Skip to content

{bp-19542} arch/arm/nrf52,nrf53: don't pass HCI messages under the lock #19649

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xiaoxiang781216 merged 1 commit into from
Aug 3, 2026
+50 −48
Merged

{bp-19542} arch/arm/nrf52,nrf53: don't pass HCI messages under the lock #19649

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 25 additions & 24 deletions arch/arm/src/nrf52/nrf52_sdc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,10 +181,10 @@
struct nrf52_sdc_dev_s
{
uint8_t *mempool; /* Must be 8 bytes aligned */
uint8_t msg_buffer[HCI_MSG_BUFFER_MAX_SIZE];

mutex_t lock;
struct work_s work;
struct work_s hci_work;
};

begin_packed_struct struct sdc_hci_cmd_vs_zephyr_write_bd_addr_s
Expand Down Expand Up @@ -308,7 +308,7 @@ static int bt_hci_send(struct bt_driver_s *btdev,
{
ret = len;

work_queue(LPWORK, &g_sdc_dev.work, on_hci_worker, NULL, 0);
work_queue(LPWORK, &g_sdc_dev.hci_work, on_hci_worker, NULL, 0);
}
}

Expand Down Expand Up @@ -354,22 +354,7 @@ static void low_prio_worker(void *arg)

static void on_hci_worker(void *arg)
{
/* We use this worker to force a call to on_hci() right after sending
* an HCI command as MPSL/SDC does not always signal the low priority
* worker
*/

nxmutex_lock(&g_sdc_dev.lock);
on_hci();
nxmutex_unlock(&g_sdc_dev.lock);
}

/****************************************************************************
* Name: on_hci
****************************************************************************/

static void on_hci(void)
{
uint8_t msg_buffer[HCI_MSG_BUFFER_MAX_SIZE];
sdc_hci_msg_type_t type;
bool check_again;
size_t len;
Expand All @@ -383,13 +368,16 @@ static void on_hci(void)
* buffer and then create an actual bt_buf_s, depending on msg length
*/

ret = sdc_hci_get(g_sdc_dev.msg_buffer, &type);
nxmutex_lock(&g_sdc_dev.lock);
ret = sdc_hci_get(msg_buffer, &type);
nxmutex_unlock(&g_sdc_dev.lock);

if (ret == 0)
{
if (type == SDC_HCI_MSG_TYPE_EVT)
{
struct bt_hci_evt_hdr_s *hdr =
(struct bt_hci_evt_hdr_s *)g_sdc_dev.msg_buffer;
(struct bt_hci_evt_hdr_s *)msg_buffer;

len = sizeof(*hdr) + hdr->len;

Expand All @@ -398,7 +386,7 @@ static void on_hci(void)
{
struct hci_evt_cmd_complete_s *cmd_complete =
(struct hci_evt_cmd_complete_s *)
(g_sdc_dev.msg_buffer + sizeof(*hdr));
(msg_buffer + sizeof(*hdr));
uint8_t *status = (uint8_t *)cmd_complete + 3;

wlinfo("received CMD_COMPLETE from softdevice "
Expand All @@ -413,29 +401,42 @@ static void on_hci(void)
#endif

bt_netdev_receive(&g_bt_driver, BT_EVT,
g_sdc_dev.msg_buffer, len);
msg_buffer, len);
check_again = true;
}

if (type == SDC_HCI_MSG_TYPE_DATA)
{
struct bt_hci_acl_hdr_s *hdr =
(struct bt_hci_acl_hdr_s *)g_sdc_dev.msg_buffer;
(struct bt_hci_acl_hdr_s *)msg_buffer;

wlinfo("received HCI ACL from softdevice (handle: %d)\n",
hdr->handle);

len = sizeof(*hdr) + hdr->len;

bt_netdev_receive(&g_bt_driver, BT_ACL_IN,
g_sdc_dev.msg_buffer, len);
msg_buffer, len);
check_again = true;
}
}
}
while (check_again);
}

/****************************************************************************
* Name: on_hci
*
* Description:
* SDC message callback.
*
****************************************************************************/

static void on_hci(void)
{
work_queue(LPWORK, &g_sdc_dev.hci_work, on_hci_worker, NULL, 0);
}

/****************************************************************************
* Name: swi_isr
****************************************************************************/
Expand Down
49 changes: 25 additions & 24 deletions arch/arm/src/nrf53/nrf53_sdc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,10 +182,10 @@
struct nrf53_sdc_dev_s
{
uint8_t *mempool; /* Must be 8 bytes aligned */
uint8_t msg_buffer[HCI_MSG_BUFFER_MAX_SIZE];

mutex_t lock;
struct work_s work;
struct work_s hci_work;
};

begin_packed_struct struct sdc_hci_cmd_vs_zephyr_write_bd_addr_s
Expand Down Expand Up @@ -309,7 +309,7 @@ static int bt_hci_send(struct bt_driver_s *btdev,
{
ret = len;

work_queue(LPWORK, &g_sdc_dev.work, on_hci_worker, NULL, 0);
work_queue(LPWORK, &g_sdc_dev.hci_work, on_hci_worker, NULL, 0);
}
}

Expand Down Expand Up @@ -355,22 +355,7 @@ static void low_prio_worker(void *arg)

static void on_hci_worker(void *arg)
{
/* We use this worker to force a call to on_hci() right after sending
* an HCI command as MPSL/SDC does not always signal the low priority
* worker
*/

nxmutex_lock(&g_sdc_dev.lock);
on_hci();
nxmutex_unlock(&g_sdc_dev.lock);
}

/****************************************************************************
* Name: on_hci
****************************************************************************/

static void on_hci(void)
{
uint8_t msg_buffer[HCI_MSG_BUFFER_MAX_SIZE];
sdc_hci_msg_type_t type;
bool check_again;
size_t len;
Expand All @@ -384,13 +369,16 @@ static void on_hci(void)
* buffer and then create an actual bt_buf_s, depending on msg length
*/

ret = sdc_hci_get(g_sdc_dev.msg_buffer, &type);
nxmutex_lock(&g_sdc_dev.lock);
ret = sdc_hci_get(msg_buffer, &type);
nxmutex_unlock(&g_sdc_dev.lock);

if (ret == 0)
{
if (type == SDC_HCI_MSG_TYPE_EVT)
{
struct bt_hci_evt_hdr_s *hdr =
(struct bt_hci_evt_hdr_s *)g_sdc_dev.msg_buffer;
(struct bt_hci_evt_hdr_s *)msg_buffer;

len = sizeof(*hdr) + hdr->len;

Expand All @@ -399,7 +387,7 @@ static void on_hci(void)
{
struct hci_evt_cmd_complete_s *cmd_complete =
(struct hci_evt_cmd_complete_s *)
(g_sdc_dev.msg_buffer + sizeof(*hdr));
(msg_buffer + sizeof(*hdr));
uint8_t *status = (uint8_t *)cmd_complete + 3;

wlinfo("received CMD_COMPLETE from softdevice "
Expand All @@ -414,29 +402,42 @@ static void on_hci(void)
#endif

bt_netdev_receive(&g_bt_driver, BT_EVT,
g_sdc_dev.msg_buffer, len);
msg_buffer, len);
check_again = true;
}

if (type == SDC_HCI_MSG_TYPE_DATA)
{
struct bt_hci_acl_hdr_s *hdr =
(struct bt_hci_acl_hdr_s *)g_sdc_dev.msg_buffer;
(struct bt_hci_acl_hdr_s *)msg_buffer;

wlinfo("received HCI ACL from softdevice (handle: %d)\n",
hdr->handle);

len = sizeof(*hdr) + hdr->len;

bt_netdev_receive(&g_bt_driver, BT_ACL_IN,
g_sdc_dev.msg_buffer, len);
msg_buffer, len);
check_again = true;
}
}
}
while (check_again);
}

/****************************************************************************
* Name: on_hci
*
* Description:
* SDC message callback.
*
****************************************************************************/

static void on_hci(void)
{
work_queue(LPWORK, &g_sdc_dev.hci_work, on_hci_worker, NULL, 0);
}

/****************************************************************************
* Name: swi_isr
****************************************************************************/
Expand Down
Loading