1 files changed, 138 insertions, 83 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d7d96b6b1f0d..a89cf1f24e47 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -58,9 +58,11 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                        test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_discovering(hdev->id, 0);
+        clear_bit(HCI_INQUIRY, &hdev->flags);
+
+        hci_dev_lock(hdev);
+        mgmt_discovering(hdev, 0);
+        hci_dev_unlock(hdev);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
 
@@ -76,10 +78,6 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_discovering(hdev->id, 0);
-
         hci_conn_check_pending(hdev);
 }
 
@@ -205,13 +203,15 @@ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_set_local_name_complete(hdev->id, sent, status);
+                mgmt_set_local_name_complete(hdev, sent, status);
 
-        if (status)
-                return;
+        if (status == 0)
+                memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 
-        memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -274,7 +274,8 @@ static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 
 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 {
-        __u8 status = *((__u8 *) skb->data);
+        __u8 param, status = *((__u8 *) skb->data);
+        int old_pscan, old_iscan;
         void *sent;
 
         BT_DBG("%s status 0x%x", hdev->name, status);
@@ -283,28 +284,40 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
-        if (!status) {
-                __u8 param = *((__u8 *) sent);
-                int old_pscan, old_iscan;
-
-                old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
-                old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
+        param = *((__u8 *) sent);
 
-                if (param & SCAN_INQUIRY) {
-                        set_bit(HCI_ISCAN, &hdev->flags);
-                        if (!old_iscan)
-                                mgmt_discoverable(hdev->id, 1);
-                } else if (old_iscan)
-                        mgmt_discoverable(hdev->id, 0);
+        hci_dev_lock(hdev);
 
-                if (param & SCAN_PAGE) {
-                        set_bit(HCI_PSCAN, &hdev->flags);
-                        if (!old_pscan)
-                                mgmt_connectable(hdev->id, 1);
-                } else if (old_pscan)
-                        mgmt_connectable(hdev->id, 0);
+        if (status != 0) {
+                mgmt_write_scan_failed(hdev, param, status);
+                hdev->discov_timeout = 0;
+                goto done;
         }
 
+        old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
+        old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
+
+        if (param & SCAN_INQUIRY) {
+                set_bit(HCI_ISCAN, &hdev->flags);
+                if (!old_iscan)
+                        mgmt_discoverable(hdev, 1);
+                if (hdev->discov_timeout > 0) {
+                        int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
+                        queue_delayed_work(hdev->workqueue, &hdev->discov_off,
+                                                                        to);
+                }
+        } else if (old_iscan)
+                mgmt_discoverable(hdev, 0);
+
+        if (param & SCAN_PAGE) {
+                set_bit(HCI_PSCAN, &hdev->flags);
+                if (!old_pscan)
+                        mgmt_connectable(hdev, 1);
+        } else if (old_pscan)
+                mgmt_connectable(hdev, 0);
+
+done:
+        hci_dev_unlock(hdev);
         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 }
 
@@ -748,6 +761,30 @@ static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 }
 
+static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
+                struct sk_buff *skb)
+{
+        struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hdev->amp_status = rp->amp_status;
+        hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
+        hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
+        hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
+        hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
+        hdev->amp_type = rp->amp_type;
+        hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
+        hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
+        hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
+        hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
+
+        hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
+}
+
 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
                                                         struct sk_buff *skb)
 {
@@ -804,19 +841,24 @@ static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
+        hci_dev_lock(hdev);
+
         if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
+                mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 
         if (rp->status != 0)
-                return;
+                goto unlock;
 
         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
         if (!cp)
-                return;
+                goto unlock;
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
         if (conn)
                 conn->pin_length = cp->pin_len;
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
@@ -825,10 +867,15 @@ static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
+        hci_dev_lock(hdev);
+
         if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
+                mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
                                                                 rp->status);
+
+        hci_dev_unlock(hdev);
 }
+
 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
                                        struct sk_buff *skb)
 {
@@ -855,9 +902,13 @@ static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
+        hci_dev_lock(hdev);
+
         if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
+                mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
                                                                 rp->status);
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
@@ -867,9 +918,13 @@ static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
+        hci_dev_lock(hdev);
+
         if (test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
+                mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
                                                                 rp->status);
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
@@ -879,8 +934,10 @@ static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
-        mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
+        hci_dev_lock(hdev);
+        mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
                                                 rp->randomizer, rp->status);
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
@@ -955,12 +1012,18 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
         if (status) {
                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
                 hci_conn_check_pending(hdev);
+                hci_dev_lock(hdev);
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_inquiry_failed(hdev, status);
+                hci_dev_unlock(hdev);
                 return;
         }
 
-        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_discovering(hdev->id, 1);
+        set_bit(HCI_INQUIRY, &hdev->flags);
+
+        hci_dev_lock(hdev);
+        mgmt_discovering(hdev, 1);
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
@@ -1339,13 +1402,16 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         BT_DBG("%s status %d", hdev->name, status);
 
-        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_discovering(hdev->id, 0);
-
         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 
         hci_conn_check_pending(hdev);
+
+        if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                return;
+
+        hci_dev_lock(hdev);
+        mgmt_discovering(hdev, 0);
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1361,12 +1427,6 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
 
         hci_dev_lock(hdev);
 
-        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
-
-                if (test_bit(HCI_MGMT, &hdev->flags))
-                        mgmt_discovering(hdev->id, 1);
-        }
-
         for (; num_rsp; num_rsp--, info++) {
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
@@ -1377,8 +1437,8 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
                 data.rssi               = 0x00;
                 data.ssp_mode           = 0x00;
                 hci_inquiry_cache_update(hdev, &data);
-                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
-                                                                        NULL);
+                mgmt_device_found(hdev, &info->bdaddr, ACL_LINK,
+                                                info->dev_class, 0, NULL);
         }
 
         hci_dev_unlock(hdev);
@@ -1412,7 +1472,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
-                        mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
+                        mgmt_connected(hdev, &ev->bdaddr, conn->type);
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -1444,7 +1504,8 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         } else {
                 conn->state = BT_CLOSED;
                 if (conn->type == ACL_LINK)
-                        mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
+                        mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
+                                                                ev->status);
         }
 
         if (conn->type == ACL_LINK)
@@ -1531,7 +1592,7 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
                 struct hci_cp_reject_conn_req cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
-                cp.reason = 0x0f;
+                cp.reason = HCI_ERROR_REJ_BAD_ADDR;
                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
         }
 }
@@ -1544,7 +1605,9 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
         BT_DBG("%s status %d", hdev->name, ev->status);
 
         if (ev->status) {
-                mgmt_disconnect_failed(hdev->id);
+                hci_dev_lock(hdev);
+                mgmt_disconnect_failed(hdev);
+                hci_dev_unlock(hdev);
                 return;
         }
 
@@ -1557,7 +1620,7 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
         conn->state = BT_CLOSED;
 
         if (conn->type == ACL_LINK || conn->type == LE_LINK)
-                mgmt_disconnected(hdev->id, &conn->dst);
+                mgmt_disconnected(hdev, &conn->dst, conn->type);
 
         hci_proto_disconn_cfm(conn, ev->reason);
         hci_conn_del(conn);
@@ -1588,7 +1651,7 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->sec_level = conn->pending_sec_level;
                 }
         } else {
-                mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+                mgmt_auth_failed(hdev, &conn->dst, ev->status);
         }
 
         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
@@ -1643,7 +1706,7 @@ static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb
         hci_dev_lock(hdev);
 
         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
-                mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
+                mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
         if (!conn)
@@ -1898,6 +1961,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_write_ca_timeout(hdev, skb);
                 break;
 
+        case HCI_OP_READ_LOCAL_AMP_INFO:
+                hci_cc_read_local_amp_info(hdev, skb);
+                break;
+
         case HCI_OP_DELETE_STORED_LINK_KEY:
                 hci_cc_delete_stored_link_key(hdev, skb);
                 break;
@@ -2029,7 +2096,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
         case HCI_OP_DISCONNECT:
                 if (ev->status != 0)
-                        mgmt_disconnect_failed(hdev->id);
+                        mgmt_disconnect_failed(hdev);
                 break;
 
         case HCI_OP_LE_CREATE_CONN:
@@ -2194,7 +2261,7 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
                 else
                         secure = 0;
 
-                mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
+                mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
         }
 
 unlock:
@@ -2363,12 +2430,6 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
 
         hci_dev_lock(hdev);
 
-        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
-
-                if (test_bit(HCI_MGMT, &hdev->flags))
-                        mgmt_discovering(hdev->id, 1);
-        }
-
         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
                 struct inquiry_info_with_rssi_and_pscan_mode *info;
                 info = (void *) (skb->data + 1);
@@ -2383,7 +2444,7 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
                         hci_inquiry_cache_update(hdev, &data);
-                        mgmt_device_found(hdev->id, &info->bdaddr,
+                        mgmt_device_found(hdev, &info->bdaddr, ACL_LINK,
                                                 info->dev_class, info->rssi,
                                                 NULL);
                 }
@@ -2400,7 +2461,7 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
                         hci_inquiry_cache_update(hdev, &data);
-                        mgmt_device_found(hdev->id, &info->bdaddr,
+                        mgmt_device_found(hdev, &info->bdaddr, ACL_LINK,
                                                 info->dev_class, info->rssi,
                                                 NULL);
                 }
@@ -2531,12 +2592,6 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         if (!num_rsp)
                 return;
 
-        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
-
-                if (test_bit(HCI_MGMT, &hdev->flags))
-                        mgmt_discovering(hdev->id, 1);
-        }
-
         hci_dev_lock(hdev);
 
         for (; num_rsp; num_rsp--, info++) {
@@ -2549,8 +2604,8 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
                 data.rssi               = info->rssi;
                 data.ssp_mode           = 0x01;
                 hci_inquiry_cache_update(hdev, &data);
-                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
-                                                info->rssi, info->data);
+                mgmt_device_found(hdev, &info->bdaddr, ACL_LINK,
+                                info->dev_class, info->rssi, info->data);
         }
 
         hci_dev_unlock(hdev);
@@ -2614,7 +2669,7 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
                 struct hci_cp_io_capability_neg_reply cp;
 
                 bacpy(&cp.bdaddr, &ev->bdaddr);
-                cp.reason = 0x18; /* Pairing not allowed */
+                cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
 
                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
                                                         sizeof(cp), &cp);
@@ -2706,7 +2761,7 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
         }
 
 confirm:
-        mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
+        mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
                                                                 confirm_hint);
 
 unlock:
@@ -2732,7 +2787,7 @@ static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_
          * event gets always produced as initiator and is also mapped to
          * the mgmt_auth_failed event */
         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
-                mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+                mgmt_auth_failed(hdev, &conn->dst, ev->status);
 
         hci_conn_put(conn);
 
@@ -2813,14 +2868,14 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
         }
 
         if (ev->status) {
-                mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
+                mgmt_connect_failed(hdev, &ev->bdaddr, conn->type, ev->status);
                 hci_proto_connect_cfm(conn, ev->status);
                 conn->state = BT_CLOSED;
                 hci_conn_del(conn);
                 goto unlock;
         }
 
-        mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
+        mgmt_connected(hdev, &ev->bdaddr, conn->type);
 
         conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
@@ -3104,5 +3159,5 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         kfree_skb(skb);
 }
 
-module_param(enable_le, bool, 0444);
+module_param(enable_le, bool, 0644);
 MODULE_PARM_DESC(enable_le, "Enable LE support");