[PATCH v3 1/3] Bluetooth: Move discovery state check inside hci_dev_lock()

[PATCH v3 1/3] Bluetooth: Move discovery state check inside hci_dev_lock()

[Jaganath Kanakkassery]

After checking the discovery state, if other thread modifies it
then it will be overwritten by the assignment in the first thread.

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
---
 net/bluetooth/hci_event.c |    9 ++++-----
 net/bluetooth/mgmt.c      |    4 ----
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 705078a..97b4828 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1273,14 +1273,13 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 
 		clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
 
+		hci_dev_lock(hdev);
 		if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-		    hdev->discovery.state == DISCOVERY_FINDING) {
+		    hdev->discovery.state == DISCOVERY_FINDING)
 			mgmt_interleaved_discovery(hdev);
-		} else {
-			hci_dev_lock(hdev);
+		else
 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
-			hci_dev_unlock(hdev);
-		}
+		hci_dev_unlock(hdev);
 
 		break;
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index e5502a5..bcc7080 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2298,14 +2298,10 @@ int mgmt_interleaved_discovery(struct hci_dev *hdev)
 
 	BT_DBG("%s", hdev->name);
 
-	hci_dev_lock(hdev);
-
 	err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
 	if (err < 0)
 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 
-	hci_dev_unlock(hdev);
-
 	return err;
 }
 
-- 
1.7.9.5

[PATCH v3 2/3] Bluetooth: Add mgmt_start_discovery_cancelled()

[Jaganath Kanakkassery]

This function can be used to inform userspace that start discovery
is cancelled

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/mgmt.c             |   19 +++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 014a2ea..d8f68c7 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1112,6 +1112,7 @@ int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
 		     u8 addr_type, s8 rssi, u8 *name, u8 name_len);
 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status);
+int mgmt_start_discovery_cancelled(struct hci_dev *hdev);
 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status);
 int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
 int mgmt_interleaved_discovery(struct hci_dev *hdev);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index bcc7080..0db9d66 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -3665,6 +3665,25 @@ int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 	return err;
 }
 
+int mgmt_start_discovery_cancelled(struct hci_dev *hdev)
+{
+	struct pending_cmd *cmd;
+	u8 type;
+	int err;
+
+	cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
+	if (!cmd)
+		return -ENOENT;
+
+	type = hdev->discovery.type;
+
+	err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, MGMT_STATUS_CANCELLED,
+			   &type, sizeof(type));
+	mgmt_pending_remove(cmd);
+
+	return err;
+}
+
 int mgmt_stop_discovery_failed(struct hci_dev *hdev, u8 status)
 {
 	struct pending_cmd *cmd;
-- 
1.7.9.5

[PATCH v3 3/3] Bluetooth: Fix stop discovery while in STARTING state

[Jaganath Kanakkassery]

If stop_discovery() is called when discovery state is STARTING, it
will be failed currently. This patch fixes this.

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
---
 include/net/bluetooth/hci_core.h |    1 +
 net/bluetooth/hci_event.c        |   14 ++++++++++++--
 net/bluetooth/mgmt.c             |   12 +++++++++++-
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index d8f68c7..01c723a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -64,6 +64,7 @@ struct discovery_state {
 		DISCOVERY_RESOLVING,
 		DISCOVERY_STOPPING,
 	} state;
+	u8  discovering;
 	struct list_head	all;	/* All devices found during inquiry */
 	struct list_head	unknown;	/* Name state not known */
 	struct list_head	resolve;	/* Name needs to be resolved */
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 97b4828..c616cbf 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1259,7 +1259,12 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 		set_bit(HCI_LE_SCAN, &hdev->dev_flags);
 
 		hci_dev_lock(hdev);
-		hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+		if (hdev->discovery.state == DISCOVERY_STOPPING) {
+			hci_cancel_le_scan(hdev);
+			mgmt_start_discovery_cancelled(hdev);
+		} else {
+			hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+		}
 		hci_dev_unlock(hdev);
 		break;
 
@@ -1375,7 +1380,12 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 	set_bit(HCI_INQUIRY, &hdev->flags);
 
 	hci_dev_lock(hdev);
-	hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+	if (hdev->discovery.state == DISCOVERY_STOPPING) {
+		hci_cancel_inquiry(hdev);
+		mgmt_start_discovery_cancelled(hdev);
+	} else {
+		hci_discovery_set_state(hdev, DISCOVERY_FINDING);
+	}
 	hci_dev_unlock(hdev);
 }
 
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0db9d66..6dc275f 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2394,7 +2394,8 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
 	hci_dev_lock(hdev);
 
-	if (!hci_discovery_active(hdev)) {
+	if (hdev->discovery.state != DISCOVERY_STARTING &&
+	    !hci_discovery_active(hdev)) {
 		err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
 				   MGMT_STATUS_REJECTED, &mgmt_cp->type,
 				   sizeof(mgmt_cp->type));
@@ -2442,6 +2443,10 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
 		break;
 
+	case DISCOVERY_STARTING:
+		err = 0;
+		break;
+
 	default:
 		BT_DBG("unknown discovery state %u", hdev->discovery.state);
 		err = -EFAULT;
@@ -3720,6 +3725,11 @@ int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
 		mgmt_pending_remove(cmd);
 	}
 
+	if (hdev->discovery.discovering == discovering)
+		return 0;
+
+	hdev->discovery.discovering = discovering;
+
 	memset(&ev, 0, sizeof(ev));
 	ev.type = hdev->discovery.type;
 	ev.discovering = discovering;
-- 
1.7.9.5

Re: [PATCH v3 3/3] Bluetooth: Fix stop discovery while in STARTING state

[Marcel Holtmann]

Hi Jaganath,

> If stop_discovery() is called when discovery state is STARTING, it
> will be failed currently. This patch fixes this.
> 
> Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
> ---
>  include/net/bluetooth/hci_core.h |    1 +
>  net/bluetooth/hci_event.c        |   14 ++++++++++++--
>  net/bluetooth/mgmt.c             |   12 +++++++++++-
>  3 files changed, 24 insertions(+), 3 deletions(-)
> 
> diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> index d8f68c7..01c723a 100644
> --- a/include/net/bluetooth/hci_core.h
> +++ b/include/net/bluetooth/hci_core.h
> @@ -64,6 +64,7 @@ struct discovery_state {
>  		DISCOVERY_RESOLVING,
>  		DISCOVERY_STOPPING,
>  	} state;
> +	u8  discovering;

what is this double spaces for? And why not a bool. Or a better name.

>  	struct list_head	all;	/* All devices found during inquiry */
>  	struct list_head	unknown;	/* Name state not known */
>  	struct list_head	resolve;	/* Name needs to be resolved */
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index 97b4828..c616cbf 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -1259,7 +1259,12 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
>  		set_bit(HCI_LE_SCAN, &hdev->dev_flags);
>  
>  		hci_dev_lock(hdev);
> -		hci_discovery_set_state(hdev, DISCOVERY_FINDING);
> +		if (hdev->discovery.state == DISCOVERY_STOPPING) {
> +			hci_cancel_le_scan(hdev);
> +			mgmt_start_discovery_cancelled(hdev);
> +		} else {
> +			hci_discovery_set_state(hdev, DISCOVERY_FINDING);
> +		}
>  		hci_dev_unlock(hdev);
>  		break;
>  
> @@ -1375,7 +1380,12 @@ static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
>  	set_bit(HCI_INQUIRY, &hdev->flags);
>  
>  	hci_dev_lock(hdev);
> -	hci_discovery_set_state(hdev, DISCOVERY_FINDING);
> +	if (hdev->discovery.state == DISCOVERY_STOPPING) {
> +		hci_cancel_inquiry(hdev);
> +		mgmt_start_discovery_cancelled(hdev);
> +	} else {
> +		hci_discovery_set_state(hdev, DISCOVERY_FINDING);
> +	}
>  	hci_dev_unlock(hdev);
>  }
>  
> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
> index 0db9d66..6dc275f 100644
> --- a/net/bluetooth/mgmt.c
> +++ b/net/bluetooth/mgmt.c
> @@ -2394,7 +2394,8 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
>  
>  	hci_dev_lock(hdev);
>  
> -	if (!hci_discovery_active(hdev)) {
> +	if (hdev->discovery.state != DISCOVERY_STARTING &&
> +	    !hci_discovery_active(hdev)) {
>  		err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
>  				   MGMT_STATUS_REJECTED, &mgmt_cp->type,
>  				   sizeof(mgmt_cp->type));
> @@ -2442,6 +2443,10 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
>  
>  		break;
>  
> +	case DISCOVERY_STARTING:
> +		err = 0;
> +		break;
> +
>  	default:
>  		BT_DBG("unknown discovery state %u", hdev->discovery.state);
>  		err = -EFAULT;
> @@ -3720,6 +3725,11 @@ int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
>  		mgmt_pending_remove(cmd);
>  	}
>  
> +	if (hdev->discovery.discovering == discovering)
> +		return 0;
> +
> +	hdev->discovery.discovering = discovering;
> +
>  	memset(&ev, 0, sizeof(ev));
>  	ev.type = hdev->discovery.type;
>  	ev.discovering = discovering;

Regards

Marcel

Re: [PATCH v3 3/3] Bluetooth: Fix stop discovery while in STARTING state

[Jaganath Kanakkassery]

Hi Marcel,

--------------------------------------------------
From: "Marcel Holtmann" <marcel@holtmann.org>
Sent: Tuesday, January 15, 2013 9:47 PM
To: "Jaganath Kanakkassery" <jaganath.k@samsung.com>
Cc: <linux-bluetooth@vger.kernel.org>
Subject: Re: [PATCH v3 3/3] Bluetooth: Fix stop discovery while in STARTING 
state

> Hi Jaganath,
>
>> If stop_discovery() is called when discovery state is STARTING, it
>> will be failed currently. This patch fixes this.
>>
>> Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
>> ---
>>  include/net/bluetooth/hci_core.h |    1 +
>>  net/bluetooth/hci_event.c        |   14 ++++++++++++--
>>  net/bluetooth/mgmt.c             |   12 +++++++++++-
>>  3 files changed, 24 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/net/bluetooth/hci_core.h 
>> b/include/net/bluetooth/hci_core.h
>> index d8f68c7..01c723a 100644
>> --- a/include/net/bluetooth/hci_core.h
>> +++ b/include/net/bluetooth/hci_core.h
>> @@ -64,6 +64,7 @@ struct discovery_state {
>>  DISCOVERY_RESOLVING,
>>  DISCOVERY_STOPPING,
>>  } state;
>> + u8  discovering;
>
> what is this double spaces for? And why not a bool. Or a better name.

I just followed the type of "discovering" in mgmt_discovering(). I am not
sure why it is u8 and not bool since the possible values are only 0 and 1.
If you are ok with bool I will raise a separate patch to first change the 
type
of discovering in mgmt_discovering() and also in struct mgmt_ev_discovering.

>>  struct list_head all; /* All devices found during inquiry */
>>  struct list_head unknown; /* Name state not known */
>>  struct list_head resolve; /* Name needs to be resolved */
>> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
>> index 97b4828..c616cbf 100644
>> --- a/net/bluetooth/hci_event.c
>> +++ b/net/bluetooth/hci_event.c
>> @@ -1259,7 +1259,12 @@ static void hci_cc_le_set_scan_enable(struct 
>> hci_dev *hdev,
>>  set_bit(HCI_LE_SCAN, &hdev->dev_flags);
>>
>>  hci_dev_lock(hdev);
>> - hci_discovery_set_state(hdev, DISCOVERY_FINDING);
>> + if (hdev->discovery.state == DISCOVERY_STOPPING) {
>> + hci_cancel_le_scan(hdev);
>> + mgmt_start_discovery_cancelled(hdev);
>> + } else {
>> + hci_discovery_set_state(hdev, DISCOVERY_FINDING);
>> + }
>>  hci_dev_unlock(hdev);
>>  break;
>>
>> @@ -1375,7 +1380,12 @@ static void hci_cs_inquiry(struct hci_dev *hdev, 
>> __u8 status)
>>  set_bit(HCI_INQUIRY, &hdev->flags);
>>
>>  hci_dev_lock(hdev);
>> - hci_discovery_set_state(hdev, DISCOVERY_FINDING);
>> + if (hdev->discovery.state == DISCOVERY_STOPPING) {
>> + hci_cancel_inquiry(hdev);
>> + mgmt_start_discovery_cancelled(hdev);
>> + } else {
>> + hci_discovery_set_state(hdev, DISCOVERY_FINDING);
>> + }
>>  hci_dev_unlock(hdev);
>>  }
>>
>> diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
>> index 0db9d66..6dc275f 100644
>> --- a/net/bluetooth/mgmt.c
>> +++ b/net/bluetooth/mgmt.c
>> @@ -2394,7 +2394,8 @@ static int stop_discovery(struct sock *sk, struct 
>> hci_dev *hdev, void *data,
>>
>>  hci_dev_lock(hdev);
>>
>> - if (!hci_discovery_active(hdev)) {
>> + if (hdev->discovery.state != DISCOVERY_STARTING &&
>> +     !hci_discovery_active(hdev)) {
>>  err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
>>     MGMT_STATUS_REJECTED, &mgmt_cp->type,
>>     sizeof(mgmt_cp->type));
>> @@ -2442,6 +2443,10 @@ static int stop_discovery(struct sock *sk, struct 
>> hci_dev *hdev, void *data,
>>
>>  break;
>>
>> + case DISCOVERY_STARTING:
>> + err = 0;
>> + break;
>> +
>>  default:
>>  BT_DBG("unknown discovery state %u", hdev->discovery.state);
>>  err = -EFAULT;
>> @@ -3720,6 +3725,11 @@ int mgmt_discovering(struct hci_dev *hdev, u8 
>> discovering)
>>  mgmt_pending_remove(cmd);
>>  }
>>
>> + if (hdev->discovery.discovering == discovering)
>> + return 0;
>> +
>> + hdev->discovery.discovering = discovering;
>> +
>>  memset(&ev, 0, sizeof(ev));
>>  ev.type = hdev->discovery.type;
>>  ev.discovering = discovering;
>

Thanks,
Jaganath