History

Bluetooth: Fix __hci_request synchronization for hci_open_dev

The initialization function used by hci_open_dev (hci_init_req) sends many different HCI commands. The __hci_request function should only return when all of these commands have completed (or a timeout occurs). Several of these commands cause hci_req_complete to be called which causes __hci_request to return prematurely. This patch fixes the issue by adding a new hdev->req_last_cmd variable which is set during the initialization procedure. The hci_req_complete function will no longer mark the request as complete until the command matching hdev->req_last_cmd completes.

Johan Hedberg committed 15 years ago

Commit 23bb5761 parent c71e97b3 files · +37 −14Browse files

Unified · Split

3 files
  1. include/net/bluetooth/hci_core.h +2 −1
  2. net/bluetooth/hci_core.c +12 −3
  3. net/bluetooth/hci_event.c +23 −10
include/net/bluetooth/hci_core.h+2−1
@@ -129,6 +129,7 @@ struct hci_dev { · 128 unmodified lines
129 wait_queue_head_t req_wait_q;129 wait_queue_head_t req_wait_q;
130 __u32 req_status;130 __u32 req_status;
131 __u32 req_result;131 __u32 req_result;
132 __u16 req_last_cmd;
132 133
133 struct inquiry_cache inq_cache;134 struct inquiry_cache inq_cache;
134 struct hci_conn_hash conn_hash;135 struct hci_conn_hash conn_hash;
@@ -693,6 +694,6 @@ struct hci_sec_filter { · 558 unmodified lines
693#define hci_req_lock(d) mutex_lock(&d->req_lock)694#define hci_req_lock(d) mutex_lock(&d->req_lock)
694#define hci_req_unlock(d) mutex_unlock(&d->req_lock)695#define hci_req_unlock(d) mutex_unlock(&d->req_lock)
695 696
696void hci_req_complete(struct hci_dev *hdev, int result);697void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result);
697 698
698#endif /* __HCI_CORE_H */699#endif /* __HCI_CORE_H */
net/bluetooth/hci_core.c+12−3
@@ -91,9 +91,16 @@ static void hci_notify(struct hci_dev *hdev, int event) · 90 unmodified lines
91 91
92/* ---- HCI requests ---- */92/* ---- HCI requests ---- */
93 93
94void hci_req_complete(struct hci_dev *hdev, int result)94void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
95{95{
96 BT_DBG("%s result 0x%2.2x", hdev->name, result);96 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
97
98 /* If the request has set req_last_cmd (typical for multi-HCI
99 * command requests) check if the completed command matches
100 * this, and if not just return. Single HCI command requests
101 * typically leave req_last_cmd as 0 */
102 if (hdev->req_last_cmd && cmd != hdev->req_last_cmd)
103 return;
97 104
98 if (hdev->req_status == HCI_REQ_PEND) {105 if (hdev->req_status == HCI_REQ_PEND) {
99 hdev->req_result = result;106 hdev->req_result = result;
@@ -149,7 +156,7 @@ static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, · 49 unmodified lines
149 break;156 break;
150 }157 }
151 158
152 hdev->req_status = hdev->req_result = 0;159 hdev->req_last_cmd = hdev->req_status = hdev->req_result = 0;
153 160
154 BT_DBG("%s end: err %d", hdev->name, err);161 BT_DBG("%s end: err %d", hdev->name, err);
155 162
@@ -252,6 +259,8 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt) · 96 unmodified lines
252 /* Connection accept timeout ~20 secs */259 /* Connection accept timeout ~20 secs */
253 param = cpu_to_le16(0x7d00);260 param = cpu_to_le16(0x7d00);
254 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);261 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
262
263 hdev->req_last_cmd = HCI_OP_WRITE_CA_TIMEOUT;
255}264}
256 265
257static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)266static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
net/bluetooth/hci_event.c+23−10
@@ -58,7 +58,7 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb) · 57 unmodified lines
58 58
59 clear_bit(HCI_INQUIRY, &hdev->flags);59 clear_bit(HCI_INQUIRY, &hdev->flags);
60 60
61 hci_req_complete(hdev, status);61 hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
62 62
63 hci_conn_check_pending(hdev);63 hci_conn_check_pending(hdev);
64}64}
@@ -174,7 +174,7 @@ static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *s · 109 unmodified lines
174 if (!status)174 if (!status)
175 hdev->link_policy = get_unaligned_le16(sent);175 hdev->link_policy = get_unaligned_le16(sent);
176 176
177 hci_req_complete(hdev, status);177 hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
178}178}
179 179
180static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)180static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
@@ -183,7 +183,7 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb) · 2 unmodified lines
183 183
184 BT_DBG("%s status 0x%x", hdev->name, status);184 BT_DBG("%s status 0x%x", hdev->name, status);
185 185
186 hci_req_complete(hdev, status);186 hci_req_complete(hdev, HCI_OP_RESET, status);
187}187}
188 188
189static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)189static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -235,7 +235,7 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb) · 45 unmodified lines
235 clear_bit(HCI_AUTH, &hdev->flags);235 clear_bit(HCI_AUTH, &hdev->flags);
236 }236 }
237 237
238 hci_req_complete(hdev, status);238 hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
239}239}
240 240
241static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)241static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -258,7 +258,7 @@ static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb) · 16 unmodified lines
258 clear_bit(HCI_ENCRYPT, &hdev->flags);258 clear_bit(HCI_ENCRYPT, &hdev->flags);
259 }259 }
260 260
261 hci_req_complete(hdev, status);261 hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
262}262}
263 263
264static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)264static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -285,7 +285,7 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb) · 20 unmodified lines
285 set_bit(HCI_PSCAN, &hdev->flags);285 set_bit(HCI_PSCAN, &hdev->flags);
286 }286 }
287 287
288 hci_req_complete(hdev, status);288 hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
289}289}
290 290
291static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)291static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
@@ -383,7 +383,7 @@ static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) · 91 unmodified lines
383 383
384 BT_DBG("%s status 0x%x", hdev->name, status);384 BT_DBG("%s status 0x%x", hdev->name, status);
385 385
386 hci_req_complete(hdev, status);386 hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
387}387}
388 388
389static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)389static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -536,7 +536,16 @@ static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb) · 146 unmodified lines
536 if (!rp->status)536 if (!rp->status)
537 bacpy(&hdev->bdaddr, &rp->bdaddr);537 bacpy(&hdev->bdaddr, &rp->bdaddr);
538 538
539 hci_req_complete(hdev, rp->status);539 hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
540}
541
542static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
543{
544 __u8 status = *((__u8 *) skb->data);
545
546 BT_DBG("%s status 0x%x", hdev->name, status);
547
548 hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
540}549}
541 550
542static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)551static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
@@ -544,7 +553,7 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status) · 1 unmodified line
544 BT_DBG("%s status 0x%x", hdev->name, status);553 BT_DBG("%s status 0x%x", hdev->name, status);
545 554
546 if (status) {555 if (status) {
547 hci_req_complete(hdev, status);556 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
548 557
549 hci_conn_check_pending(hdev);558 hci_conn_check_pending(hdev);
550 } else559 } else
@@ -871,7 +880,7 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff · 320 unmodified lines
871 880
872 clear_bit(HCI_INQUIRY, &hdev->flags);881 clear_bit(HCI_INQUIRY, &hdev->flags);
873 882
874 hci_req_complete(hdev, status);883 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
875 884
876 hci_conn_check_pending(hdev);885 hci_conn_check_pending(hdev);
877}886}
@@ -1379,6 +1388,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk · 501 unmodified lines
1379 hci_cc_read_bd_addr(hdev, skb);1388 hci_cc_read_bd_addr(hdev, skb);
1380 break;1389 break;
1381 1390
1391 case HCI_OP_WRITE_CA_TIMEOUT:
1392 hci_cc_write_ca_timeout(hdev, skb);
1393 break;
1394
1382 default:1395 default:
1383 BT_DBG("%s opcode 0x%x", hdev->name, opcode);1396 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1384 break;1397 break;