RE: Kernel panic when SCO connection

Hi,

I noticed the same problem when I was working with a embedded board with
Broadcom chipset and Linux kernel 2.6.18 (I guess). Use case was, a
Bluetooth based headset sends data to the CSR Bluetooth dongle(USB),
which in turn provide data to the Application through bluez stack.


Following were my observation:

1. Board processor is not strong enough and so there was no URB in the
queue and audio data was getting accumulated in the USB host controller.
There are only 2 Rx URBs (hci_usb.h: #define HCI_MAX_ISOC_RX
2).
2. Actual length of data for data in the URB is reaching to the level of
1K bytes. (Max ISOC data length) however Bluetooth driver is expecting
10 packets of 64 bytes each. hci_usb_isoc_rx_submit function in
hci_usb.c file.
3. Completion routine copies data for actual length returned for packet
that could be 1024 while limit for one packet is 64B only. (hci_usb.c:
hci_usb_rx_complete function).
4. These "SCO packet for unknown connection handle" error logs further
complicated the problem as this will further eat-up cpu time.


Cause:

Max length of available transfer buffer could be 640 bytes (that's
depend upon the buffer index) and copying big chunk of data was
resulting into memory overrun and kernel memory was getting corrupted
that results in un-expected behavior line connection break, lots of
noise  and even kernel panic some times.


Following was the work around:

1. Increased number of Rx URBs to 6. (hci_usb.h: #define HCI_MAX_ISOC_RX
6).
2. Increased transfer buffer size to 1.5K.
3. Put a check in completion routine that in case actual length is more
then frame length then copy only frame length size data as follows:

int len = (urb->iso_frame_desc[i].actual_length >
urb->iso_frame_desc[i].length)?
	     urb->iso_frame_desc[i].length:
	     urb->iso_frame_desc[i].actual_length;

__recv_frame(husb,
		 _urb->type, 
		urb->transfer_buffer + urb->iso_frame_desc[i].offset,
		len);
4. Logging "SCO packet for unknown connection handle" error only once
for 100 errors. This will give more change to queue a URB as
follows(hci_core.c:hci_scodata_packet function):
hdev->stat.err_rx++;
if(!(hdev->stat.err_rx % 100))
{
	BT_ERR("%s 100 SCO packets for unknown connection
handles",hdev->name);
}


I must say that I did not try with latest Linux kernel however I could
not see any code change regarding this functionality. Hope this will
help.

I can see a big code change in the latest 2.6.33-rc6 kernel. The hci_usb
driver has been replaced by btusb since a few releases now ;)

Regards

Marcel