 13 deletions(-)
[mynewt-nimble] 01/06: nimble/ll: Fix dtm stop
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 0c67261ea07dea4c588552fb715f40add1fd199d
Author: JustineKH <ju...@juul.com>
AuthorDate: Wed Jul 17 16:04:08 2019 -0700
nimble/ll: Fix dtm stop
---
nimble/controller/src/ble_ll_dtm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/nimble/controller/src/ble_ll_dtm.c b/nimble/controller/src/ble_ll_dtm.c
index 8d561e0..c78a4b2 100644
--- a/nimble/controller/src/ble_ll_dtm.c
+++ b/nimble/controller/src/ble_ll_dtm.c
@@ -424,7 +424,6 @@ ble_ll_dtm_ctx_free(struct dtm_ctx * ctx)
OS_EXIT_CRITICAL(sr);
return;
}
- OS_EXIT_CRITICAL(sr);
ble_ll_sched_rmv_elem(&ctx->sch);
ble_npl_eventq_remove(&g_ble_ll_data.ll_evq, &g_ble_ll_dtm_ctx.evt);
@@ -433,13 +432,12 @@ ble_ll_dtm_ctx_free(struct dtm_ctx * ctx)
ble_phy_disable_dtm();
ble_ll_state_set(BLE_LL_STATE_STANDBY);
#ifdef BLE_XCVR_RFCLK
- OS_ENTER_CRITICAL(sr);
ble_ll_xcvr_rfclk_stop();
- OS_EXIT_CRITICAL(sr);
#endif
os_mbuf_free_chain(ctx->om);
memset(ctx, 0, sizeof(*ctx));
+ OS_EXIT_CRITICAL(sr);
}
int
[mynewt-nimble] 06/06: nimble/ll: Workaround and traces for the
possible race scenario
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit a7ebf297fc17468893793d74def1217f792e980a
Author: Łukasz Rymanowski <lu...@codecoup.pl>
AuthorDate: Tue Jul 16 21:23:35 2019 +0200
nimble/ll: Workaround and traces for the possible race scenario
It looks like there is a race when closing connection with different
paths. It can lead to situation that Nimble tries to close connsm which is
already in IDLE, which leads to crash when removing connsm from
g_ble_ll_conn_active_list which does not contain connsm.
This patch adds workaround and plus assert and stats which should help
to understand the root cause
---
nimble/controller/src/ble_ll_conn.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c
index 17dc3b7..be11285 100644
--- a/nimble/controller/src/ble_ll_conn.c
+++ b/nimble/controller/src/ble_ll_conn.c
@@ -179,6 +179,8 @@ STATS_SECT_START(ble_ll_conn_stats)
STATS_SECT_ENTRY(tx_l2cap_bytes)
STATS_SECT_ENTRY(tx_empty_pdus)
STATS_SECT_ENTRY(mic_failures)
+ STATS_SECT_ENTRY(sched_start_in_idle)
+ STATS_SECT_ENTRY(sched_end_in_idle)
STATS_SECT_END
STATS_SECT_DECL(ble_ll_conn_stats) ble_ll_conn_stats;
@@ -209,6 +211,8 @@ STATS_NAME_START(ble_ll_conn_stats)
STATS_NAME(ble_ll_conn_stats, tx_l2cap_bytes)
STATS_NAME(ble_ll_conn_stats, tx_empty_pdus)
STATS_NAME(ble_ll_conn_stats, mic_failures)
+ STATS_NAME(ble_ll_conn_stats, sched_start_in_idle)
+ STATS_NAME(ble_ll_conn_stats, sched_end_in_idle)
STATS_NAME_END(ble_ll_conn_stats)
static void ble_ll_conn_event_end(struct ble_npl_event *ev);
@@ -1162,6 +1166,15 @@ ble_ll_conn_event_start_cb(struct ble_ll_sched_item *sch)
connsm = (struct ble_ll_conn_sm *)sch->cb_arg;
g_ble_ll_conn_cur_sm = connsm;
BLE_LL_ASSERT(connsm);
+ if (connsm->conn_state == BLE_LL_CONN_STATE_IDLE) {
+ /* That should not happen. If it does it means connection
+ * is already closed
+ */
+ STATS_INC(ble_ll_conn_stats, sched_start_in_idle);
+ BLE_LL_ASSERT(0);
+ ble_ll_conn_current_sm_over(connsm);
+ return BLE_LL_SCHED_STATE_DONE;
+ }
/* Log connection event start */
ble_ll_trace_u32(BLE_LL_TRACE_ID_CONN_EV_START, connsm->conn_handle);
@@ -2280,6 +2293,24 @@ ble_ll_conn_event_end(struct ble_npl_event *ev)
/* Better be a connection state machine! */
connsm = (struct ble_ll_conn_sm *)ble_npl_event_get_arg(ev);
BLE_LL_ASSERT(connsm);
+ if (connsm->conn_state == BLE_LL_CONN_STATE_IDLE) {
+ /* That should not happen. If it does it means connection
+ * is already closed.
+ * Make sure LL state machine is in idle
+ */
+ STATS_INC(ble_ll_conn_stats, sched_end_in_idle);
+ BLE_LL_ASSERT(0);
+
+ /* Just in case */
+ ble_ll_state_set(BLE_LL_STATE_STANDBY);
+
+ ble_ll_scan_chk_resume();
+#ifdef BLE_XCVR_RFCLK
+ ble_ll_sched_rfclk_chk_restart();
+#endif
+
+ return;
+ }
/* Log event end */
ble_ll_trace_u32x2(BLE_LL_TRACE_ID_CONN_EV_END, connsm->conn_handle,
[mynewt-nimble] 04/06: nimble/ll: Remove pointer to unreferenced
aux_data
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 7d2ba57141b3c1d4ac20bbb7cf05a126623493da
Author: Łukasz Rymanowski <lu...@codecoup.pl>
AuthorDate: Mon Jul 22 22:20:41 2019 +0200
nimble/ll: Remove pointer to unreferenced aux_data
When removing aux scheduler entry from the scheduler, make sure to remove
the reference to the aux_data.
---
nimble/controller/src/ble_ll_scan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index 71be964..4fcdc62 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -1171,6 +1171,7 @@ static void
ble_ll_scan_sched_remove(struct ble_ll_sched_item *sch)
{
ble_ll_scan_aux_data_unref(sch->cb_arg);
+ sch->cb_arg = NULL;
}
#endif
/**
[mynewt-nimble] 05/06: nimble/phy: Fix memblock overwrite on PDU
copy
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 45d28fd14317508e9784fc90d35dd333bd832269
Author: Andrzej Kaczmarek <an...@codecoup.pl>
AuthorDate: Tue Jul 23 03:43:57 2019 +0200
nimble/phy: Fix memblock overwrite on PDU copy
Optimized ble_phy_rxpdu_copy (f19002e9) can overwrite header of adjacent
block at specific payload lengths.
This happens if length of data that should be copied to last mbuf in
chain is less than 4 bytes of data. In such case the last but one mbuf
is already full when remaining data are appended to it beyond its data
buffer effectively overwriting adjacent buffer.
We should always check if there is enough space in current mbuf to copy
data. If not, we just advance to next mbuf in chain. Even in such case
there will be free mbuf to store remaining few bytes of data as this is
guaranteed by ble_ll_rxpdu_alloc.
---
nimble/drivers/nrf51/src/ble_phy.c | 13 ++++++++-----
nimble/drivers/nrf52/src/ble_phy.c | 5 ++++-
2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/nimble/drivers/nrf51/src/ble_phy.c b/nimble/drivers/nrf51/src/ble_phy.c
index baa0208..1ce3ed9 100644
--- a/nimble/drivers/nrf51/src/ble_phy.c
+++ b/nimble/drivers/nrf51/src/ble_phy.c
@@ -210,6 +210,7 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
uint32_t rem_len;
uint32_t copy_len;
uint32_t block_len;
+ uint32_t block_rem_len;
void *dst;
void *src;
struct os_mbuf * om;
@@ -234,12 +235,14 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
* Always copy blocks of length aligned to word size, only last mbuf
* will have remaining non-word size bytes appended.
*/
+ block_rem_len = copy_len;
copy_len = min(copy_len, rem_len);
copy_len &= ~3;
dst = om->om_data;
om->om_len = copy_len;
rem_len -= copy_len;
+ block_rem_len -= copy_len;
__asm__ volatile (".syntax unified \n"
" mov r4, %[len] \n"
@@ -250,13 +253,13 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
" bpl 1b \n"
" adds %[src], %[src], r4 \n"
" adds %[dst], %[dst], r4 \n"
- : [dst] "+r" (dst), [src] "+r" (src),
- [len] "+r" (copy_len)
+ : [dst] "+l" (dst), [src] "+l" (src),
+ [len] "+l" (copy_len)
:
: "r3", "r4", "memory"
);
- if (rem_len < 4) {
+ if ((rem_len < 4) && (block_rem_len >= rem_len)) {
break;
}
@@ -273,8 +276,8 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
" strb r3, [%[dst], %[len]] \n"
"2: subs %[len], #1 \n"
" bpl 1b \n"
- : [len] "+r" (rem_len)
- : [dst] "r" (dst), [src] "r" (src)
+ : [len] "+l" (rem_len)
+ : [dst] "l" (dst), [src] "l" (src)
: "r3", "memory"
);
diff --git a/nimble/drivers/nrf52/src/ble_phy.c b/nimble/drivers/nrf52/src/ble_phy.c
index e49c7a1..7a499fd 100644
--- a/nimble/drivers/nrf52/src/ble_phy.c
+++ b/nimble/drivers/nrf52/src/ble_phy.c
@@ -400,6 +400,7 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
uint32_t rem_len;
uint32_t copy_len;
uint32_t block_len;
+ uint32_t block_rem_len;
void *dst;
void *src;
struct os_mbuf * om;
@@ -424,12 +425,14 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
* Always copy blocks of length aligned to word size, only last mbuf
* will have remaining non-word size bytes appended.
*/
+ block_rem_len = copy_len;
copy_len = min(copy_len, rem_len);
copy_len &= ~3;
dst = om->om_data;
om->om_len = copy_len;
rem_len -= copy_len;
+ block_rem_len -= copy_len;
__asm__ volatile (".syntax unified \n"
" mov r4, %[len] \n"
@@ -446,7 +449,7 @@ ble_phy_rxpdu_copy(uint8_t *dptr, struct os_mbuf *rxpdu)
: "r3", "r4", "memory"
);
- if (rem_len < 4) {
+ if ((rem_len < 4) && (block_rem_len >= rem_len)) {
break;
}
[mynewt-nimble] 02/06: nimble/mesh: Fix null pointer access on
prov_init
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit d751f05139a05463e74f733159c1eacdd566b803
Author: Michał Narajowski <mi...@codecoup.pl>
AuthorDate: Wed Jul 17 11:59:24 2019 +0200
nimble/mesh: Fix null pointer access on prov_init
During bt_mesh_prov_init() a bt_mesh_proxy_get_buf() function
is called that returns a buffer that tries to initialize
unallocated buffer. With this patch we just return NULL
here, and then the buffer is allocated after Proxy is initialized.
---
nimble/host/mesh/src/proxy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/nimble/host/mesh/src/proxy.c b/nimble/host/mesh/src/proxy.c
index 1465940..609da54 100644
--- a/nimble/host/mesh/src/proxy.c
+++ b/nimble/host/mesh/src/proxy.c
@@ -681,7 +681,9 @@ struct os_mbuf *bt_mesh_proxy_get_buf(void)
{
struct os_mbuf *buf = clients[0].buf;
- net_buf_simple_init(buf, 0);
+ if (buf != NULL) {
+ net_buf_simple_init(buf, 0);
+ }
return buf;
}
[mynewt-nimble] 03/06: nimble/ll: Enlarge critical section when
stoping scanning
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
janc pushed a commit to branch 1_2_0_dev
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git
commit 6039e4a2b4e3e9ce633eb5c0e6f9455598285f8c
Author: Łukasz Rymanowski <lu...@codecoup.pl>
AuthorDate: Tue Jun 4 21:05:07 2019 +0200
nimble/ll: Enlarge critical section when stoping scanning
---
nimble/controller/src/ble_ll_scan.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/nimble/controller/src/ble_ll_scan.c b/nimble/controller/src/ble_ll_scan.c
index 06d33ae..71be964 100644
--- a/nimble/controller/src/ble_ll_scan.c
+++ b/nimble/controller/src/ble_ll_scan.c
@@ -1187,20 +1187,19 @@ ble_ll_scan_sm_stop(int chk_disable)
scansm = &g_ble_ll_scan_sm;
os_cputime_timer_stop(&scansm->scan_timer);
+ OS_ENTER_CRITICAL(sr);
/* Disable scanning state machine */
scansm->scan_enabled = 0;
scansm->restart_timer_needed = 0;
#if MYNEWT_VAL(BLE_LL_CFG_FEAT_LL_EXT_ADV)
if (scansm->ext_scanning) {
- OS_ENTER_CRITICAL(sr);
ble_ll_scan_clean_cur_aux_data();
- OS_EXIT_CRITICAL(sr);
-
ble_ll_sched_rmv_elem_type(BLE_LL_SCHED_TYPE_AUX_SCAN, ble_ll_scan_sched_remove);
scansm->ext_scanning = 0;
}
#endif
+ OS_EXIT_CRITICAL(sr);
/* Count # of times stopped */
STATS_INC(ble_ll_stats, scan_stops);