Bug 196174 - Bluetooth does not work (since r275326) - hccontrol prints EMSGSIZE error and fails
Summary: Bluetooth does not work (since r275326) - hccontrol prints EMSGSIZE error and...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: amd64 Any
: --- Affects Only Me
Assignee: Gleb Smirnoff
URL: https://svnweb.freebsd.org/changeset/...
Keywords: needs-qa, regression
Depends on:
Blocks:
 
Reported: 2014-12-21 16:45 UTC by Jan Kokemüller
Modified: 2014-12-22 19:23 UTC (History)
2 users (show)

See Also:


Attachments
Proposed patch. (548 bytes, patch)
2014-12-22 13:12 UTC, Gleb Smirnoff
no flags Details | Diff
another patch (1.01 KB, patch)
2014-12-22 15:09 UTC, Gleb Smirnoff
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jan Kokemüller 2014-12-21 16:45:38 UTC
I can't get Bluetooth working. Setting up the netgraph nodes with ngctl works, but trying to send a command with hccontrol fails with "Message too long" (EMSGSIZE).

I've bisected this to r275326, a merge from the projects/sendfile branch. I guess some of the socket changes don't work 100% reliably with the netgraph/Bluetooth code.

I can reproduce this with a recent snapshot on a Thinkpad T420 with Bluetooth from Broadcom. I can send more info if needed.
Comment 1 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 16:59:14 UTC
Yes, please provide the all sequence of commands to reproduce the problem.
Comment 2 Jan Kokemüller 2014-12-21 17:06:28 UTC
I've run "sh -x /etc/rc.d/bluetooth start ubt0" to debug the bluetooth startup script and it runs these commands:

ngctl mkpeer ubt0: hci hook drv
ngctl name ubt0:hook ubt0hci
ngctl msg ubt0hci: set_debug 3
ngctl mkpeer ubt0hci: l2cap acl hci
ngctl name ubt0hci:acl ubt0l2cap
ngctl msg ubt0l2cap: set_debug 3
ngctl connect ubt0hci: btsock_hci_raw: raw ubt0raw
ngctl connect ubt0l2cap: btsock_l2c_raw: ctl ubt0ctl
ngctl connect ubt0l2cap: btsock_l2c: l2c ubt0l2c
/usr/sbin/hccontrol -n ubt0hci reset

It fails at the hccontrol command with a "Message too long" error. The ngctl commands work fine. I'll reboot into the snapshot again and see if there is anything unusual in dmesg or /var/log/messages.
Comment 3 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 18:07:19 UTC
Can you please do:

# kldload dtraceall
# dtrace -n 'fbt:ng_btsocket::return / execname == "hccontrol" && arg1 == 40 / { stack(); }'

Then in another window try to reproduce the problem again. I'm interested whether dtrace would catch anything.
Comment 4 Jan Kokemüller 2014-12-21 18:38:29 UTC
This Dtrace command didn't catch anything, sadly.
Comment 5 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 18:43:56 UTC
How many probes did it match?
Comment 6 Jan Kokemüller 2014-12-21 18:52:55 UTC
It did match 123 probes. If I leave out "arg1 == 40", stuff gets printed when I run hccontrol, but not when I leave it in.
Comment 7 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 18:58:31 UTC
Can you please run:

# dtrace -n 'syscall:::return / execname == "hccontrol" && arg1 == -1 / { printf("ret %d\n", arg1); stack(); }'
Comment 8 Jan Kokemüller 2014-12-21 19:11:02 UTC
There are only some lstat/access/readlink/stat syscalls that return ENOENT.
Comment 9 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 19:18:57 UTC
Ok. I will update my Thinkpad X1 to recent head and try it myself. Never used bluetooth on it before.
Comment 10 Jan Kokemüller 2014-12-21 19:34:05 UTC
I've just noticed that hccontrol sets EMSGSIZE itself in two places. I'll check if this is the source of the error.
Comment 11 Jan Kokemüller 2014-12-21 20:15:56 UTC
I did some printf debugging of hccontrol, and it looks like recv in hci_recv in send_recv.c returns 0 and not at least sizeof(ng_hci_event_pkt_t). Then errno is set to EMSGSIZE. The socket was created by a call to socket(PF_BLUETOOTH, SOCK_RAW, BLUETOOTH_PROTO_HCI).
I've tried to call recv in a loop, but then hci_recv just runs into the timeout.
Comment 12 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-21 20:35:56 UTC
btw, have you tried head after 275968?
Comment 13 Vladimir Kondratyev freebsd_committer freebsd_triage 2014-12-21 20:57:35 UTC
(In reply to Gleb Smirnoff from comment #12)
> btw, have you tried head after 275968?

I`ve seen exactly the same problem with r276028 and reverting to r275326 also helped to solve it.

I`ve tracked it to line 77 of /usr/src/usr.sbin/bluetooth/hccontrol/send_recv.c like Jan did
Comment 14 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-22 13:12:05 UTC
Created attachment 150848 [details]
Proposed patch.

Can you please test this patch?
Comment 15 Jan Kokemüller 2014-12-22 13:59:31 UTC
With this patch, at least "hccontrol -n ubt0hci reset" and "hccontrol -n ubt0hci inquiry" work, and "service bluetooth start ubt0" works as before, i.e. the first time there is an error but the second time it works.

The hccontrol inquiry command correctly detects my phone. Starting the hcsecd daemon with "hcsecd -d" also seems to work fine. However, trying to send/receive files fails. "obexapp -a XX:XX:XX:XX:XX:XX -C OPUSH" prints "obexapp: Could not obtain RFCOMM channel: No message of desired type" after maybe 10 seconds. Usually this command causes a confirmation dialog to pop up on the phone and then goes into a ftp-like interface where one can upload files to the phone.
Comment 16 Gleb Smirnoff freebsd_committer freebsd_triage 2014-12-22 15:09:02 UTC
Created attachment 150851 [details]
another patch

Please try this one, backing out the previous one.
Comment 17 Jan Kokemüller 2014-12-22 15:31:32 UTC
Thanks, this patch works! Sending and receiving files is possible again.
Comment 18 commit-hook freebsd_committer freebsd_triage 2014-12-22 15:39:56 UTC
A commit references this bug:

Author: glebius
Date: Mon Dec 22 15:39:25 UTC 2014
New revision: 276058
URL: https://svnweb.freebsd.org/changeset/base/276058

Log:
  In sbappend*() family of functions clear M_PROTO flags of incoming
  mbufs. sbappendstream() already does this in m_demote().

  PR:		196174
  Sponsored by:	Nginx, Inc.

Changes:
  head/sys/kern/uipc_sockbuf.c
Comment 19 Vladimir Kondratyev freebsd_committer freebsd_triage 2014-12-22 19:23:41 UTC
I`m also able to use my bt keyboard now. Thank you.