[Bluez-devel] Kernel panic with SCO socket - Debian kernel 2.6.15-8

[Fabien Chevalier - <fchevalier@silicom.fr>]

[-- Attachment #1: Type: text/plain, Size: 826 bytes --]


Hi all,

I'm currently playing with a bluetooth dongle and a Motorola HS810 headset.

I wrote a sample program that mimics the establishment of a Headset 
Profile like connection.
For now it just waits for user input, then sends the content of a PCM 
file over the SCO socket.

The thing basically works... exect after 1or 2 minutes playback, the 
program suddenly exits.
Then i just have a few seconds left and *bang* . Kernel Panic :-(

The issue is 100% reproductible on my configuration :-(.

I attached the source of the program that makes my Linux crash... would 
eventually anybody have any idea of what goes wrong ??

Tip : here is the command line i use to start this program:
./hsplay 00:07:A4:4D:02:14 1 fallen-8kHz.wav 0

I also noticed that it crashes a lot faster when last parameter is 0...

Cheers,

Fabien



[-- Attachment #2: hsplay.c --]
[-- Type: text/x-csrc, Size: 3166 bytes --]

#include <getopt.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
#include <string.h>
#include <errno.h>
#include <regex.h>
#include <ctype.h>

#include <sys/wait.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/time.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <sys/poll.h>

#include <bluetooth/bluetooth.h>
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>
#include <bluetooth/sco.h>
#include <bluetooth/rfcomm.h>
#include <bluetooth/sdp.h>
#include <bluetooth/sdp_lib.h>

static int rfcomm_connect(bdaddr_t * dst, uint8_t channel)
{
	struct sockaddr_rc addr;
	int s;

	if ((s = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM)) < 0) {
		return -1;
	}

	memset(&addr, 0, sizeof(addr));
	addr.rc_family = AF_BLUETOOTH;
	bacpy(&addr.rc_bdaddr, dst);
	addr.rc_channel = channel;
	if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
		close(s);
		return -1;
	}

	return s;
}

static int sco_connect(bdaddr_t * dst, uint16_t * handle,
		       uint16_t * mtu)
{
	struct sockaddr_sco addr;
	struct sco_conninfo conn;
	struct sco_options opts;
	int s;
	unsigned int size;

	if ((s = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO)) < 0) {
		return -1;
	}

	memset(&addr, 0, sizeof(addr));
	addr.sco_family = AF_BLUETOOTH;
	bacpy(&addr.sco_bdaddr, dst);
	if (connect(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
		close(s);
		return -1;
	}

	size = sizeof(conn);
	if (getsockopt(s, SOL_SCO, SCO_CONNINFO, &conn, &size) < 0) {
		close(s);
		return -1;
	}

	size = sizeof(opts);
	if (getsockopt(s, SOL_SCO, SCO_OPTIONS, &opts, &size) < 0) {
		close(s);
		return -1;
	}

	if (handle)
		*handle = conn.hci_handle;

	if (mtu)
		*mtu = opts.mtu;

	return s;
}

#define PKT_SIZE 48

int main(int argc, char **argv)
{
	bdaddr_t remote;
	int rfcomm_socket;
	int sco_socket;
	char buff[256];
	int res;
	char *pcm_filename;
	int pcm_fd;
	int channel;
	int delay;

	if(argc != 5) {
		printf("usage: hsplay bdaddr rfcomm_channel pcm_file delay\n");		
		printf("bdaddr = headet bd address\n");
		printf("rfcomm_channel = rfcomm channel used for headset control\n");		
		printf("pcm_file = 8OOHz, 16 bits signed PCM file te read\n");		
		printf("delay = between two sco packets, 1500 usually works great\n");		
		exit(1);
	}
	
	str2ba(argv[1], &remote);
	channel = atoi(argv[2]);
	pcm_filename = argv[3];
	delay = atoi(argv[4]);	
	
	rfcomm_socket = rfcomm_connect(&remote, channel);
	assert(rfcomm_socket != -1);
	res = write(rfcomm_socket, "RING", 4); 	
	assert(res == 4);
	memset(buff, 0, sizeof(buff));
	printf("RFCOMM control channel opened, waiting for HS button push\n");
	res = read(rfcomm_socket, buff, sizeof(buff));
	assert(res > 0);
	printf("Recv: %s\n", buff);
	sco_socket = sco_connect(&remote, 0, 0);
	assert(res > 0);
	printf("SCO connected.\n");

	pcm_fd = open(pcm_filename, 0);
	assert(pcm_fd > 0);
	lseek(pcm_fd, 44, SEEK_SET);
	while((res = read(pcm_fd, buff, PKT_SIZE)) == PKT_SIZE)
	{
		res = send(sco_socket, buff, PKT_SIZE, 0);
		if(res <= 0) {
			perror("write");
			exit(1);
		}
		if(delay > 0) {
			usleep(delay);
		}
	}	
	return 0;
}