History log of /net/bluetooth/
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
db0e07948289cd4d332b82b1b5e9fe05846b2bc6 15-Oct-2008 Robert Love <rlove@google.com> Paranoid network.

With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.

Signed-off-by: Robert Love <rlove@google.com>

paranoid networking: Use in_egroup_p() to check group membership

The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.

Signed-off-by: Nick Pelly <npelly@google.com>

Fix 2.6.29 build.

Signed-off-by: Arve Hjønnevåg <arve@android.com>

net: Fix compilation of the IPv6 module

Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.

Signed-off-by: Steinar H. Gunderson <sesse@google.com>

net: bluetooth: Remove the AID_NET_BT* gid numbers

Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.

Signed-off-by: JP Abgrall <jpa@google.com>
f_bluetooth.c
9c238ca8ec79c38ab22762b44aeaf7a42fc97b18 01-Oct-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Check transmit errors for multicast packets

We did not return error if multicast packet transmit failed.
This might not be desired so return error also in this case.
If there are multiple 6lowpan devices where the multicast packet
is sent, then return error even if sending to only one of them fails.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
lowpan.c
d7b6b0a532da7de25e16deed610658cfa1969fe9 01-Oct-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Return EAGAIN error also for multicast packets

Make sure that we are able to return EAGAIN from l2cap_chan_send()
even for multicast packets. The error code was ignored unncessarily.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
lowpan.c
a7807d73a0fa9b33dbdfd5f1cb97970ccc91d77e 01-Oct-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Avoid memory leak if memory allocation fails

If skb_unshare() returns NULL, then we leak the original skb.
Solution is to use temp variable to hold the new skb.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
lowpan.c
fc12518a4bcbd4214652291df76f692343bca3d5 01-Oct-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Memory leak as the skb is not freed

The earlier multicast commit 36b3dd250dde ("Bluetooth: 6lowpan:
Ensure header compression does not corrupt IPv6 header") lost one
skb free which then caused memory leak.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
lowpan.c
02e246aee868e982eecc25ee97d02acf2c2b8884 02-Oct-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix lockdep warning with l2cap_chan_connect

The L2CAP connection's channel list lock (conn->chan_lock) must never be
taken while already holding a channel lock (chan->lock) in order to
avoid lock-inversion and lockdep warnings. So far the l2cap_chan_connect
function has acquired the chan->lock early in the function and then
later called l2cap_chan_add(conn, chan) which will try to take the
conn->chan_lock. This violates the correct order of taking the locks and
may lead to the following type of lockdep warnings:

-> #1 (&conn->chan_lock){+.+...}:
[<c109324d>] lock_acquire+0x9d/0x140
[<c188459c>] mutex_lock_nested+0x6c/0x420
[<d0aab48e>] l2cap_chan_add+0x1e/0x40 [bluetooth]
[<d0aac618>] l2cap_chan_connect+0x348/0x8f0 [bluetooth]
[<d0cc9a91>] lowpan_control_write+0x221/0x2d0 [bluetooth_6lowpan]
-> #0 (&chan->lock){+.+.+.}:
[<c10928d8>] __lock_acquire+0x1a18/0x1d20
[<c109324d>] lock_acquire+0x9d/0x140
[<c188459c>] mutex_lock_nested+0x6c/0x420
[<d0ab05fd>] l2cap_connect_cfm+0x1dd/0x3f0 [bluetooth]
[<d0a909c4>] hci_le_meta_evt+0x11a4/0x1260 [bluetooth]
[<d0a910eb>] hci_event_packet+0x3ab/0x3120 [bluetooth]
[<d0a7cb08>] hci_rx_work+0x208/0x4a0 [bluetooth]

CPU0 CPU1
---- ----
lock(&conn->chan_lock);
lock(&chan->lock);
lock(&conn->chan_lock);
lock(&chan->lock);

Before calling l2cap_chan_add() the channel is not part of the
conn->chan_l list, and can therefore only be accessed by the L2CAP user
(such as l2cap_sock.c). We can therefore assume that it is the
responsibility of the user to handle mutual exclusion until this point
(which we can see is already true in l2cap_sock.c by it in many places
touching chan members without holding chan->lock).

Since the hci_conn and by exctension l2cap_conn creation in the
l2cap_chan_connect() function depend on chan details we cannot simply
add a mutex_lock(&conn->chan_lock) in the beginning of the function
(since the conn object doesn't yet exist there). What we can do however
is move the chan->lock taking later into the function where we already
have the conn object and can that way take conn->chan_lock first.

This patch implements the above strategy and does some other necessary
changes such as using __l2cap_chan_add() which assumes conn->chan_lock
is held, as well as adding a second needed label so the unlocking
happens as it should.

Reported-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
156395c9989a76228e0da40e71267a3d4fb07419 29-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Enable multicast support

Set multicast support for 6lowpan network interface.
This is needed in every network interface that supports IPv6.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
36b3dd250dde5317fa6bb8c9010e1e7ab7f2265a 29-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Ensure header compression does not corrupt IPv6 header

If skb is going to multiple destinations, then make sure that we
do not overwrite the common IPv6 headers. So before compressing
the IPv6 headers, we copy the skb and that is then sent to 6LoWPAN
Bluetooth devices.

This is a similar patch as what was done for IEEE 802.154 6LoWPAN
in commit f19f4f9525cf3 ("ieee802154: 6lowpan: ensure header compression
does not corrupt ipv6 header")

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
59790aa2873cb3c32db02c777f08eb19faccf5fa 29-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Make sure skb exists before accessing it

We need to make sure that the saved skb exists when
resuming or suspending a CoC channel. This can happen if
initial credits is 0 when channel is connected.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
565766b087a6d6ff257f5b79c8ceda0188c9169f 25-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename sco_param_wideband table to esco_param_msbc

The sco_param_wideband table represents the eSCO parameters for
specifically mSBC encoding. This patch renames the table to the more
descriptive esco_param_msbc name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
c7da579763f29cf45a861ad4c339aba590d8b80d 24-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add retransmission effort into SCO parameter table

It is expected that new parameter combinations will have the
retransmission effort value different between some entries (mainly
because of the new S4 configuration added by HFP 1.7), so it makes sense
to move it into the table instead of having it hard coded based on the
selected SCO_AIRMODE_*.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
d41c15cf95bd91b9c333f6f749670e22c8a47ad9 24-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix reason code used for rejecting SCO connections

The core specification defines valid values for the
HCI_Reject_Synchronous_Connection_Request command to be 0x0D-0x0F. So
far the code has been using HCI_ERROR_REMOTE_USER_TERM (0x13) which is
not a valid value and is therefore being rejected by some controllers:

> HCI Event: Connect Request (0x04) plen 10
bdaddr 40:6F:2A:6A:E5:E0 class 0x000000 type eSCO
< HCI Command: Reject Synchronous Connection (0x01|0x002a) plen 7
bdaddr 40:6F:2A:6A:E5:E0 reason 0x13
Reason: Remote User Terminated Connection
> HCI Event: Command Status (0x0f) plen 4
Reject Synchronous Connection (0x01|0x002a) status 0x12 ncmd 1
Error: Invalid HCI Command Parameters

This patch introduces a new define for a value from the valid range
(0x0d == Connection Rejected Due To Limited Resources) and uses it
instead for rejecting incoming connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2b0bf6c85a4940e00516f68ff7103329abf8512d 22-Sep-2014 Joe Perches <joe@perches.com> Bluetooth: Convert bt_<level> logging functions to return void

No caller or macro uses the return value so make all
the functions return void.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ib.c
48e68ff5e55af6907d3f90233e5c4d5601a628a6 23-Sep-2014 Bernhard Thaler <bernhard.thaler@r-it.at> Bluetooth: Check for SCO type before setting retransmission effort

SCO connection cannot be setup to devices that do not support retransmission.
Patch based on http://permalink.gmane.org/gmane.linux.bluez.kernel/7779 and
adapted for this kernel version.

Code changed to check SCO/eSCO type before setting retransmission effort
and max. latency. The purpose of the patch is to support older devices not
capable of eSCO.

Tested on Blackberry 655+ headset which does not support retransmission.
Credits go to Alexander Sommerhuber.

Signed-off-by: Bernhard Thaler <bernhard.thaler@r-it.at>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
5eb596f55cacc2389554a8d7572d90d5e9d4269d 18-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting correct security level when initiating SMP

We can only determine the final security level when both pairing request
and response have been exchanged. When initiating pairing the starting
target security level is set to MEDIUM unless explicitly specified to be
HIGH, so that we can still perform pairing even if the remote doesn't
have MITM capabilities. However, once we've received the pairing
response we should re-consult the remote and local IO capabilities and
upgrade the target security level if necessary.

Without this patch the resulting Long Term Key will occasionally be
reported to be unauthenticated when it in reality is an authenticated
one.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
mp.c
0097db06f5ab2df1756bc4cbf4395593024d87a1 16-Sep-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove exported hci_recv_fragment function

The hci_recv_fragment function is no longer used by any driver and thus
do not export it. In fact it is not even needed by the core and it can
be removed altogether.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
43e73e4e2ad05d9bf3b438cfbe1e71b57a85f26c 14-Sep-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide HCI command opcode information to driver

The Bluetooth core already does processing of the HCI command header
and puts it together before sending it to the driver. It is not really
efficient for the driver to look at the HCI command header again in
case it has to make certain decisions about certain commands. To make
this easier, just provide the opcode as part of the SKB control buffer
information. The extra information about the opcode is optional and
only provided for HCI commands.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7cb9d20fd9f8fb41f29e294734c4f8b5dc81ed93 14-Sep-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add BUILD_BUG_ON check for SKB control buffer size

The struct bt_skb_cb size needs to stay within the limits of skb->cb
at all times and to ensure that add a BUILD_BUG_ON to check for it at
compile time.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
9a783a139c32a905825ee0aa9597f485ea461f76 12-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix re-setting RPA as expired when deferring update

The hci_update_random_address will clear the RPA_EXPIRED flag and
proceed with setting a new one if the flag was set. However, the
set_random_addr() function that is called may choose to defer the update
to a later moment. In such a case the flag would incorrectly remain
unset unless set_random_addr() re-sets it. This patch fixes the issue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
7ed3fa20780a5efd22bb192be0908468e7c376ed 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Expire RPA if encryption fails

If encryption fails and we're using an RPA it may be because of a
conflict with another device. To avoid repeated failures the safest
action is to simply mark the RPA as expired so that a new one gets
generated as soon as the connection drops.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
5be5e275ad214bbb420425754354add679d8ab68 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Avoid hard-coded IO capability values in SMP

This is a trivial change to use a proper define for the NoInputNoOutput
IO capability instead of hard-coded values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
aeaeb4bbca520b862d3b3e7cd74c23042815a160 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP information request handling for fixed channels

Even if we have no connection-oriented channels we should perform the
L2CAP Information Request procedures before notifying L2CAP channels of
the connection. This is so that the L2CAP channel implementations can
perform checks on what the remote side supports (e.g. does it support
the fixed channel in question).

So far the code has relied on the l2cap_do_start() function to initiate
the Information Request, however l2cap_do_start() is used on a
per-channel basis and only for connection-oriented channels. This means
that if there are no connection-oriented channels on the system we would
never start the Information Request procedure.

This patch creates a new l2cap_request_info() helper function to
initiate the Information Request procedure, and ensures that it is
called whenever a BR/EDR connection has been established. The patch also
updates fixed channels to be notified of connection readiness only once
the Information Request procedure has completed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
a6f7833ca353d50de46e3532afebe4abfc5dc4d9 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add smp_ltk_sec_level() helper function

There are several places that need to determine the security level that
an LTK can provide. This patch adds a convenience function for this to
help make the code more readable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
mp.c
mp.h
1afc2a1ab6612dcc3f26db7ca1afba9cff359f1c 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP security level when we have no IO capabilities

When the local IO capability is NoInputNoOutput any attempt to convert
the remote authentication requirement to a target security level is
futile. This patch makes sure that we set the target security level at
most to MEDIUM if the local IO capability is NoInputNoOutput.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
24bd0bd94e0947e257c5cd6a85b0e337d953e79c 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Centralize disallowing SMP commands to a single place

All the cases where we mark SMP commands as dissalowed are their
respective command handlers. We can therefore simplify the code by
always clearing the bit immediately after testing it. This patch
converts the corresponding test_bit() call to a test_and_clear_bit()
call and also removes the now unused SMP_DISALLOW_CMD macro.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
c05b9339c8a448a2df0c8598424ea9c0933288d1 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix ignoring unknown SMP authentication requirement bits

The SMP specification states that we should ignore any unknown bits from
the authentication requirement. We already have a define for masking out
unknown bits but we haven't used it in all places so far. This patch
adds usage of the AUTH_REQ_MASK to all places that need it and ensures
that we don't pass unknown bits onward to other functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
3a7dbfb8ff943711be4221df978254ad2bc1ac46 11-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary early initialization of variable

We do nothing else with the auth variable in smp_cmd_pairing_rsp()
besides passing it to tk_request() which in turn only cares about
whether one of the sides had the MITM bit set. It is therefore
unnecessary to assign a value to it until just before calling
tk_request(), and this value can simply be the bit-wise or of the local
and remote requirements.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
196332f5a1e5c3ec7171742fce83d03795abf120 10-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix allowing SMP Signing info PDU

If the remote side is not distributing its IRK but is distributing the
CSRK the next PDU after master identification is the Signing
Information. This patch fixes a missing SMP_ALLOW_CMD() for this in the
smp_cmd_master_ident() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
39e90c77637b3892a39f2908aea57539e961c50e 07-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Route packets that are not meant to peer via correct device

Packets that are supposed to be delivered via the peer device need to
be checked and sent to correct device. This requires that user has set
the routes properly so that the 6lowpan module can then figure out
the destination gateway and the correct Bluetooth device.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.17.x
lowpan.c
b2799cec22812f5f1aaaa57133df51876f685d84 07-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Set the peer IPv6 address correctly

The peer IPv6 address contained wrong U/L bit in the EUI-64 part.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.17.x
lowpan.c
2ae50d8d3aaf7154f72b44331b71f15799cdc1bb 07-Sep-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6lowpan: Increase the connection timeout value

Use the default connection timeout value defined in l2cap.h because
the current timeout was too short and most of the time the connection
attempts timed out.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.17.x
lowpan.c
e1e930f591bfd9604c3077f0af5c390f4f890259 09-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt pairing failure when authentication fails

Whether through HCI with BR/EDR or SMP with LE when authentication fails
we should also notify any pending Pair Device mgmt command. This patch
updates the mgmt_auth_failed function to take the actual hci_conn object
and makes sure that any pending pairing command is notified and cleaned
up appropriately.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
mp.c
c68b7f127d5f517c214e8bcf231d0188f6776d2a 06-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix dereferencing conn variable before NULL check

This patch fixes the following type of static analyzer warning (and
probably a real bug as well as the NULL check should be there for a
reason):

net/bluetooth/smp.c:1182 smp_conn_security() warn: variable dereferenced before check 'conn' (see line 1174)

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
9f06a8d623b2c3aea09292b844e329fbfb401231 06-Sep-2014 Behan Webster <behanw@converseincode.com> Bluetooth: LLVMLinux: Remove VLAIS from bluetooth/amp.c

Replaced the use of a Variable Length Array In Struct (VLAIS) with a C99
compliant equivalent. This patch allocates the appropriate amount of memory
using an char array.

The new code can be compiled with both gcc and clang.

struct shash_desc contains a flexible array member member ctx declared with
CRYPTO_MINALIGN_ATTR, so sizeof(struct shash_desc) aligns the beginning
of the array declared after struct shash_desc with long long.

No trailing padding is required because it is not a struct type that can
be used in an array.

The CRYPTO_MINALIGN_ATTR is required so that desc is aligned with long long
as would be the case for a struct containing a member with
CRYPTO_MINALIGN_ATTR.

Signed-off-by: Behan Webster <behanw@converseincode.com>
Signed-off-by: Mark Charlebois <charlebm@gmail.com>
Signed-off-by: Jan-Simon Möller <dl9pf@gmx.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
b28b4943660f4e36f118b751ec606c103ba6b1cc 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add strict checks for allowed SMP PDUs

SMP defines quite clearly when certain PDUs are to be expected/allowed
and when not, but doesn't have any explicit request/response definition.
So far the code has relied on each PDU handler to behave correctly if
receiving PDUs at an unexpected moment, however this requires many
different checks and is prone to errors.

This patch introduces a generic way to keep track of allowed PDUs and
thereby reduces the responsibility & load on individual command
handlers. The tracking is implemented using a simple bit-mask where each
opcode maps to its own bit. If the bit is set the corresponding PDU is
allow and if the bit is not set the PDU is not allowed.

As a simple example, when we send the Pairing Request we'd set the bit
for Pairing Response, and when we receive the Pairing Response we'd
clear the bit for Pairing Response.

Since the disallowed PDU rejection is now done in a single central place
we need to be a bit careful of which action makes most sense to all
cases. Previously some, such as Security Request, have been simply
ignored whereas others have caused an explicit disconnect.

The only PDU rejection action that keeps good interoperability and can
be used for all the applicable use cases is to drop the data. This may
raise some concerns of us now being more lenient for misbehaving (and
potentially malicious) devices, but the policy of simply dropping data
has been a successful one for many years e.g. in L2CAP (where this is
the *only* policy for such cases - we never request disconnection in
l2cap_core.c because of bad data). Furthermore, we cannot prevent
connected devices from creating the SMP context (through a Security or
Pairing Request), and once the context exists looking up the
corresponding bit for the received opcode and deciding to reject it is
essentially an equally lightweight operation as the kind of rejection
that l2cap_core.c already successfully does.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
c6e81e9ae61cae3ea265e8f7fb2cbe59afc63594 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix calling smp_distribute_keys() when still waiting for keys

When we're in the process of receiving keys in phase 3 of SMP we keep
track of which keys are still expected in the smp->remote_key_dist
variable. If we still have some key bits set we need to continue waiting
for more PDUs and not needlessly call smp_distribute_keys(). This patch
fixes two such cases in the smp_cmd_master_ident() and
smp_cmd_ident_addr_info() handler functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
88d3a8acf33e8f4989a1032998eb819a89829573 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add define for key distribution mask

This patch adds a define for the allowed bits of the key distribution
mask so we don't have to have magic 0x07 constants throughout the code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
fc75cc8684d21d3649b28c4c37d4ce3f000759e4 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix locking of the SMP context

Before the move the l2cap_chan the SMP context (smp_chan) didn't have
any kind of proper locking. The best there existed was the
HCI_CONN_LE_SMP_PEND flag which was used to enable mutual exclusion for
potential multiple creators of the SMP context.

Now that SMP has been converted to use the l2cap_chan infrastructure and
since the SMP context is directly mapped to a corresponding l2cap_chan
we get the SMP context locking essentially for free through the
l2cap_chan lock. For all callbacks that l2cap_core.c makes for each
channel implementation (smp.c in the case of SMP) the l2cap_chan lock is
held through l2cap_chan_lock(chan).

Since the calls from l2cap_core.c to smp.c are covered the only missing
piece to have the locking implemented properly is to ensure that the
lock is held for any other call path that may access the SMP context.
This means user responses through mgmt.c, requests to elevate the
security of a connection through hci_conn.c, as well as any deferred
work through workqueues.

This patch adds the necessary locking to all these other code paths that
try to access the SMP context. Since mutual exclusion for the l2cap_chan
access is now covered from all directions the patch also removes
unnecessary HCI_CONN_LE_SMP_PEND flag (once we've acquired the chan lock
we can simply check whether chan->smp is set to know if there's an SMP
context).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
d6268e86a12a94a4f5193551c2367162e6a37db4 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary deferred work for SMP key distribution

Now that the identity address update happens through its own deferred
work there's no need to have smp_distribute_keys anymore behind a second
deferred work. This patch removes this extra construction and makes the
code do direct calls to smp_distribute_keys() again.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
f3d82d0c8ec025fc113408e3ad5775fed5a060ff 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move identity address update behind a workqueue

The identity address update of all channels for an l2cap_conn needs to
take the lock for each channel, i.e. it's safest to do this by a
separate workqueue callback.

Previously this was partially solved by moving the entire SMP key
distribution behind a workqueue. However, if we want SMP context locking
to be correct and safe we should always use the l2cap_chan lock when
accessing it, meaning even smp_distribute_keys needs to take that lock
which would once again create a dead lock when updating the identity
address.

The simplest way to solve this is to have l2cap_conn manage the deferred
work which is what this patch does. A subsequent patch will remove the
now unnecessary SMP key distribution work struct.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
mp.c
84bc0db53b3a425fb992d5fed25b575e4434167a 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't take any action in smp_resume_cb if not encrypted

When smp_resume_cb is called if we're not encrypted (i.e. the callback
wasn't called because the connection became encrypted) we shouldn't take
any action at all. This patch moves also the security_timer cancellation
behind this condition.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
1b0921d6be7860271ccf6027891b8215fc28cde5 05-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary checks after canceling SMP security timer

The SMP security timer used to be able to modify the SMP context state
but now days it simply calls hci_disconnect(). It is therefore
unnecessary to have extra sanity checks for the SMP context after
canceling the timer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
434714dc02b286d3f21179c651a6f1a84e199eb7 01-Sep-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add clarifying comment for LE CoC result value

The "pending" L2CAP response value is not defined for LE CoC. This patch
adds a clarifying comment to the code so that the reader will not think
there is a bug in trying to use this value for LE CoC.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
839035a7b3acd17a6f739b1fb50298e9499d3fa4 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move clock offset reading into hci_disconnect()

To give all hci_disconnect() users the advantage of getting the clock
offset read automatically this patch moves the necessary code from
hci_conn_timeout() into hci_disconnect(). This way we pretty much always
update the clock offset when disconnecting.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
e3f2f92a047cd2be3c87a2aaf0a8958e1fd4c17a 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_disconnect() for mgmt_disconnect_device()

There's no reason to custom build the HCI_Disconnect command in the
Disconnect Device mgmt command handler. This patch updates the code to
use hci_disconnect() instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
e3b679d56caa2bc555dee646a6ac5861631e7a28 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update hci_disconnect() to return an error value

We'll soon use hci_disconnect() from places that are interested to know
whether the hci_send_cmd() really succeeded or not. This patch updates
hci_disconnect() to pass on any error returned from hci_send_cmd().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
9b7b18ef1bea82e5fc1e05da386ff57b0f60f651 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP error and response to be mutually exclusive

Returning failure from the SMP data parsing function will cause an
immediate disconnect, making any attempts to send a response PDU futile.
This patch updates the function to always either send a response or
return an error, but never both at the same time:

* In the case that HCI_LE_ENABLED is not set we want to send a Pairing Not
Supported response but it is not required to force a disconnection, so
do not set the error return in this case.

* If we get garbage SMP data we can just fail with the handler function
instead of also trying to send an SMP Failure PDU.

* There's no reason to force a disconnection if we receive an unknown SMP
command. Instead simply send a proper Command Not Supported SMP
response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
b04afa0c280b7e7ced88692251d75a78c8fcb2a7 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused l2cap_conn_shutdown API

Now that there are no more users of the l2cap_conn_shutdown API (since
smp.c switched to using hci_disconnect) we can simply remove it along
with all of it's l2cap_conn variables.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
1e91c29eb60c031f4297d1a58125d0bd37691348 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_disconnect for immediate disconnection from SMP

Relying on the l2cap_conn_del procedure (triggered through the
l2cap_conn_shutdown API) to get the connection disconnected is not
reliable as it depends on all users releasing (through hci_conn_drop)
and that there's at least one user (so hci_conn_drop is called at least
one time).

A much simpler and more reliable solution is to call hci_disconnect()
directly from the SMP code when we want to disconnect. One side-effect
this has is that it prevents any SMP Failure PDU from being sent before
the disconnection, however neither one of the scenarios where
l2cap_conn_shutdown was used really requires this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
e31fb86005a01b7df8427b09d0158da28d0c773a 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set discon_timeout to 0 in l2cap_conn_del

When the l2cap_conn_del() function is used we do not want to wait around
"in case something happens" before disconnecting. This patch sets the
disconnection timeout to 0 so that the disconnection routines get
immediately scheduled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
bcbb655a180344d8004ede669228992bff1921e4 18-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove hci_conn_hold/drop from hci_chan

We can't have hci_chan contribute to the "active" reference counting of
the hci_conn since otherwise the connection would never get dropped when
there are no more users (since hci_chan would be counted as a user).
This patch removes hold() when creating the hci_chan and drop() when
destroying it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
f94b665dcf15324f5ac8aa639e47be0829b6409d 17-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Ignore incoming data after initiating disconnection

When hci_chan_del is called the disconnection routines get scheduled
through a workqueue. If there's any incoming ACL data before the
routines get executed there's a chance that a new hci_chan is created
and the disconnection never happens. This patch adds a new hci_conn flag
to indicate that we're in the process of driving the connection down. We
set the flag in hci_chan_del and check for it in hci_chan_create so that
no new channels are created for the same connection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
b3ff670a44cc34c01e78900c42255511e4f232e6 17-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set disc_timeout to 0 when calling hci_chan_del

The hci_chan_del() function is used in scenarios where we've decided we
want to get rid of the underlying baseband link. It makes therefore
sense to force the disc_timeout to 0 so that the disconnection routines
are immediately scheduled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
6c388d32ec1b9fcc2f2404fb5e9b3b0096be5de9 17-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_conn reference counting with hci_chan

The hci_chan_del() function was doing a hci_conn_drop() but there was no
matching hci_conn_hold() in the hci_chan_create() function. Furthermore,
as the hci_chan struct holds a pointer to the hci_conn there should be
proper use of hci_conn_get/put. This patch fixes both issues so that
hci_chan does correct reference counting of the hci_conn object.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
f6c63249698aaa87399e795adcf3b70171384dc2 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor connection parameter freeing into its own function

The necessary steps for freeing connection paramaters have grown quite a
bit so we can simplify the code by factoring it out into its own
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
f8aaf9b65a77267f749c1af641e46c3457d50701 17-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix using hci_conn_get() for hci_conn pointers

Wherever we keep hci_conn pointers around we should be using
hci_conn_get/put to ensure that they stay valid. This patch fixes
all places violating against the principle currently.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
gmt.c
51bb8457ddfa74ede52bf8c02054dea831d59fff 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Improve *_get() functions to return the object type

It's natural to have *_get() functions that increment the reference
count of an object to return the object type itself. This way it's
simple to make a copy of the object pointer and increase the reference
count in a single step. This patch updates two such get() functions,
namely hci_conn_get() and l2cap_conn_get(), and updates the users to
take advantage of the new API.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
2cap_core.c
5477610fc187d4aae0f699d21dfb0e3f440f7de7 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Optimize connection parameter lookup for LE connections

When we get an LE connection complete event there's really no reason to
look through the entire connection parameter list as the entry should be
present in the hdev->pend_le_conns list too. This patch changes the
lookup code to do a more restricted lookup only in the pend_le_conns
list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
08853f18eafe65aa97deb464c28505a67c898b0e 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set addr_type only when it's needed

In the hci_le_conn_complete_evt() function there's no need to set the
addr_type value until it's actually needed, i.e. for the black list
lookup. This patch moves the code a bit further down in the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
c16900cf285ca240f0f84117bf8b88a03c55469b 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_conn reference counting for fixed channels

Now that SMP has been converted to use fixed channels we've got a bit of
a problem with the hci_conn reference counting. So far the L2CAP code
has kept a reference for each L2CAP channel that was notified of the
connection. With SMP however this would mean that the connection is
never dropped even though there are no other users of it. Furthermore,
SMP already does its own hci_conn reference counting internally,
starting from a security or pairing request and ending with the key
distribution.

This patch makes L2CAP fixed channels default to the L2CAP core not
keeping a hci_conn reference for them. A new FLAG_HOLD_HCI_CONN flag is
added so that L2CAP users can declare an exception to this rule and hold
a reference even for their fixed channels. One such exception is the
L2CAP socket layer which does want a reference for each socket (e.g. an
ATT socket which uses a fixed channel).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
b3ed6c63f7d4a51b01a61b10e53a2992ad26aa78 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary l2cap_chan_unlock before l2cap_chan_add

The l2cap_chan_add() function doesn't require the channel to be
unlocked. It only requires the l2cap_conn to be unlocked. Therefore,
it's unnecessary to unlock a channel before calling l2cap_chan_add().
This patch removes such unnecessary unlocking from the
l2cap_chan_connect() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
72c6fb915ff2d30ae14053edee4f0d30019bad76 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix incorrect LE CoC PDU length restriction based on HCI MTU

The l2cap_create_le_flowctl_pdu() function that l2cap_segment_le_sdu()
calls is perfectly capable of doing packet fragmentation if given bigger
PDUs than the HCI buffers allow. Forcing the PDU length based on the HCI
MTU (conn->mtu) would therefore needlessly strict operation on hardware
with limited LE buffers (e.g. both Intel and Broadcom seem to have this
set to just 27 bytes).

This patch removes the restriction and makes it possible to send PDUs of
the full length that the remote MPS value allows.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2cap_core.c
61a3d4f9d52c00b2016bc27fc66b10a194043f76 08-Sep-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
f161dd4122ffa73e4e12000309dca65bec80d416 15-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_conn reference counting for auto-connections

Recently the LE passive scanning and auto-connections feature was
introduced. It uses the hci_connect_le() API which returns a hci_conn
along with a reference count to that object. All previous users would
tie this returned reference to some existing object, such as an L2CAP
channel, and there'd be no leaked references this way. For
auto-connections however the reference was returned but not stored
anywhere, leaving established connections with one higher reference
count than they should have.

Instead of playing special tricks with hci_conn_hold/drop this patch
associates the returned reference from hci_connect_le() with the object
that in practice does own this reference, i.e. the hci_conn_params
struct that caused us to initiate a connection in the first place. Once
the connection is established or fails to establish this reference is
removed appropriately.

One extra thing needed is to call hci_pend_le_actions_clear() before
calling hci_conn_hash_flush() so that the reference is cleared before
the hci_conn objects are fully removed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
13cac15296afe7e42088ecfcd0f1d4b658248c46 14-Aug-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Fix ERTM L2CAP resend packet

I-Frame which is going to be resend already has FCS field added and set
(if it was required). Adding additional FCS field calculated from data +
old FCS in resend function is incorrect. This patch fix that.

Issue has been found during PTS testing.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
069cb27017de6476d47a70fbf144f69200d3e854 13-Aug-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Improve data packing in SAR mode

There is no need to decrease pdu size with L2CAP SDU lenght in Start
L2CAP SDU frame. Start packtet is just 2 bytes longer as specified and
we can keep payload as long as possible.

When testing SAR L2CAP against PTS, L2CAP channel is usually configured
in that way, that SDU = MPS * 3. PTS expets then 3 I-Frames from IUT: Start,
Continuation and End frame.

Without this fix, we sent 4 I-Frames. We could pass a test by using -b
option in l2test and send just two bytes less than SDU length. With this
patch no need to use -b option.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
6f48e260a95c1a0161e5be39adb0f20c737fe459 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make smp_chan_destroy() private to smp.c

There are no external users of smp_chan_destroy() so make it private to
smp.c. The patch also moves the function higher up in the c-file in
order to avoid forward declarations.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
86d1407cb9cd3cb866eae24a2aedb8006160db69 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Always call smp_distribute_keys() from a workqueue

The smp_distribute_keys() function calls smp_notify_keys() which in turn
calls l2cap_conn_update_id_addr(). The l2cap_conn_update_id_addr()
function will iterate through all L2CAP channels for the respective
connection: lock the channel, update the address information and unlock
the channel.

Since SMP is now using l2cap_chan callbacks each callback is called with
the channel lock held. Therefore, calling l2cap_conn_update_id_addr()
would cause a deadlock calling l2cap_chan_lock() on the SMP channel.
This patch moves calling smp_distribute_keys() through a workqueue so
that it is never called from an L2CAP channel callback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
109ec2309eb996fbe03302fbd40dec9014c6f849 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move canceling security_timer into smp_chan_destroy()

All places needing to cancel the security timer also call
smp_chan_destroy() in the same go. To eliminate the need to do these two
calls in multiple places simply move the timer cancellation into
smp_chan_destroy().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
276d807317dead63ef2f13aa46e3c17d57ba0713 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused l2cap_conn->security_timer

Now that there are no-longer any users for l2cap_conn->security_timer we
can go ahead and simply remove it. The patch makes initialization of the
conn->info_timer unconditional since it's better not to leave any
l2cap_conn data structures uninitialized no matter what the underlying
transport.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
b68fda6848ebef3499905500971d40b84faa8319 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add SMP-internal timeout callback

This patch adds an SMP-internal timeout callback to remove the depenency
on (the soon to be removed) l2cap_conn->security_timer. The behavior is
the same as with l2cap_conn->security_timer except that the new
l2cap_conn_shutdown() public function is used instead of the L2CAP core
internal l2cap_conn_del().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
8ae9b9845b3252216cf5d2e033e5cca41bae48ef 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix double free of SMP data skb

In the case that the SMP recv callback returns error the calling code in
l2cap_core.c expects that it still owns the skb and will try to free it.
The SMP code should therefore not try to free the skb if it return an
error. This patch fixes such behavior in the SMP command handler
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
4befb867b9de8adc56c683f4cf6c9e6c035e94e3 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Call l2cap_conn_shutdown() when SMP recv callback fails

To restore pre-l2cap_chan functionality we should be trying to
disconnect the connection when receviving garbage SMP data (i.e. when
the SMP command handler fails). This patch renames the command handler
back to smp_sig_channel() and adds a smp_recv_cb() wrapper function for
calling it. If smp_sig_channel() fails the code calls
l2cap_conn_shutdown().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
dec5b49235e2526d7aacf5b93ea48f5e30c2f7c3 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add public l2cap_conn_shutdown() API to request disconnection

Since we no-longer do special handling of SMP within l2cap_core.c we
don't have any code for calling l2cap_conn_del() when smp.c doesn't like
the data it gets. At the same time we cannot simply export
l2cap_conn_del() since it will try to lock the channels it calls into
whereas we already hold the lock in the smp.c l2cap_chan callbacks (i.e.
it'd lead to a deadlock).

This patch adds a new l2cap_conn_shutdown() API which is very similar to
l2cap_conn_del() except that it defers the call to l2cap_conn_del()
through a workqueue, thereby making it safe to use it from an L2CAP
channel callback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
44f1a7ab51ebe1ca189445837e0599a5edc6efb1 11-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use L2CAP resume callback to call smp_distribute_keys

There's no need to export the smp_distribute_keys() function since the
resume callback is called in the same scenario. This patch makes the
smp_notify_keys function private (at the same time moving it higher up
in smp.c to avoid forward declarations) and adds a resume callback for
SMP to call it from there instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
mp.c
mp.h
5d88cc73dded31a93fcc4821f33a8c3d755bf454 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert SMP to use l2cap_chan infrastructure

Now that we have all the necessary pieces in place we can fully convert
SMP to use the L2CAP channel infrastructure. This patch adds the
necessary callbacks and removes the now unneeded conn->smp_chan pointer.

One notable behavioral change in this patch comes from the following
code snippet:

- case L2CAP_CID_SMP:
- if (smp_sig_channel(conn, skb))
- l2cap_conn_del(conn->hcon, EACCES);

This piece of code was essentially forcing a disconnection if garbage
SMP data was received. The l2cap_conn_del() function is private to
l2cap_conn.c so we don't have access to it anymore when using the L2CAP
channel callbacks. Therefore, the behavior of the new code is simply to
return errors in the recv() callback (which is simply the old
smp_sig_channel()), but no disconnection will occur.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
mp.c
mp.h
defce9e83666658d4420d65e45ab1ad190992f72 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make AES crypto context private to SMP

Now that we have per-adapter SMP data thanks to the root SMP L2CAP
channel we can take advantage of it and attach the AES crypto context
(only used for SMP) to it. This means that the smp_irk_matches() and
smp_generate_rpa() function can be converted to internally handle the
AES context.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
mp.c
mp.h
70db83c4bcdc1447bbcb318389561c90d7056b18 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add SMP L2CAP channel skeleton

This patch creates the initial SMP L2CAP channels and a skeleton for
their callbacks. There is one per-adapter channel created upon adapter
registration, and then one channel per-connection created through the
new_connection callback. The channels are registered with the reserved
CID 0x1f for now in order to not conflict with existing SMP
functionality. Once everything is in place the value can be changed to
what it should be, i.e. L2CAP_CID_SMP.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
711eafe345d993cf4831e890fa989d02c06cad62 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move SMP (de)initialization to smp.c

As preparation for moving SMP to use l2cap_chan infrastructure we need
to move the (de)initialization functions to smp.c (where they'll
eventually need access to the local L2CAP channel callbacks).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
mp.c
mp.h
54506918059a5bdbf396f34f2e0a2735803024db 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move SMP initialization after HCI init

First of all, it's wasteful to initialize SMP if it's never going to be
used (e.g. on non-LE controllers). Second of all, when we move to use
l2cap_chan we need to know the real local address, meaning we must have
completed at least part of the HCI init. This patch moves the SMP
initialization to after the HCI init procedure and makes it depend on
whether the controller actually supports LE.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
222916e3e509f04678d0b6f13f7b17bbc8dd14b6 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor SMP (de)initialization into separate functions

As preparation for converting SMP to use the l2cap_chan infrastructure
refactor the (de)initialization into separate functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
893ededeb189aa48c308116a7acd793efae5c830 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix IRK lookup when tfm_aes is not available

If the AES crypto has not been initialized properly we should cleanly
return from the hci_find_irk_by_rpa() function. Right now this will not
happen in practice, but once (in subsequent patches) SMP init is moved
to after the HCI init procedure it is possible that the pointer is NULL.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
fabed38fcf456cc5d3e6946fab78855aa65bd40b 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_update_random_address() error return for no crypto

If the AES crypto context is not available we cannot generate new RPAs.
We should therefore cleanly return an error from the function
responsible for updating the random address.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
d3368605591b88cd8af522adadb1c460a8f8e7bb 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix using HCI_CONN_LE_SMP_PEND to check for SMP context

The code is consistently using the HCI_CONN_LE_SMP_PEND flag check for
the existence of the SMP context, with the exception of this one place
in smp_sig_channel(). This patch converts the place to use the flag just
like all other instances.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
79a0572736ad4b9cac7be72d4402f9c79db8ebaf 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Call l2cap_le_conn_ready after notifying channels

For most cases it makes no difference whether l2cap_le_conn_ready() is
called before or after calling the channel ready() callbacks, however
for upcoming SMP code we need this as the ready() callback initializes
certain structures that a call to smp_conn_security() from
l2cap_le_conn_ready() depends on. Therefore, move the call to
l2cap_le_conn_ready() after iterating through and notifying channels.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
72847ce02180e8a0be1b23ba53ffe437cdb25d6a 08-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Call L2CAP teardown callback before clearing chan->conn

L2CAP channel implementations may want to still access the chan->conn
pointer. This will particularly be the case for SMP that will want to
clear a reference to the SMP channel in the l2cap_conn structure. The
only user of the teardown callback so far is l2cap_sock.c and for the
code there it makes no difference whether the callback is called before
or after clearing the chan->conn pointer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
148243087b3a5d95a32825da26858dc9d893b141 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move parts of fixed channel initialization to l2cap_add_scid

The l2cap_add_scid function is used for registering a fixed L2CAP
channel. Instead of having separate initialization of the channel type
and outgoing MTU in l2cap_sock.c it's more intuitive to do these things
in the l2cap_add_scid function itself (and thereby make the
functionality available to other users besides l2cap_sock.c).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
06171e0546434b006a3857ea745b4258ad5d677c 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove special ATT data channel handling

Now that we've got the fixed channel infrastructure cleaned up in a
generic way there's no longer a need to have a dedicated function for
handling data on the ATT channel. Instead the generic
l2cap_data_channel() handler will be able to do the exact same thing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
54a1b626c96039f172dd2ea15b2671053b3c5a68 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Improve fixed channel lookup based on link type

When notifying global fixed channels of new connections it doesn't make
sense to consider channels meant for a different link type than the one
available. This patch adds an extra parameter to the
l2cap_global_fixed_chan() lookup function and ensures that only channels
matching the current hci_conn type are looked up.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
e760ec12134d5736065c4e88b0e783cc1fe0d20a 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move L2CAP fixed channel creation into l2cap_conn_cfm

In order to remove special handling of fixed L2CAP channels we need to
start creating them in a single place instead of having per-channel
exceptions. The most natural place is the l2cap_conn_cfm() function
which is called whenever there is a new baseband link.

The only really special case so far has been the ATT socket, so in order
not to break the code in between this patch removes the ATT special
handling at the same time as it adds the generic fixed channel handling
from l2cap_le_conn_ready() into the hci_conn_cfm() function. As a
related change the channel locking in l2cap_conn_ready() becomes simpler
and we can thereby move the smp_conn_security() call into the
l2cap_le_conn_ready() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
dc0f5088182b2e48ae47629a55bdf35ad5d6ed44 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor l2cap_connect_cfm

This patch is a simple refactoring of l2cap_connect_cfm to allow easier
extension of the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
191eb398c677444bc08cb4497467ca9e2b8696bc 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove special handling of ATT in l2cap_security_cfm()

With the update to sk->resume() and __l2cap_no_conn_pending() we
no-longer need to have special handling of ATT channels in the
l2cap_security_cfm() function. The chan->sec_level update when
encryption has been enabled is safe to do for any kind of channel, and
the loop takes later care of calling chan->ready() or chan->resume() if
necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
d52deb17489b8155e031fb1a9f116c602d719e11 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Resume BT_CONNECTED state after LE security elevation

The LE ATT socket uses a special trick where it temporarily sets
BT_CONFIG state for the duration of a security level elevation. In order
to not require special hacks for going back to BT_CONNECTED state in the
l2cap_core.c code the most reasonable place to resume the state is the
resume callback. This patch adds a new flag to track the pending
security level change and ensures that the state is set back to
BT_CONNECTED in the resume callback in case the flag is set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
5ff6f34d4260c542df3712e29ead87cf071ad472 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix __l2cap_no_conn_pending() usage with all channels

The __l2cap_no_conn_pending() function would previously only return a
meaningful value for connection oriented channels and was therefore not
useful for anything else. As preparation of making the L2CAP code more
generic allow the function to be called for other channel types as well
by returning a meaningful value for them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
a24cce144b9814a17f46006dbad6056f1f5f481e 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix reference counting of global L2CAP channels

When looking up entries from the global L2CAP channel list there needs
to be a guarantee that other code doesn't go and remove the entry after
a channel has been returned by the lookup function. This patch makes
sure that the channel reference is incremented before the read lock is
released in the global channel lookup functions. The patch also adds the
corresponding l2cap_chan_put() calls once the channels pointers are
no-longer needed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2b29349044cc2cf74d4c6e23e26cd27977d91353 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix confusion between parent and child channel for 6lowpan

The new_connection L2CAP channel callback creates a new channel based on
the provided parent channel. The 6lowpan code was confusingly naming the
child channel "pchan" and the parent channel "chan". This patch swaps
the names.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
5fcb93475697911eb239f68241903eb5540803ac 07-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant check for remote_key_dist

In the smp_cmd_sign_info() function the SMP_DIST_SIGN bit is explicitly
cleared early on in the function. This means that there's no need to
check for it again before calling smp_distribute_keys().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
22f433dcf7c71cf075e4c42b5f36ea4352978a6d 01-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Disable page scan if all whitelisted devices are connected

When we're not connectable and all whitelisted (BR/EDR) devices are
connected it doesn't make sense to keep page scan enabled. This patch
adds code to check for any disconnected whitelist devices and if there
are none take the appropriate action in the hci_update_page_scan()
function to disable page scan.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
432df05eb1e57adfc46df08abbedca6c3b8862f7 01-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Create unified helper function for updating page scan

Similar to our hci_update_background_scan() function we can simplify a
lot of code by creating a unified helper function for doing page scan
updates. This patch adds such a function to hci_core.c and updates all
the relevant places to use it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
84c61d92bb6e9048eecc0738a83f1bf66f053026 01-Aug-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add convenience function to check for pending power off

There are several situations where we're interested in knowing whether
we're currently in the process of powering off an adapter. This patch
adds a convenience function for the purpose and makes it public since
we'll soon need to access it from hci_event.c as well.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ae045e2455429c418a418a3376301a9e5753a0a8 06-Aug-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
"Highlights:

1) Steady transitioning of the BPF instructure to a generic spot so
all kernel subsystems can make use of it, from Alexei Starovoitov.

2) SFC driver supports busy polling, from Alexandre Rames.

3) Take advantage of hash table in UDP multicast delivery, from David
Held.

4) Lighten locking, in particular by getting rid of the LRU lists, in
inet frag handling. From Florian Westphal.

5) Add support for various RFC6458 control messages in SCTP, from
Geir Ola Vaagland.

6) Allow to filter bridge forwarding database dumps by device, from
Jamal Hadi Salim.

7) virtio-net also now supports busy polling, from Jason Wang.

8) Some low level optimization tweaks in pktgen from Jesper Dangaard
Brouer.

9) Add support for ipv6 address generation modes, so that userland
can have some input into the process. From Jiri Pirko.

10) Consolidate common TCP connection request code in ipv4 and ipv6,
from Octavian Purdila.

11) New ARP packet logger in netfilter, from Pablo Neira Ayuso.

12) Generic resizable RCU hash table, with intial users in netlink and
nftables. From Thomas Graf.

13) Maintain a name assignment type so that userspace can see where a
network device name came from (enumerated by kernel, assigned
explicitly by userspace, etc.) From Tom Gundersen.

14) Automatic flow label generation on transmit in ipv6, from Tom
Herbert.

15) New packet timestamping facilities from Willem de Bruijn, meant to
assist in measuring latencies going into/out-of the packet
scheduler, latency from TCP data transmission to ACK, etc"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1536 commits)
cxgb4 : Disable recursive mailbox commands when enabling vi
net: reduce USB network driver config options.
tg3: Modify tg3_tso_bug() to handle multiple TX rings
amd-xgbe: Perform phy connect/disconnect at dev open/stop
amd-xgbe: Use dma_set_mask_and_coherent to set DMA mask
net: sun4i-emac: fix memory leak on bad packet
sctp: fix possible seqlock seadlock in sctp_packet_transmit()
Revert "net: phy: Set the driver when registering an MDIO bus device"
cxgb4vf: Turn off SGE RX/TX Callback Timers and interrupts in PCI shutdown routine
team: Simplify return path of team_newlink
bridge: Update outdated comment on promiscuous mode
net-timestamp: ACK timestamp for bytestreams
net-timestamp: TCP timestamping
net-timestamp: SCHED timestamp on entering packet scheduler
net-timestamp: add key to disambiguate concurrent datagrams
net-timestamp: move timestamp flags out of sk_flags
net-timestamp: extend SCM_TIMESTAMPING ancillary data struct
cxgb4i : Move stray CPL definitions to cxgb4 driver
tcp: reduce spurious retransmits due to transient SACK reneging
qlcnic: Initialize dcbnl_ops before register_netdev
...
aef4f5b6db654e512ebcccab2a6e50424c05d2f9 05-Aug-2014 David S. Miller <davem@davemloft.net> Merge tag 'master-2014-07-31' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

Conflicts:
net/6lowpan/iphc.c

Minor conflicts in iphc.c were changes overlapping with some
style cleanups.

John W. Linville says:

====================
Please pull this last(?) batch of wireless change intended for the
3.17 stream...

For the NFC bits, Samuel says:

"This is a rather quiet one, we have:

- A new driver from ST Microelectronics for their NCI ST21NFCB,
including device tree support.

- p2p support for the ST21NFCA driver

- A few fixes an enhancements for the NFC digital laye"

For the Atheros bits, Kalle says:

"Michal and Janusz did some important RX aggregation fixes, basically we
were missing RX reordering altogether. The 10.1 firmware doesn't support
Ad-Hoc mode and Michal fixed ath10k so that it doesn't advertise Ad-Hoc
support with that firmware. Also he implemented a workaround for a KVM
issue."

For the Bluetooth bits, Gustavo and Johan say:

"To quote Gustavo from his previous request:

'Some last minute fixes for -next. We have a fix for a use after free in
RFCOMM, another fix to an issue with ADV_DIRECT_IND and one for ADV_IND with
auto-connection handling. Last, we added support for reading the codec and
MWS setting for controllers that support these features.'

Additionally there are fixes to LE scanning, an update to conform to the 4.1
core specification as well as fixes for tracking the page scan state. All
of these fixes are important for 3.17."

And,

"We've got:

- 6lowpan fixes/cleanups
- A couple crash fixes, one for the Marvell HCI driver and another in LE SMP.
- Fix for an incorrect connected state check
- Fix for the bondable requirement during pairing (an issue which had
crept in because of using "pairable" when in fact the actual meaning
was "bondable" (these have different meanings in Bluetooth)"

Along with those are some late-breaking hardware support patches in
brcmfmac and b43 as well as a stray ath9k patch.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
82c295b1b07595d21e9931c58f08ccd9fa151de0 30-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Always use non-bonding requirement when not bondable

When we're not bondable we should never send any other SSP
authentication requirement besides one of the non-bonding ones.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
b2939475eb6a3575fe542c06f3f879b93d48ae1b 30-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename pairable mgmt setting to bondable

This setting maps to the HCI_BONDABLE flag which tracks whether we're
bondable or not. Therefore, rename the mgmt setting and respective
command accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b6ae8457ac5c727a2bb85eb8f2e22375d44d2b2d 30-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename HCI_PAIRABLE to HCI_BONDABLE

The HCI_PAIRABLE flag isn't actually controlling whether we're pairable
but whether we're bondable. Therefore, rename it accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
mp.c
bdb9434664d026ea63ad086443160dd4ed347758 30-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix sparse warning from HID new leds handling

The new leds bit handling produces this spares warning.

CHECK net/bluetooth/hidp/core.c
net/bluetooth/hidp/core.c:156:60: warning: dubious: x | !y

Just fix it by doing an explicit x << 0 shift operation.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
idp/core.c
6f78fd4bb93e17543f2f6f25112687c633c12eb7 30-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix check for connected state when pairing

Both BT_CONNECTED and BT_CONFIG state mean that we have a baseband link
available. We should therefore check for either of these when pairing
and deciding whether to call hci_conn_security() directly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
616d55be4c754dc7e1e1b7df59fb6cc5aee19ddd 29-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP context tracking leading to a kernel crash

The HCI_CONN_LE_SMP_PEND flag is supposed to indicate whether we have an
SMP context or not. If the context creation fails, or some other error
is indicated between setting the flag and creating the context the flag
must be cleared first.

This patch ensures that smp_chan_create() clears the flag in case of
allocation failure as well as reorders code in smp_cmd_security_req()
that could lead to returning an error between setting the flag and
creating the context.

Without the patch the following kind of kernel crash could be observed
(this one because of unacceptable authentication requirements in a
Security Request):

[ +0.000855] kernel BUG at net/bluetooth/smp.c:606!
[ +0.000000] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ +0.000000] CPU: 0 PID: 58 Comm: kworker/u5:2 Tainted: G W 3.16.0-rc1+ #785
[ +0.008391] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ +0.000000] Workqueue: hci0 hci_rx_work
[ +0.000000] task: f4dc8f90 ti: f4ef0000 task.ti: f4ef0000
[ +0.000000] EIP: 0060:[<c13432b6>] EFLAGS: 00010246 CPU: 0
[ +0.000000] EIP is at smp_chan_destroy+0x1e/0x145
[ +0.000709] EAX: f46db870 EBX: 00000000 ECX: 00000000 EDX: 00000005
[ +0.000000] ESI: f46db870 EDI: f46db870 EBP: f4ef1dc0 ESP: f4ef1db0
[ +0.000000] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ +0.000000] CR0: 8005003b CR2: b666b0b0 CR3: 00022000 CR4: 00000690
[ +0.000000] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ +0.000000] DR6: fffe0ff0 DR7: 00000400
[ +0.000000] Stack:
[ +0.000000] 00000005 f17b7840 f46db870 f4ef1dd4 f4ef1de4 c1343441 c134342e 00000000
[ +0.000000] c1343441 00000005 00000002 00000000 f17b7840 f4ef1e38 c134452a 00002aae
[ +0.000000] 01ef1e00 00002aae f46bd980 f46db870 00000039 ffffffff 00000007 f4ef1e34
[ +0.000000] Call Trace:
[ +0.000000] [<c1343441>] smp_failure+0x64/0x6c
[ +0.000000] [<c134342e>] ? smp_failure+0x51/0x6c
[ +0.000000] [<c1343441>] ? smp_failure+0x64/0x6c
[ +0.000000] [<c134452a>] smp_sig_channel+0xad6/0xafc
[ +0.000000] [<c1053b61>] ? vprintk_emit+0x343/0x366
[ +0.000000] [<c133f34e>] l2cap_recv_frame+0x1337/0x1ac4
[ +0.000000] [<c133f34e>] ? l2cap_recv_frame+0x1337/0x1ac4
[ +0.000000] [<c1172307>] ? __dynamic_pr_debug+0x3e/0x40
[ +0.000000] [<c11702a1>] ? debug_smp_processor_id+0x12/0x14
[ +0.000000] [<c1340bc9>] l2cap_recv_acldata+0xe8/0x239
[ +0.000000] [<c1340bc9>] ? l2cap_recv_acldata+0xe8/0x239
[ +0.000000] [<c1169931>] ? __const_udelay+0x1a/0x1c
[ +0.000000] [<c131f120>] hci_rx_work+0x1a1/0x286
[ +0.000000] [<c137244e>] ? mutex_unlock+0x8/0xa
[ +0.000000] [<c131f120>] ? hci_rx_work+0x1a1/0x286
[ +0.000000] [<c1038fe5>] process_one_work+0x128/0x1df
[ +0.000000] [<c1038fe5>] ? process_one_work+0x128/0x1df
[ +0.000000] [<c10392df>] worker_thread+0x222/0x2de
[ +0.000000] [<c10390bd>] ? process_scheduled_works+0x21/0x21
[ +0.000000] [<c103d34c>] kthread+0x82/0x87
[ +0.000000] [<c1040000>] ? create_new_namespaces+0x90/0x105
[ +0.000000] [<c13738e1>] ret_from_kernel_thread+0x21/0x30
[ +0.000000] [<c103d2ca>] ? __kthread_parkme+0x50/0x50
[ +0.000000] Code: 65 f4 89 f0 5b 5e 5f 5d 8d 67 f8 5f c3 57 8d 7c 24 08 83 e4 f8 ff 77 fc 55 89 e5 57 89 c7 56 53 52 8b 98 e0 00 00 00 85 db 75 02 <0f> 0b 8b b3 80 00 00 00 8b 00 c1 ee 03 83 e6 01 89 f2 e8 ef 09
[ +0.000000] EIP: [<c13432b6>] smp_chan_destroy+0x1e/0x145 SS:ESP 0068:f4ef1db0

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
3fd0202a0dfe07d255c5462d7d0e27673ca10430 29-Jul-2014 David S. Miller <davem@davemloft.net> Merge tag 'master-2014-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
pull request: wireless-next 2014-07-25

Please pull this batch of updates intended for the 3.17 stream!

For the mac80211 bits, Johannes says:

"We have a lot of TDLS patches, among them a fix that should make hwsim
tests happy again. The rest, this time, is mostly small fixes."

For the Bluetooth bits, Gustavo says:

"Some more patches for 3.17. The most important change here is the move of
the 6lowpan code to net/6lowpan. It has been agreed with Davem that this
change will go through the bluetooth tree. The rest are mostly clean up and
fixes."

and,

"Here follows some more patches for 3.17. These are mostly fixes to what
we've sent to you before for next merge window."

For the iwlwifi bits, Emmanuel says:

"I have the usual amount of BT Coex stuff. Arik continues to work
on TDLS and Ariej contributes a few things for HS2.0. I added a few
more things to the firmware debugging infrastructure. Eran fixes a
small bug - pretty normal content."

And for the Atheros bits, Kalle says:

"For ath6kl me and Jessica added support for ar6004 hw3.0, our latest
version of ar6004.

For ath10k Janusz added a printout so that it's easier to check what
ath10k kconfig options are enabled. He also added a debugfs file to
configure maximum amsdu and ampdu values. Also we had few fixes as
usual."

On top of that is the usual large batch of various driver updates --
brcmfmac, mwifiex, the TI drivers, and wil6210 all get some action.
Rafał has also been very busy with b43 and related updates.

Also, I pulled the wireless tree into this in order to resolve a
merge conflict...

P.S. The change to fs/compat_ioctl.c reflects a name change in a
Bluetooth header file...
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
3bd2724010a51d5d15afa8065ac3c5fab3725499 28-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix incorrectly disabling page scan when toggling connectable

If we have entries in the whitelist we shouldn't disable page scanning
when disabling connectable mode. This patch adds the necessary check to
the Set Connectable command handler.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
204e399003174ee8ceb7606c61daaa7f4e89e794 28-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing HCI_PSCAN flag

This patch fixes a typo in the hci_cc_write_scan_enable() function where
we want to clear the HCI_PSCAN flag if the SCAN_PAGE bit of the HCI
command parameter was not set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
ca5bc6cd5de5b53eb8fd6fea39aa3fe2a1e8c3d9 28-Jul-2014 Ingo Molnar <mingo@kernel.org> Merge branch 'sched/urgent' into sched/core, to merge fixes before applying new changes

Signed-off-by: Ingo Molnar <mingo@kernel.org>
32226e4f1af2b58983676b577ce33403c08e6c94 24-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set Simultaneous LE and BR/EDR controller option to zero

With the Bluetooth 4.1 specification the Simultaneous LE and BR/EDR
controller option has been deprecated. It shall be set to zero and
ignored otherwise.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
729a1051da6ff92e52ef8773e1676d462dc43b90 26-Jul-2014 Georg Lukas <georg@op-co.de> Bluetooth: Expose default LE advertising interval via debugfs

Expose the default values for minimum and maximum LE advertising
interval via debugfs for testing purposes.

Signed-off-by: Georg Lukas <georg@op-co.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
628531c9e971f1bd023d9fbd00faff014ca22440 26-Jul-2014 Georg Lukas <georg@op-co.de> Bluetooth: Provide defaults for LE advertising interval

Store the default values for minimum and maximum advertising interval
with all the other controller defaults. These vaules are sent to the
adapter whenever advertising is (re)enabled.

Signed-off-by: Georg Lukas <georg@op-co.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
66d8e837ab4f58722c56ccbfa5ab9a522cebde78 24-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix white list handling with resolvable private addresses

Devices using resolvable private addresses are required to provide
an identity resolving key. These devices can not be found using
the current controller white list support. This means if the kernel
knows about any devices with an identity resolving key, the white
list filtering must be disabled.

However so far the kernel kept identity resolving keys around even
for devices that are not using resolvable private addresses. The
notification to userspace clearly hints to not store the key and
so it is best to just remove the key from the kernel as well at
that point.

With this it easy now to detect when using the white list is
possible or when kernel side resolving of addresses is required.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
mp.c
8540f6c0364722b141547c6c7ac366c3ea77390b 24-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for using controller white list filtering

The Bluetooth controller can use a white list filter when scanning
to avoid waking up the host for devices that are of no interest.

Devices marked as reporting, direct connection (incoming) or general
connection are now added to the controller white list. The update of
the white list happens just before enabling passive scanning.

In case the white list is full and can not hold all devices, the
white list is not used and the filter policy set to accept all
advertisements.

Using the white list for scanning allows for power saving with
controllers that do not handle the duplicate filtering correctly.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4b9e7e7516135b1d5f047ad59188b5355bacc106 23-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issue with ADV_IND reports and auto-connection handling

When adding remote devices to the kernel using the Add Device management
command, these devices are explicitly allowed to connect. This kind of
incoming connections are possible even when the controller itself is
not connectable.

For BR/EDR this distinction is pretty simple since there is only one
type of incoming connections. With LE this is not that simple anymore
since there are ADV_IND and ADV_DIRECT_IND advertising events.

The ADV_DIRECT_IND advertising events are send for incoming (slave
initiated) connections only. And this is the only thing the kernel
should allow when adding devices using action 0x01. This meaning
of incoming connections is coming from BR/EDR and needs to be
mapped to LE the same way.

Supporting the auto-connection of devices using ADV_IND advertising
events is an important feature as well. However it does not map to
incoming connections. So introduce a new action 0x02 that allows
the kernel to connect to devices using ADV_DIRECT_IND and in addition
ADV_IND advertising reports.

This difference is represented by the new HCI_AUTO_CONN_DIRECT value
for only connecting to ADV_DIRECT_IND. For connection to ADV_IND and
ADV_DIRECT_IND the old value HCI_AUTO_CONN_ALWAYS is used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
gmt.c
cd4d5671385ba0c6355e013512ea6d06b1ebce02 23-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Ignore ADV_DIRECT_IND attempts from unknown devices

Unconditionally connecting to devices sending ADV_DIRECT_IND when
the controller is in CONNECTABLE mode is a feature that is not
fully working. The background scanning trigger for this has been
removed, but the statement allowing it to happen in case some
other part triggers is still present. So remove that code part
as well to avoid unwanted connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
f4fe73ed564b1c0c375481cb7a773b03767b0216 23-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Get MWS transport configuration of the controller

If the Bluetooth controller supports Get MWS Transport Layer
Configuration command, then issue it during initialization.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
109e3191935a77d123375f045e719b164fa471aa 23-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read list of local codecs supported by the controller

If the Bluetooth controller supports Read Local Supported Codecs
command, then issue it during initialization so that the list of
codecs is known.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
32333edb82fb2009980eefc5518100068147ab82 22-Jul-2014 Vignesh Raman <Vignesh_Raman@mentor.com> Bluetooth: Avoid use of session socket after the session gets freed

The commits 08c30aca9e698faddebd34f81e1196295f9dc063 "Bluetooth: Remove
RFCOMM session refcnt" and 8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
"Bluetooth: Return RFCOMM session ptrs to avoid freed session"
allow rfcomm_recv_ua and rfcomm_session_close to delete the session
(and free the corresponding socket) and propagate NULL session pointer
to the upper callers.

Additional fix is required to terminate the loop in rfcomm_process_rx
function to avoid use of freed 'sk' memory.

The issue is only reproducible with kernel option CONFIG_PAGE_POISONING
enabled making freed memory being changed and filled up with fixed char
value used to unmask use-after-free issues.

Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com>
Signed-off-by: Vitaly Kuzmichev <Vitaly_Kuzmichev@mentor.com>
Acked-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
fcomm/core.c
27f70f3e628c82362def60eb0af79d2129a51da2 21-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Prefer sizeof(*ptr) when allocating memory

It's safer practice to use sizeof(*ptr) instead of sizeof(ptr_type) when
allocating memory in case the type changes. This also fixes the
following style of warnings from static analyzers:

CHECK: Prefer kzalloc(sizeof(*ie)...) over kzalloc(sizeof(struct inquiry_entry)...)
+ ie = kzalloc(sizeof(struct inquiry_entry), GFP_KERNEL);

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
2cap_core.c
0a961a440d693f0f74d3185728b13b8a11fc5860 20-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded variable assignment in hmac_sha256

The variable ret does not need to be assigned when declaring it. So
remove this initial assignment.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
d1d588c181e35d98113f91c8004f77cdac2bf9d5 20-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Disable HCI_CONNECTABLE based passive scanning for now

When HCI_CONNECTABLE is set the code has been enabling passive scanning
in order to be consistent with BR/EDR and accept connections from any
device doing directed advertising to us. However, some hardware
(particularly CSR) can get very noisy even when doing duplicates
filtering, making this feature waste resources.

Considering that the feature is for fairly corner-case use (devices
who'd use directed advertising would likely be in the whitelist anyway)
it's better to disable it for now. It may still be brought back later,
possibly with a better implementation (e.g. through improved scan
parameters).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
beb19e4c079d626bf0502fbb65bd7c9891a10c2e 18-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use EOPNOTSUPP instead of ENOTSUPP

The EOPNOTSUPP and ENOTSUPP errors are very similar in meaning, but
ENOTSUPP is a fairly new addition to POSIX. Not all libc versions know
about the value the kernel uses for ENOTSUPP so it's better to use
EOPNOTSUPP to ensure understandable error messages.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap_core.c
2cap_sock.c
mp.c
2f407f0afb443207789df3fb46456551aea11cc3 17-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix allowing initiating pairing when not pairable

When we're not pairable we should still allow us to act as initiators
for pairing, i.e. the HCI_PAIRABLE flag should only be affecting
incoming pairing attempts. This patch fixes the relevant checks for the
hci_io_capa_request_evt() and hci_pin_code_request_evt() functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
977f8fce0279e5f96dc5c5068610d60b9ae94802 17-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce a flag to track who really initiates authentication

Even though our side requests authentication, the original action that
caused it may be remotely triggered, such as an incoming L2CAP or RFCOMM
connect request. To track this information introduce a new hci_conn flag
called HCI_CONN_AUTH_INITIATOR.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
e7cafc45258c852c5176cd421615846e79a3d307 17-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass initiator/acceptor information to hci_conn_security()

We're interested in whether an authentication request is because of a
remote or local action. So far hci_conn_security() has been used both
for incoming and outgoing actions (e.g. RFCOMM or L2CAP connect
requests) so without some modifications it cannot know which peer is
responsible for requesting authentication.

This patch adds a new "bool initiator" parameter to hci_conn_security()
to indicate which side is responsible for the request and updates the
current users to pass this information correspondingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap_core.c
2cap_sock.c
gmt.c
fcomm/core.c
c1d4fa7aa86e9194724dfff9cb9359edb98d75ac 17-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix resetting remote authentication requirement after pairing

When a new hci_conn object is created the remote SSP authentication
requirement is set to the invalid value 0xff to indicate that it is
unknown. Once pairing completes however the code was leaving it as-is.
In case a new pairing happens over the same connection it is important
that we reset the value back to unknown so that the pairing code doesn't
make false assumptions about the requirements.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
093facf3634da1b0c2cc7ed106f1983da901bbab 14-Jul-2014 Vladimir Davydov <vdavydov@parallels.com> Bluetooth: never linger on process exit

If the current process is exiting, lingering on socket close will make
it unkillable, so we should avoid it.

Reproducer:

#include <sys/types.h>
#include <sys/socket.h>

#define BTPROTO_L2CAP 0
#define BTPROTO_SCO 2
#define BTPROTO_RFCOMM 3

int main()
{
int fd;
struct linger ling;

fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
//or: fd = socket(PF_BLUETOOTH, SOCK_DGRAM, BTPROTO_L2CAP);
//or: fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);

ling.l_onoff = 1;
ling.l_linger = 1000000000;
setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling));

return 0;
}

Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2cap_sock.c
fcomm/sock.c
co.c
02f3e25457915728624b976b0382601b5605ad64 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't bother user space without IO capabilities

If user space has a NoInputNoOutput IO capability it makes no sense to
bother it with confirmation requests. This patch updates both SSP and
SMP to check for the local IO capability before sending a user
confirmation request to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
mp.c
9f743d7499bc2c4dc8c35af33bdb2a29bea663b9 17-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix using uninitialized variable when pairing

Commit 6c53823ae0e10e723131055e1e65dd6a328a228e reshuffled the way the
authentication requirement gets set in the hci_io_capa_request_evt()
function, but at the same time it failed to update an if-statement where
cp.authentication is used before it has been initialized. The correct
value the code should be looking for in this if-statement is
conn->auth_type.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.16
ci_event.c
46c4c941a417265e4b8afb3c52f31cabcbf4deb1 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix always checking the blacklist for incoming connections

We should check the blacklist no matter what, meaning also when we're
not connectable. This patch fixes the respective logic in the function
making the decision whether to accept a connection or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
743162013d40ca612b4cb53d3a200dff2d9ab26e 07-Jul-2014 NeilBrown <neilb@suse.de> sched: Remove proliferation of wait_on_bit() action functions

The current "wait_on_bit" interface requires an 'action'
function to be provided which does the actual waiting.
There are over 20 such functions, many of them identical.
Most cases can be satisfied by one of just two functions, one
which uses io_schedule() and one which just uses schedule().

So:
Rename wait_on_bit and wait_on_bit_lock to
wait_on_bit_action and wait_on_bit_lock_action
to make it explicit that they need an action function.

Introduce new wait_on_bit{,_lock} and wait_on_bit{,_lock}_io
which are *not* given an action function but implicitly use
a standard one.
The decision to error-out if a signal is pending is now made
based on the 'mode' argument rather than being encoded in the action
function.

All instances of the old wait_on_bit and wait_on_bit_lock which
can use the new version have been changed accordingly and their
action functions have been discarded.
wait_on_bit{_lock} does not return any specific error code in the
event of a signal so the caller must check for non-zero and
interpolate their own error code as appropriate.

The wait_on_bit() call in __fscache_wait_on_invalidate() was
ambiguous as it specified TASK_UNINTERRUPTIBLE but used
fscache_wait_bit_interruptible as an action function.
David Howells confirms this should be uniformly
"uninterruptible"

The main remaining user of wait_on_bit{,_lock}_action is NFS
which needs to use a freezer-aware schedule() call.

A comment in fs/gfs2/glock.c notes that having multiple 'action'
functions is useful as they display differently in the 'wchan'
field of 'ps'. (and /proc/$PID/wchan).
As the new bit_wait{,_io} functions are tagged "__sched", they
will not show up at all, but something higher in the stack. So
the distinction will still be visible, only with different
function names (gds2_glock_wait versus gfs2_glock_dq_wait in the
gfs2/glock.c case).

Since first version of this patch (against 3.15) two new action
functions appeared, on in NFS and one in CIFS. CIFS also now
uses an action function that makes the same freezer aware
schedule call as NFS.

Signed-off-by: NeilBrown <neilb@suse.de>
Acked-by: David Howells <dhowells@redhat.com> (fscache, keys)
Acked-by: Steven Whitehouse <swhiteho@redhat.com> (gfs2)
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Steve French <sfrench@samba.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20140707051603.28027.72349.stgit@notabene.brown
Signed-off-by: Ingo Molnar <mingo@kernel.org>
ci_core.c
f99353cf9c061bc1700b6a49ee98cae93e28207b 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix trying to initiate connections when acting as LE slave

When we have at least one LE slave connection most (probably all)
controllers will refuse to initiate any new connections. To avoid
unnecessary failures simply check for this situation up-front and skip
the connection attempt.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a5c4e309b9f23b9de5475029b2cb1641ec293137 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a role parameter to hci_conn_add()

We need to be able to track slave vs master LE connections in
hci_conn_hash, and to be able to do that we need to know the role of the
connection by the time hci_conn_add_has() is called. This means in
practice the hci_conn_add() call that creates the hci_conn_object.

This patch adds a new role parameter to hci_conn_add() function to give
the object its initial role value, and updates the callers to pass the
appropriate role to it. Since the function now takes care of
initializing both conn->role and conn->out values we can remove some
other unnecessary assignments.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
ci_conn.c
ci_event.c
e804d25d4a07c0ff9e5e1c58ea5ee67232aa9af8 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use explicit role instead of a bool in function parameters

To make the code more understandable it makes sense to use the new HCI
defines for connection role instead of a "bool master" parameter. This
makes it immediately clear when looking at the function calls what the
last parameter is describing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
2cap_core.c
gmt.c
mp.c
40bef302f6323d1ee6fb3dc0e62edb0f446d0339 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert HCI_CONN_MASTER flag to a conn->role variable

Having a dedicated u8 role variable in the hci_conn struct greatly
simplifies tracking of the role, since this is the native way that it's
represented on the HCI level.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
mp.c
ba165a90b59812ab1d9cd2943fd104cfc25c601e 16-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add proper defines for HCI connection role

All HCI commands and events, including LE ones, use 0x00 for master role
and 0x01 for slave role. It makes therefore sense to add generic defines
for these instead of the current LE_CONN_ROLE_MASTER. Having clean
defines will also make it possible to provide simpler internal APIs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
c835a677331495cf137a7f8a023463afd9f032f8 14-Jul-2014 Tom Gundersen <teg@jklm.no> net: set name_assign_type in alloc_netdev()

Extend alloc_netdev{,_mq{,s}}() to take name_assign_type as argument, and convert
all users to pass NET_NAME_UNKNOWN.

Coccinelle patch:

@@
expression sizeof_priv, name, setup, txqs, rxqs, count;
@@

(
-alloc_netdev_mqs(sizeof_priv, name, setup, txqs, rxqs)
+alloc_netdev_mqs(sizeof_priv, name, NET_NAME_UNKNOWN, setup, txqs, rxqs)
|
-alloc_netdev_mq(sizeof_priv, name, setup, count)
+alloc_netdev_mq(sizeof_priv, name, NET_NAME_UNKNOWN, setup, count)
|
-alloc_netdev(sizeof_priv, name, setup)
+alloc_netdev(sizeof_priv, name, NET_NAME_UNKNOWN, setup)
)

v9: move comments here from the wrong commit

Signed-off-by: Tom Gundersen <teg@jklm.no>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
lowpan.c
nep/core.c
2d3c2260e7ef0b21f7f0db0fbfee0b092e1202f8 15-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't try to reject failed LE connections

The check for the blacklist in hci_le_conn_complete_evt() should be when
we know that we have an actual successful connection (ev->status being
non-zero). This patch fixes this ordering.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
3a19b6feb26295fe03c9242a72084d2f32dcaac4 15-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary params variable from process_adv_report()

The params variable was just used for storing the return value from the
hci_pend_le_action_lookup() function and then checking whether it's NULL
or not. We can simplify the code by checking the return value directly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
4d042654afb342386cb5c33e29843b76d598ab61 14-Jul-2014 Himangi Saraogi <himangi774@gmail.com> Bluetooth: cmtp: Remove unnecessary null test

This patch removes the null test on ctrl. ctrl is initialized at the
beginning of the function to &session->ctrl. Since session is
dereferenced prior to the null test, session must be a valid pointer,
and &session->ctrl cannot be null.

The following Coccinelle script is used for detecting the change:

@r@
expression e,f;
identifier g,y;
statement S1,S2;
@@

*e = &f->g
<+...
f->y
...+>
*if (e != NULL || ...)
S1 else S2

Signed-off-by: Himangi Saraogi <himangi774@gmail.com>
Acked-by: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mtp/capi.c
b2d5e254ebfe9e4a926265c23bc5943f212fd1ac 14-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix trying LTK re-encryption when we don't have an LTK

In the case that the key distribution bits cause us not to generate a
local LTK we should not try to re-encrypt if we're currently encrypted
with an STK. This patch fixes the check for this in the
smp_sufficient_security function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
eb5a4de80f266d0bb7edd43c61894da74faaa91a 14-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove sco_chan_get helper function

The sco_chan_get helper function is only used in two places and really
only protects conn->sk with a lock. So instead of hiding that fact,
just put the actual code in place where it is used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
5a54e7c85b8303b84a9b2fbf978a74d625f85a99 13-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Convert L2CAP ident spinlock into a mutex

The spinlock protecting the L2CAP ident number can be converted into
a mutex since the whole processing is run in a workqueue. So instead
of using a spinlock, just use a mutex here.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
e03ab5199df597d3f1737ef638a7f692daaaef9f 13-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded forward declaration of sco_chan_del

The forward declaration of sco_chan_del is not needed and thus just
remove it. Move sco_chan_del into the proper location.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
015b01cbca20276a6b09ad25ce4002e811a53130 13-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded forward declaration of __sco_chan_add

The forward declaration of __sco_chan_add is not needed and thus just
remove it. Move __sco_chan_add into the proper location.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
395365eaf125e53b9d7e1c11c91ee01bf5a4b792 13-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allocate struct inquiry_entry with GFP_KERNEL

The allocation of inquiry cache entries is triggered as a result of
processing HCI events. Since the processing is done in the context
of a workqueue, there is no needed to allocate with GFP_ATOMIC in
that case. Switch it to GFP_KERNEL.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4d6c705bbd9e845bcfbe119bb017a5653c0d9efb 13-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable LE Long Term Key Request event only when supported

The support for LE encryption is optional and with that also the
LE Long Term Key Request event. If encryption is not supported, then
do not bother enabling this event.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
0da71f1bf90f259debf50aaaa547e2cc31b5cf67 12-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable LE encryption events only when supported

The support for LE encryption is optional. When encryption is not
supported then also do not enable the encryption related events.

This moves the event mask setting to the third initialization
stage to ensure that the LE features are available.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
15a49cca98c3380271ced8db2ea69ee95db5c709 12-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read LE Advertising Channel TX Power only when available

The Read LE Advertising Channel TX Power command is not mandatory for
a Bluetooth HCI controller only supporting receiption. Move the command
to the third stage of the controller initialization and only execute it
when support for it has been indicated.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2c6bed7cfcd3f594ed9e4d6919fa2ebea2243d19 11-Jul-2014 Alexander Aring <alex.aring@gmail.com> 6lowpan: introduce new net/6lowpan directory

This patch moves generic code which is used by bluetooth and ieee802154
6lowpan to a new net/6lowpan directory. This directory contains generic
6LoWPAN code which is shared between bluetooth and ieee802154 MAC-Layer.

This is the IPHC - "IPv6 Header Compression" format at the moment. Which
is described by RFC 6282 [0]. The BLTE 6LoWPAN draft describes that the
IPHC is the same format like IEEE 802.15.4, see [1].

Futuremore we can put more code into this directory which is shared
between BLTE and IEEE 802.15.4 6LoWPAN like RFC 6775 or the routing
protocol RPL RFC 6550.

To avoid naming conflicts I renamed 6lowpan-y to ieee802154_6lowpan-y
in net/ieee802154/Makefile.

[0] http://tools.ietf.org/html/rfc6282
[1] http://tools.ietf.org/html/draft-ietf-6lowpan-btle-12#section-3.2
[2] http://tools.ietf.org/html/rfc6775
[3] http://tools.ietf.org/html/rfc6550

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
6c53823ae0e10e723131055e1e65dd6a328a228e 11-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix tracking local SSP authentication requirement

When we need to make the decision whether to perform just-works or real
user confirmation we need to know the exact local authentication
requirement that was passed to the controller. So far conn->auth_type
(the local requirement) wasn't in one case updated appropriately in fear
of the user confirmation being rejected later.

The real problem however was not really that conn->auth_type couldn't
represent the true value but that we were checking the local MITM
requirement in an incorrect way. It's perfectly fine to let auth_type
follow what we tell the controller since we're still tracking the target
security level with conn->pending_sec_level.

This patch updates the check for local MITM requirement in the
hci_user_confirm_request_evt function to use the locally requested
security level and ensures that auth_type always represents what we tell
the controller. All other code in hci_user_confirm_request_evt still
uses the auth_type instead of pending_sec_level for determining whether
to do just-works or not, since that's the only value that's in sync with
what the remote device knows.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org # 3.16
ci_event.c
068d69e5bbd85291aa8ad0d81062f047609a173c 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move SCO timeout constants into net/bluetooth/sco.c

There is no external user of the SCO timeout constants and thus
move them into net/bluetooth/sco.c where they are actuallu used.

In addition just remove SCO_CONN_IDLE_TIMEOUT since it is unused.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
fc8f525a6f7c81743bec6b5d497988313b211383 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move struct sco_conn into net/bluetooth/sco.c

There exists no external user of struct sco_conn and thus move
it into the one place that is actually using it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
2a0dccb3df2c8775d1a6e962aa88c4c22693c887 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move struct sco_pinfo into net/bluetooth/sco.c

There exists no external user of struct sco_pinfo and sco_pi and
thus move it into the one place that is actually using it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
a6801ca9856c24298cba2c1fafd3da818acdaab6 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update the list of L2CAP fixed channels

The list of L2CAP fixed channels increased with newer versions of the
specification. This just updates the constants for it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
899de765667b63bb51526f0a31693aed6ad5f828 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move HCI request internals to net/bluetooth/hci_core.c

The internals of the HCI request framework should not be leaking to
its users. Move them all into net/bluetooth/hci_core.c and provide
a simple hci_req_pending helper function for the one user outside
the framework.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
863def58fec2fa494c8e9ca45471819c6d731ec3 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move struct hci_pinfo into net/bluetooth/hci_sock.c

There exists no external user of struct hci_pinfo and hci_pi and thus
move it into the one place that is actually using it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
7e67c112a007fafef6dd36c33d1029a65250ca9b 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Delcare the hci_sec_filter as const

The hci_sec_filter socket filter details do not change. They are fixed
and with that they can also be delcared as const.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
3ad254f7f6fd3b66ce47a156cbb92cb02002103e 11-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move struct hci_sec_filter next to its user

There is only single location using struct hci_sec_filter and with
that there is no point in putting this declaration into a global
header file. So move it right next to its user and make the code
a lot more simpler.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
12aa4f0a3d0576c554efc770a6e16c8bb897b966 10-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set HCI_PAIRABLE during power on for legacy ioctl

When the controller is brought up using legacy ioctl, the setting of
the HCI_PAIRABLE flag should happen then. Previously it was set during
enumeration and when retrieving device information.

This change also will not set the HCI_PAIRABLE flag when the controller
is used with the HCI User Channel operation.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2e84d8db91e45964c2b54ccc7da1f9b4bfb1222b 10-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Mark controller is down when HCI_AUTO_OFF is set

During the initial setup phase, the controller is powered on and will
be powered off again if it is not used within the auto-off timeout.

Userspace using ioctl does not know about the difference between the
initial setup phase and a controller being present. It is a bad idea
to keep the controller powered by just looking at the device list or
device information. Instead just tell userspace that the controller
is still down.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
13a779e42251184d0f53a8f8299ced614faa028f 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded mgmt_write_scan_failed function

The Set Connectable/Discoverable mgmt handlers use a hci_request with a
proper callback to handle the HCI command sending. It makes therefore
little sense to have this extra function to be called from hci_event.c
for command failures.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
bc6d2d04182877b198c1a945b7c401decbbb8c02 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded mgmt_discoverable function

Since the HCISETSCAN ioctl is the only non-mgmt user we care about for
setting the right discoverable state we can simply do the necessary
updates in the ioctl handler function instead. This then allows the
removal of the mgmt_discoverable function and should simplify that state
handling considerably.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
123abc0833181aec4796c628d9ffd608b2b41d5c 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor ioctl scan state update to its own function

With subsequent patches we'll also need to update the discoverable
state. As the code grows bigger it's better to move this out from the
switch statement into its own function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
031547d8688a0fc5da875b504bf11e6c2e18390e 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded mgmt_connectable function

The mgmt_connectable function has been used to ensure that the right
actions to HCI_CONNECTABLE are taken when the HCI_Write_Scan_Enable
command is triggered by something else than mgmt. The only other user
that we really care about is the HCISETSCAN ioctl code, so we can
actually more simply perform the needed changes there instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
7fabc0f4c7bd2206c368a79e3ed79b7d36625cfd 10-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix using test_and_clear instead of test_and_set

The code for updating the HCI_CONNECTABLE flag was incorrectly using
test_and_set_bit instead of test_and_clear_bit when HCI_CONNECTABLE is
to be cleared.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
b3c6410b8c75cd48e4242af0173bb55701939b9b 10-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluteooth: Reject SMP bonding if HCI_PAIRABLE is not set

If the remote device tries to initiate bonding with us and we don't have
HCI_PAIRABLE set we should just flat out reject the request. This brings
SMP in line with how the flag is used for BR/EDR SSP.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
e8b1202ce6ab67341660812e7d66db4c3e2a5649 10-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix advertising parameter update when toggling connectable

When we change the connectable state and have advertising enabled we
should update the advertising parameters no matter what. The code was
incorrectly only updating them if advertising was not already active.
This patch fixes the issue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c072d546c20390fea0e5332d00fd1b67366ca013 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix incorrect clearing of SMP_FLAG_INITIATOR

When the SMP context is created all flags default to zero. To determine
that we are the initiators it's therefore best to simply change the flag
value when we know we're sending the first SMP PDU. Clearing the flag
when receiving a Pairing Request is not correct since the request may be
a response to a previous Security Request from us (for which we would
already have correctly set the flag). Same goes for receiving a Security
Request which may be coming after us already starting pairing by sending
a Pairing Request.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
e247605a6247aff887d435d2334ffe0e581dae24 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix forcing SMP just-works with no-bonding

Whether we bond or not should not have any impact on the user
interaction model. This patch removes an incorrect fall-back from
JUST_CFM to JUST_WORKS in case we're not bonding.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
2bcd4003b8fafe200eb31f43d50e305e5dc44058 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Always confirm incoming SMP just-works requests

For incoming requests we want to let the user know that pairing is
happening since otherwise there could be access to MEDIUM security
services without any user interaction at all. Therefore, set the
selected method to JUST_CFM instead of JUST_WORKS and let it be
converted back to JUST_WORKS later if we are the initators.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
6fea7ad1d338dba592d65423427a997f1b7ff485 09-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't send ERTM configuration option when disabled

When ERTM support is disabled, then do not even send ERTM configuration
option even if the remote side supports it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
91a668b0565dddc9f556f9bce65da58264c74623 09-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting HCI_CONNECTABLE from ioctl code

When the white list is in use the code would not update the
HCI_CONNECTABLE flag if it gets changed through the ioctl code (e.g.
hciconfig hci0 pscan). Since the flag is important for properly
accepting incoming connections add code to fix it up if necessary and
emit a New Settings mgmt event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
a55bd29d522729e0cb125474396acdc2a107d4d9 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add white list lookup for incoming connection requests

This patch adds support for looking up entries in the white list when
HCI_CONNECTABLE is not set. The logic is fairly simple: if we're
connectable check the black list, if we're not connectable check the
white list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
6cebb9e73a88a4ffea586a2bf2873c0901f4e912 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable page scan also if there are white list entries

Page scan should be enabled either if the connectable setting is set or
if there are any entries in the BR/EDR white list. This patch implements
such behavior by updating the two places that were making decisions on
whether to enable page scan or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
70c464256310e1c3716099b9d02ece4169272f73 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor connection request handling

The conditions for accepting an incoming connections are already
non-trivial and will become more so once a white list is added. This
patch breaks up the checks for when to reject the request by creating a
helper function for it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
dee58c1ed5e29eb57fa9358a8ff27848b72f3b7d 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix incorrectly setting HCI_CONNECTABLE

Since page scan might be enabled by Add Device we should not implicitly
set connectable whenever something else than Set Connectable changes it.
This patch makes sure that we don't set HCI_CONNECTABLE for these cases
if there are any entries in the white list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
a397407f266f8dcb6ea7b28cbff9d9cbd87b6ca8 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update page scan when necessary for Add/Remove Device

When we're removing the last item in the white list or adding the first
one to it and HCI_CONNECTABLE is not set we need to update the current
page scan. This patch adds a simple helper function for the purpose and
calls it from the respective mgmt command handlers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6659358efe617bb46237e62f7303c76e10568d70 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce a whitelist for BR/EDR devices

This patch extends the Add/Remove device commands by letting user space
pass BR/EDR addresses to them. The resulting entries get stored in a new
hdev->whitelist list. The idea is that we can now selectively accept
connections from devices in the list even though HCI_CONNECTABLE is not
set (the actual implementation of this is coming in a subsequent patch).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
dcc36c16c2f1c9800146c8416ee5a4c3dc974623 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Unify helpers for bdaddr_list manipulations

We already have several lists with struct bdaddr_list entries, and there
will be more in the future. Since the operations for adding, removing,
looking up and clearing entries in these lists are exactly the same it
doesn't make sense to define new functions for every single list. This
patch unifies the functions by passing the list_head to them instead of
a hci_dev pointer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ci_sock.c
2cap_core.c
gmt.c
cd7ca0ec5e046c570497b387332560eb42908cc4 09-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix enabling Authenticated Payload Timeout Expired event

The Authenticated Payload Timeout Expired event is valid for
controllers with BR/EDR Secure Connections support, but also for
LE only controllers supporting LE Ping feature. When either of them
is available enable this event. Previous it was not enabled when
the controller was only supporting LE operation.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
fbd96c151cdcadb0ce83b45747d738498d72aa9d 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing HCI_LE_ADV for LE connections

All LE controllers always implicitly stop advertising when establishing
connections. Therefore, be sure to clear the flag in the event handler
for new LE connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
562064e654d42599ad986812adaded653f3b81df 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix toggling background scan when changing connectable state

If the connectable state change doesn't require any special HCI commands
the set_connectable_update_settings() function is used instead of the
set_connectable_complete() function. We must therefore make sure to call
hci_update_background_scan() there as well. This code path is used also
when we're powered off, but that's fine since hci_update_background_scan()
has the necessary checks for it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
3742abfc4e853f9c926982d8d45be6ff010966ae 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix connectable and discoverable supported settings values

The connectable and discoverable mgmt settings are supported both for LE
and BR/EDR controllers so they do not belong behind a lmp_bredr_capable()
condition. This patch fixes the issue in get_supported_settings().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
23a48093b53999f8539144db1d9567964a84655c 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting STOPPING state for discovery

If any of the HCI commands from the hci_stop_discovery function were
successfully sent we need to set the discovery state to STOPPING. The
Stop Discovery code was already handling this, but the code in
clean_up_hci_state was not. This patch updates the hci_stop_discovery to
return a bool to indicate whether it queued any commands and the
clean_up_hci_state() function respectively to look at the return value
and call hci_discovery_set_state() if necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
34722277045f84d0ee618865d02030a44b1ed257 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix check for re-enabling advertising

There are many different places that can disable LE scanning but we only
want to re-enable advertising in hci_cc_le_set_scan_enable() for a very
specific use case, which is when the active scanning part of Start
Discovery is complete. Because of this, fix the discovery state check to
test for the exact state.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e8bb6b9739e2e80e0e413f56816af3871388cfe8 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix advertising and active scanning co-existence

Many controllers allow simultaneous active scanning and advertising
(e.g. Intel and Broadcom) but some do not (e.g. CSR). It's therefore
safest to implement mutual exclusion of these states in the kernel.

This patch ensures that the two states are never entered simultaneously.
Extra precaution needs to be taken for outgoing connection attempts in
slave role (i.e. through directed advertising) in which case the
operation that came first has precedence and the one that comes after
gets a rejection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
gmt.c
376f54c171674ac1f9a2eefe67d413db4836d25a 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Stop advertising always before initiating a connection

Most controllers do not support advertising while initiating an LE
connection. We also have to first disable current advertising if the
initiation is going to happen through direct advertising. Therefore,
simply stop advertising as the first thing when starting to issue
commands to establish an LE connection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
73e082f80d990c017c695a6750f7ac96cdc6308a 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use the correct flag to decide to disable advertising

When deciding to call disable_advertising() we're interested in the real
state instead of the mgmt setting. Use therefore HCI_LE_ADV instead of
the HCI_ADVERTISING flag.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
0ec5ae8438af02bf2295f08585d8ab49d15eaf2c 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify usage of the enable_advertising function

By adding support for disabling advertising when necessary and doing the
checks for existing LE connections inside the enable_advertising
function we can simplify the calling code quite a lot.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5ce194c4a751ac603966dd1567b62035a7dfbf89 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use real advertising state to random address update decision

Now that we have a flag for tracking the real advertising state we
should use that to determine whether it's safe to update the random
address or not. The couple of places that were clearing the flag due to
a pending request need to be updated too.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
gmt.c
c93bd15033027928709ee15bab2ce1f5582085c6 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary mgmt_advertising function

Since the real advertising state is now tracked with its own flag we can
simply set/unset the HCI_ADVERTISING flag in the
set_advertising_complete function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
66c417c1ee01398ac5ab1c749a20c4d8ba50e9a9 08-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add flag to track the real advertising state

Having a single HCI_ADVERTISING flag is problematic since it tries to
track both the real advertising state and the corresponding mgmt
setting. To make the logic simpler and more reliable add a new flag that
only tracks the actual advertising state that has been written to the
controller.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a70f4b5f14a029c14c3901f429e4d3d7e5477b4f 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't try background scanning if LE is not enabled

For adapters that do not support LE and ones where LE hasn't been
enabled we shouldn't be trying to initiate background scanning. This
patch adds an extra check to the hci_update_background_scan() to ensure
that we bail out if HCI_LE_ENABLED is not set.

Since we do allow user space to feed the kernel with LE connection
parameters even when LE is not enabled we now need to also call
hci_update_background_scan() as soon as LE gets enabled so that scanning
gets started if necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
cdd6275e510bd86c44d3fc85a78306f514bbac9a 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass desired connection role to hci_connect_le()

If we have both LE scanning and advertising simultaneously enabled we
need a way to tell hci_connect_le() in which role to initiate a
connection. This patch adds a new parameter to the function to give it
the necessary information. For auto-connect and mgmt_pair_device we
always use master role, whereas for L2CAP users (in practice sockets) we
use slave role whenever HCI_ADVERTISING is set and master role
otherwise.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
gmt.c
d93375a82da10cb023afc945fa18471bf3c41704 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove auth_type parameter from hci_connect_le()

The auth_type value which gets assigned to hci_conn->auth_type is
something that's only used for BR/EDR connections and is of no value for
LE connections. It makes therefore little sense to pass it to the
hci_connect_le() function. This patch removes the parameter from the
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
gmt.c
2b7be33e60c631b3080099baf14c43505fa8017d 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable passive scanning whenever we're connectable

Enabling passive scanning always when we're connectable aligns us with
the BR/EDR page scanning. This is also consistent with the fact that the
code dealing with passive scanning results will actively try to connect
any direct advertising event when we're connectable.

This patch implements the feature by adding the connectable condition to
hci_update_background_scan() checks for starting scanning and by calling
hci_update_background_scan() whenever the connectable state changes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
ae23ada43d7d644e563a23d4c2cd2aa828be1431 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't let background scanning interfering with discovery

If we have an active discovery going on we shouldn't do any changes to
LE scanning when hci_update_background_scan() is called (a call which
can happen for many different reasons). This patch fixes the issue by
returning from the function if the discovery state is anything else
except DISCOVERY_STOPPED.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
bb3e0a336ae683332c1282d1e84b371b65aba1b4 07-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update discovery state earlier in hci_discovery_set_state

In a subsequent patch the hci_update_background_scan() function will
depend on being able to know the current discovery state. For this to be
possible we need to set the new state early in the function. Since we
also need to check what the old state was this patch introduces an extra
variable for tracking it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
7e899c94939b928173d76d1e5a7c0675f44813f5 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary return value from check_pending_le_conn

Since the only caller of this function doesn't care about the return
value anymore let's just remove it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
841c564499dca9f4819ae2a5f5beb31694f9634e 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant IRK lookup in mgmt_device_found()

Now that we have the process_adv_report() function doing the IRK lookup
and updating the bdaddr we don't need to do this anymore in mgmt.c in
the mgmt_device_found() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
1c1abcabfa229b4b3d688d0a1f677d0ca7a1c624 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix connecting devices during LE device discovery

If we have devices set as to be connected we should connect to them even
during normal discovery if we get a connectable advertising event. If we
also have HCI_CONNECTABLE set we should connect ADV_DIRECT_IND events
even to devices that we don't have in our pend_le_conns list. This patch
implements such behavior by passing the advertising report type to
check_pending_le_conn() and calls that function regardless of what type
of scanning we are doing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
74292d5ac289ff5ec8b565889aaeab332e709099 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enforce providing hdev->send driver callback

The hdev->send driver callback is mandatory to be provided by a driver
before calling hci_register_dev. So enforce it and return EINVAL in
case it is not available.

All existing drivers are providing this callback anyway, so this is
just an extra sanity check.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
cdc52faac5f341beaff036828b9459f7c8dd7296 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix memory leaking when hdev->send returns an error

The drivers are allowed to just return an error from hdev->send callback
and in that case the driver does not own the SKB. Which means that the
caller has to free the SKB.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
223683a54bf3f371683c401b9a759c54e1452fa3 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating background scan for LE connect complete

When we get an LE connection complete event we should restart background
scanning if there are any devices needing it. So far the code was only
making the decision based on whether the completed connection had any
stored parameters or not. This patch ensures that we trigger background
scanning always when necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
cc78b44ba2231d6a92707407cd199b2e05fe3528 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Skip unconfigured init procedure for raw-only devices

When the driver sets HCI_QUIRK_RAW_DEVICE, the controller will be set
as unconfigured. However running the unconfigured init procecure is
not useful since raw-only devices are not allowed to change its
configuration. This change skips the init procedure and just allows
user channel operation for this device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
09ae260ba452c2ed36ec295941a58cb75db213ed 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use lower timeout for LE auto-connections

When we establish connections as a consequence of receiving an
advertising report it makes no sense to wait the normal 20 second LE
connection timeout. This patch modifies the hci_connect_le function to
take an extra timeout value and uses a lower 2 second timeout for the
auto-connection case. This timeout is intentionally chosen to be just a
bit higher than the 1.28 second timeout that High Duty Cycle Advertising
uses.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
gmt.c
5ea234d3e5ff9b6e5c82bde5979307213dde249d 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Clear HCI_RAW flag when controller becomes configured

When an unconfigured controllers reaches the configured state, it is
important to change the HCI_RAW flag. It indicates to userspace that
the controller is fully operational.

External configuration allows to bring the controller back into an
unconfigured state. In that case make sure HCI_RAW flag is set again.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
9713c17b086c1ebfe34ea4d34147a778276e2dab 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for changing the public device address

This adds support for changing the public device address. This feature
is required by controllers that do not provide a public address and
have HCI_QUIRK_INVALID_BDADDR set.

Even if a controller has a public device address, this is useful when
an embedded system wants to use its own value. As long as the driver
provides the set_bdaddr callback, this allows changing the device
address before powering on the controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
d603b76b0c18c5adf4a3164dff50bb15948cd7bd 06-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Run controller setup after external configuration

When the external configuration triggers the switch to a configured
controller, it means the setup needs to be run. Controllers that start
out unconfigured have only run limited set of HCI commands. This is
not enough for complete operation and thus run the setup procedure
before announcing the new controller index.

This introduces HCI_CONFIG flag as companion to HCI_SETUP flag. The
HCI_SETUP flag is only used once for the initial setup procedure. And
during that procedure hdev->setup driver callback is called. With the
new HCI_CONFIG the switch from unconfigured to configured state is
triggering the same setup procedure just without hdev->setup. This
is required since bringing a controller back to unconfigured state
from configured state is possible.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
gmt.c
19de0825cd8acb1de6fa6a135b1f059446781049 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending Device Removed when clearing all parameters

When calling Device Remove with BDADDR_ANY we should in a similar way
emit Device Removed events as we do when removing a single device. Since
we have to iterate the list and call device_removed() the dedicated
hci_conn_params_clear_enabled() is not really useful anymore. This patch
removes the helper function and does the event emission and list item
removal in a single loop.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
9e1d7e15340b14bfb2ac86d77ca72fcebfe67d66 06-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Restrict blocked device check in l2cap_recv_frame to LE

BR/EDR has the connection request and connection request rejection, but
LE doesn't have anything similar. We still request LE connections to
blocked devices to be disconnected but it's possible that ACL data slips
through before that. The check in l2cap_recv_frame really only needs to
be for LE and not BR/EDR because of this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
e30d3f5fef378cd14ba8c331a5c7a2f9239c2770 05-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store Bluetooth address from controller setup

During the setup phase of a controller, the Bluetooth address will be
read and to have that original address available for later use, store
it as setup address.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
0ebca7d6819a24b7518d518f89597cf7c7854094 05-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Run special init procedure for unconfigured controllers

For an unconfigured controller it is required to read at least the
local version information. If the set_bdaddr driver callback is
provideded, then also the local Bluetooth address will be read.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
45296acd91b14d32d7d023a08baaf285a0ea2193 05-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use a more simpler style for HCI event callbacks

The HCI event callbacks have grown over the last years and some
functions handle status checking different than others. For the
simple ones, check the status at the beginning and exit if an
error with the HCI command occured.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
f4537c04d387eda86ed89e0eafe0352f7fa0c9d0 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for New Configuration Options management event

When one or more of the missing configuration options change, then send
this even to all the other management interface clients.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
04c60f05a08aeb5ed412b08da037ed86419344a9 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move mgmt_event helper function to different location

Move the mgmt_event function higher up in the code so that no forward
declaration is needed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
dbece37a3233933ec89f77f04049e13ad9b29634 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Set External Configuration management command

The Set External Configuration management command allows for switching
between configured and unconfigured start if HCI_QURIK_EXTERNAL_CONFIG
is set by the transport driver.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
af202f84415a69b964a9ec371e11781f2a1e5396 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix quirks that are valid during setup driver callback

For the quirks that are allow to be set during setup callback, the
check needs to be modified so that they are applied even if no
setup callback provided by the driver.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
eb1904f49d3e11468997e0667e6ec332a66697c9 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add quirk for external configuration requirement

When a controller requires external configuration, then setting this
quirk will allow indicating this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
42a9bc148960b2c85f9ec5ef1abe3a87e0155c60 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow reading configuration info when unconfigured

Reading the controller configuration information is a valid management
command when the controller is unconfigured. Allow this command, but
return invalid index on all other commands.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
89bc22d23f63c2d437f677d7eae0fa922bedcdcb 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add quirk for invalid controller address setting

When a Bluetooth controller does not have a valid public Bluetooth
address, then allow the driver to indicate this. If the quirk is
set, the Bluetooth core will switch to unconfigured state first
and will allow userspace to configure the address before starting
the full initialization of the controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
d1dbf12e3be0befcd3fd1f978202c5f72d2cc67b 04-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use list_del when freeing the list entry

It's wasteful to use list_del_init (which re-initializes the list_head)
if we're just about to free the element and never use it again.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
99a6768e0e55d19a47934ccd653ff0f9b3236401 04-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't take actions on blocked devices when scanning

If a found device is marked as blocked while doing passive LE scanning,
neither report it nor try to connect to it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a7545f2afcfc49fd5341fe51e943064eefe20ea1 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_pend_le_action_lookup to look up report entries

Instead of looking through the entire list of entries we can more
efficiently use the new hci_pend_le_action_lookup() function to look up
entries specifically in the pend_le_reports list. Since the search is
now limited to the right list we can also remove an unnecessary check
for list_empty() before the lookup.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
501f882741b139da22bb3ba4bc615a6eadce5038 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make hci_pend_le_conn_lookup more general purposed

In some circumstances we need to look up entries in pend_le_conns and in
other in pend_le_reports. This patch converts the existing lookup
function for pend_le_conns to something that can be used for both lists.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
d9b3ad7df101a6490272771f1aabbaa623a196f3 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused hci_pend_le_conn_add function

Since there are no more users of this function we can simply go ahead
and remove it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
418025d1c390b3979f0fd3bb639f0a15026d0530 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary usage of hci_pend_le_conn_add

This is the last place using hci_pend_le_conn_add() and we can more
just as simply manipulate the list directly here.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
d7347f3cc2b63be0ea35b3239faf4b32fde2fb44 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing and restarting all LE actions on power cycle

When powering off (hci_dev_do_close) we should clear both the
pend_le_reports and pend_le_conns types of entries. When powering on
respectively we should populate both lists. This patch converts the
hci_pend_le_conns_clear() function into hci_pend_le_actions_clear()
(which can now be static) and converts the restart_le_auto_conns()
function into restart_le_actions().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
ae44e5d19e870385d1e73ce248c19ea4761bb40c 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused hci_pend_le_conn_del() function

Now that there are no-longer any users of the hci_pend_le_conn_del()
function we can simply go ahead and remove it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
95305baa779223060c7129100424da6c0d01045b 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify hci_conn_params->action list usage

Since params->action is used for both the pend_le_conns and
pend_le_reports lists we can simplify the adding and deleting of the
lists considerably. For example, when deleting entries in most
situations we no-longer need to check the auto_connect value but can
directly proceed with calling list_del_init on param->action (which is
safe even if the entry is not part of any list).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
42ce26de67e13c50885e7856ff91aaeedf07a81b 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't bother doing anything if auto_connect doesn't change

When hci_conn_params_set() is called if the new auto_connect value is
the same as the old one we don't need to take any action. Simply return
success from the function in this case.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
a2f41a8f370a940629a0e42258ab9e941b1dbc83 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify use of hci_pend_le_conns_clear()

Now that pend_le_connections is a list of hci_conn_params entries we can
simply remove items from that list as we iterate through the global list
of le_conn_params. This also moves the responsibility of calling
hci_update_background_scan() to the functions that were previously
calling hci_pend_le_conns_clear(). The only user that's left for
hci_pend_le_conns_clear() is hci_dev_do_close() which anyway does not
need to call hci_update_background_scan().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
66f8455aeac3427110d451534567eb1b9aea6929 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert pend_le_reports into a list

To simplify manipulation and lookup of hci_conn_params entries of the
type HCI_AUTO_CONN_REPORT it makes sense to store them in their own
list. The new action list_head in hci_conn_params is used for this
purpose.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
93450c75448e370659ce7ca9c192298596fb055e 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert pend_le_conn list to a generic action list

In preparation to store also HCI_AUTO_CONN_REPORT entries in a list it
makes sense to convert the existing pend_le_conn list head of
hci_conn_params into a more generically named "action". This makes sense
because a parameter entry will never participate in more than one action
list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
97bf2e99934bdfd3f91914e6c935271b62567470 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing return statement in process_adv_report

If we're doing passive scanning we shouldn't proceed with any of the
code that deals with active scanning (pending reports, etc.). This patch
fixes a missing return statement for the passive scanning section in the
process_adv_report() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
9fc3bfb681bdf59999f56072fff4632a5abea897 04-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for controller configuration info command

The Read Controller Configuration Information command allows retrieving
details about possible configurations option. The supported options are
returned and also the missing options (if any).

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
738f61859d08771e12b552d043b48c8fc13708d1 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add identity address check in param lookup functions

Since we only store entries with identity addresses in the
le_conn_params and pend_le_conns lists we can avoid unnecessary lookups
by checking for an identity address before diving into the lists
themselves.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
bb5ce4d018f896403d7a394ec56a550e7890b563 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary checks for auto-connected devices

If a device is in the pend_le_conns list it cannot at the same time also
have the need to be notified through mgmt_device_found. By making
check_pending_le_conn return whether it found an entry or not we can
avoid unnecessary checks in process_adv_report().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
912b42ef05a1e9f72a82c21d678a29c5055045d5 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_conn_params in pend_le_conns

Since the connection parameters are always a basis for adding entries to
hdev->pend_le_conns (so far of type bdaddr_list) it's simpler and more
efficient to have the parameters themselves be the entries in the
pend_le_conns list. We do this by adding another list_head to the
hci_conn_params struct.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
435a13d839abe8c8b9ebe1be635d1ab8f7352f56 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant IRK lookup

When processing passive scanning results we need the resolved identity
address both in check_pending_le_conn() as well as later in
process_adv_report(). Since process_adv_report() calls
check_pending_le_conn() we can simply resolve the IRK earlier in the
function and thereby eliminate a second lookup.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
617ca1bf11de84c23d1c83724fa89cfdc83b023a 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing update of pend_le_reports

When calling Remove Device for an entry using HCI_AUTO_CONN_REPORT we
need to decrement the pend_le_reports value correspondingly. This patch
fixes one such missing action in the Remove Device command handler.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ba1d6936f6f83927f17a28ecc9cbb989fa0a7e34 03-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix buffer overflow with variable length commands

The handler for variable length commands were trying to calculate the
expected length of the command based on the given parameter count, and
then comparing that with the received data. However, the expected count
was stored in a u16 which can easily overflow. With a carefully crafted
command this can then be made to match the given data even though the
parameter count is actually way too big, resulting in a buffer overflow
when parsing the parameters.

This patch fixes the issue by calculating a per-command maximum
parameter count and returns INVALID_PARAMS if it is exceeded.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
079446c8a254d65da0378a45c2106dbf1ff6a769 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Support scanning for devices using RPA

When we're scanning for specific devices that use an RPA we need to
convert the RPA to the identity address before looking up the entry in
the connection parameters. This patch adds the necessary code to do this
in the process_adv_report() function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0d2bf13462732d3b2e11d8efb0545c1ed272298b 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for background LE scanning

If we have one or more devices with HCI_AUTO_CONN_REPORT we should do
background scanning and emit mgmt_device_found events. This patch
modifies the hci_update_background_scan() function to extend the
conditions needed to trigger scanning, and adds the necessary code to
process_adv_report() to emit mgmt_device_found events.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
75ce208cc44938195f57c55f81c8e4447dd492fb 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Allow mgmt_device_found events for kernel-side scanning

When the kernel is doing LE scanning because of one or more devices
added with action 0x00 through the Add Device command we do want to let
mgmt_device_found() to proceed with sending an event. This kind of
devices are tracked with hdev->pend_le_reports, so check this value
before bailing out from the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
851efca8387e10a25ca259f7efcc47819b19bff9 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track number of added devices with HCI_AUTO_CONN_REPORT

To be able to make the right choice of whether to start passive scanning
or to send out a mgmt_device_found event we need to know if there are
any devices in the le_conn_params list with the auto_connect value set
to HCI_AUTO_CONN_REPORT. This patch adds a counter for this kind of
devices.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
73d1df2a7a1036a1f000e5f0ece6ade3e082b854 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Read Unconfigured Index List command

This command allows to get the list of currently known controller that
are in unconfigured state.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
edd3896bc41059fc064c4ec76da004a57203d88e 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Unconfigured Index Removed events

When a controller in an unconfigured state gets removed, then send
Unconfigured Index Removed events.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
0602a8adc3ce3f592d03df426c92d1f36229403c 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Unconfigured Index Added events

When a controller is in unconfigured state it is currently hidden
from the management interface. This change now announces the new
controller with an Unconfigured Index Added event and allows clients
to easily detect the controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
gmt.c
4a964404c08fed64d1afd8b0af1e7f2b8f7ae90e 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce unconfigured controller state

With the new unconfigured controller state it is possible to provide a
fully functional HCI transport, but disable the higher level operations
that would normally happen. This way userspace can try to configure the
controller before releases the unconfigured state.

The internal state is represented by HCI_UNCONFIGURED. This replaces the
HCI_QUIRK_RAW_DEVICE quirk as internal state representation. This is now
a real state and drivers can use the quirk to actually trigger this
state. In the future this will allow a more fine grained switching from
unconfigured state to configured state for controller inititialization.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
gmt.c
c103aea6f709c68916160eca4ed20224934e62d7 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't send connection parameters without identity address

If we don't have an identity address for connection parameters it
doesn't really make sense to send them to user space. Instead just
ignore them for now. Later we can add support for sending them when we
eventually get the identity through pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c46245b3efce80884acf65c01443582aec1f31ed 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make is_identity_address a global function

There are more places that can take advantage of is_identity_address()
besides hci_core.c. This patch moves the function to hci_core.h and
gives it the appropriate hci_ prefix.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
f4869e2adb7ab9d09a9335b4e26a63ec413f2c6f 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass store hint to mgmt_new_conn_param

The calling functions of mgmt_new_conn_param have more information about
the parameters, such as whether the kernel is tracking them or not. It
makes therefore sense to have them pass an initial store_hint value to
the mgmt_new_conn_param function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
2cap_core.c
gmt.c
7d6ca6939cb2f701204317cbab15af1b98f7f501 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make hci_le_conn_update return the store hint

The caller of hci_le_conn_update is directly interested in knowing what
the best value is for the store_hint parameter of the corresponding
mgmt event. Since hci_le_conn_update knows whether there were stored
parameters that were updated or not we can have it return an initial
store_hint value to the caller.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
348d50b8e96c2c4630801e6e720c7c722ade83e8 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing update of conn params

We should update any stored connection parameters when we receive the LE
Remote Connection Parameter Request HCI event. This patch adds the
necessary code to the function that handles the event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a26f3dcff2cf5890f33d883c98d90cdfa51ed460 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add Load Connection Parameters command

This patch implements the new Load Connection Parameters mgmt command
that's intended to load the desired connection parameters for LE
devices.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c71593dd34ae1fd46777662a522a32cfde86f073 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove only enabled entries with Remove Device command

The Remove Device mgmt command is supposed to undo what the Add Device
command does. An entry added by Add Device cannot have the
HCI_AUTO_CONN_DISABLED auto_connect value, so we should treat this as an
invalid entry to remove. This patch adds the necessary pieces to the
Remove Device command handler so that it only removes entries which were
added by Add Device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
a3451d279f839d987cbcf25b0f3be666aef99d0b 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add new auto_conn value matching mgmt action 0x00

The 0x00 action value of mgmt means "scan and report" but do not
connect. This is different from HCI_AUTO_CONN_DISABLED so we need a new
value for it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
55af49a8fe85278ea244e72d2d264cf5e0941c61 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add specific connection parameter clear functions

In some circumstances we'll need to either clear only the enabled
parameters or only the disabled ones. This patch adds convenience
functions for this purpose.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
373110c5d30b0944b47cddbe586069b7457f8845 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename hci_conn_params_clear to hci_conn_params_clear_all

We'll soon have specific clear functions for clearing enabled or
disabled entries, so rename the function that removes everything to
clear_all().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
96c2103a57c5c6498138f38df926af6b86ea4e86 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Default to internal use manufacturer identifier

When allocating a new controller structure, then default to the internal
use value 0xffff first. Default to 0x0000 is a bad idea since that is
the manufacturer identifier of Ericsson Technology Licensing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
837d502efc3fe9a088b943aa1a7279cee4d0e118 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Drop LE connections for blocked devices

Unlike BR/EDR we cannot reject LE connections of blocked devices but
have to do it as soon as we get a LE Connection Complete event. The
patch adds a blacklist check to the hci_le_conn_complete_evt function
and drops all connections for blocked devices.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e493150e363917bf7e86e8fa4316e915fc2cf40b 02-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Centralize looking up blocked devices to l2cap_recv_frame

The ATT channel isn't the only one that we should ensure doesn't receive
data from blocked devices. SMP is another, and in general we don't want
data packets going to any of the various handlers. Therefore, add a
single check to the l2cap_recv_frame function.

The patch fixes at the same time the use of a correct address type. The
blacklist stores the values with the user space facing triple type
wheras hci_conn->dst_type uses the HCI address type (0x00 or 0x01).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
24c457e27076beb2a85b4213642a6388eb88f240 02-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for hdev->set_bdaddr callback handling

Some embedded controllers allow the programming of a public address
and this adds vendor support for supporting OEM confguration of such
addresses.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ffb5a827d5ca5aef3f3fe5d64e42f3cf7fed4fc8 01-Jul-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce "New Connection Parameter" Event

This patch introduces a new Mgmt event called "New Connection Parameter".
This event indicates to userspace the connection parameters values the
remote device requested.

The user may store these values and load them into kernel. This way, next
time a connection is established to that device, the kernel will use those
parameters values instead of the default ones.

This event is sent when the remote device requests new connection
parameters through connection parameter update procedure. This event is
not sent for slave connections.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
2cap_core.c
gmt.c
662bc2e63de765bb701e3d3eca6af9fe553d72ac 01-Jul-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Enable new LE meta event

The Bluetooth 4.1 introduces a new LE meta event called "LE Remote
Connection Parameter Request" event. In order to the controller
sends this event to host, we should enable it during controller
initialization.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
9193c6e884ae1b403f53ca1370a4b7f8185c547b 01-Jul-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Move LE event mask setting into init3 phase

During init2 phase, the LE local features have not be read yet so
we aren't able to rely on hdev->le_features to determine if the
controller supports the Connection Parameters Request Procedure.

For that reason, this patch moves LE event mask setting from init2
into init3 initialization phase.

The hdev->le_features mask will be checked by the next patch in order
to know if "LE Remote Connection Parameter Request Event" should be
enabled.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
8e75b46a4f5d2c71b2f3ea632df1b15502514948 01-Jul-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Connection Parameter Update Procedure

This patch adds support for LE Connection Parameters Request Link
Layer control procedure introduced in Core spec 4.1. This procedure
allows a Peripheral or Central to update the Link Layer connection
parameters of an established connection.

Regarding the acceptance of connection parameters, the LL procedure
follows the same approach of L2CAP procedure (see l2cap_conn_param_
update_req function). We accept any connection parameters values as
long as they are within the valid range.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
2a8357f2393d89a34b5a77051d29951af9646406 01-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix redundant device (un)blocked events

For the Block/Unblock Device mgmt commands we should only emit the
Blocked/Unblocked events on any socket except for the one which received
the command. The code was previously incorrectly trying to look up a
non-existent pending command and thereby ending up not skipping the
command socket for the event.

We can simplify the code a lot by simply sending the event directly from
the command handler functions. We have the reference to the command
socket available there which makes it easy to pass to the mgmt_event
function for skipping.

The only notable side-effect of this is that the old blacklisting
ioctl's no-longer cause mgmt events to be emitted, however as user space
versions using these ioctl's are not mgmt-aware this is acceptable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
c83ed19d23909db10a4402d4c6c0164bab9a9cf0 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Ensure that background scanning gets enabled on power on

The background scanning normally gets enabled during power on by
adding devices to the pending connection list. However devices
might be already on that list and the list of devices is empty,
then it is better to trigger the background manually.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
b8221770c984bcd185c93cb3a31acab27b67c94a 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Do not trigger background scanning when HCI_AUTO_OFF is set

When a new controller is initialized, but not powered from userspace
at the moment, the HCI_AUTO_OFF flag is still set. During this period,
userspace might program device for auto-connection, but never power
on the controller. In this case do not try to start background
scanning and leave it for later to be started.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
9ab65d60c212c23f1605f35aea229f4c94df2334 01-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Allow re-encryption with LTK when STK is in use

If we're encrypted with the STK we should allow re-encryption with an
LTK even though the achieved security level is the same. This patch adds
the necessary logic to the smp_sufficient_security function which is
used to determine whether to proceed with encryption or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
fe59a05f941dbeb14316449be42d059761bed62c 01-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add flag to track STK encryption

There are certain subtle differences in behavior when we're encrypted
with the STK, such as allowing re-encryption even though the security
level stays the same. Because of this, add a flag to track whether we're
encrypted with an STK or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
mp.c
854f47278fb36f4904649b994acf559e13920232 01-Jul-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix redundant encryption when receiving Security Request

If we're already encrypted with a good enough LTK we should just ignore
an incoming SMP Security Request. The code was already taking care of
this in the smp_conn_security function before calling smp_ltk_encrypt
but failed to do the same in smp_cmd_security_req. This patch fixes the
issue by moving up the smp_sufficient_security function and using it in
the Security Request handler before trying to request encryption.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
c70a7e4cc8d22cb1ce684637ef8a4bb3a80d15b7 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Not Connectable flag for Device Found events

The Device Found events of the management interface should indicate if
it is possible to connect to a remote device or if it is broadcaster
only advertising. To allow this differentation the Not Connectable flag
is introduced that will be set when it is known that a device can not
be connected.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
af58925ca6175695e502fa792f43a946f7474765 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide flags parameter direct to mgmt_device_found

Providing the flags parameter directly to mgmt_device_found function
makes the core simpler and more readable. With this it becomes a lot
easier to add new flags in the future.

This also changes hci_inquiry_cache_update to just return that flags
needed for mgmt_device_found since that is its only use for the two
return parameters anyway.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
gmt.c
42bd6a56ed1ab4b2cb50f4d4e674874da9b47f46 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix merge of advertising data and scan response data

The advertising data and scan response data are merged in the wrong
order. It should be advertsing data first and then scan response data
and not the other way around.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org # 3.16
ci_event.c
d06b50ce14119acb04773a9808ccff5d1767b7e4 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove connection interval parameters from hci_conn_params_set

The connection interval parameter of hci_conn_params_set are always used
with the controller defaults. So just let hci_conn_params_add set the
controller default and not bother resetting them to controller defaults
every time the hci_conn_params_set is called.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
8c87aae1fa2ffa89e5e840b8e928fa0eb5c13157 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hci_conn_params_add within hci_conn_params_set

The hci_conn_params_add function provides the default allocation of
connection parameters. To avoid code duplication, use that code from
hci_conn_params_set to allocate or lookup parameter struct.

As a benefit the connection latency and supervision timeout parameters
are no longer reset to default when calling hci_conn_params_set.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
51d167c0972ef1496f2e6ab08aab602644d1f9bb 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Change hci_conn_params_add to return the parameter struct

When adding new connection parameters, it is useful to return either
the existing struct or the newly created one.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
f81cd823a844c60349c40b53a1b84b5968113596 01-Jul-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use bool for smp_ltk_encrypt return value

The return value of smp_ltk_encrypt is simple boolean, so just use
bool and make the code a bit more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
81218d2099e85542a57e266336db5e0585c9f2cc 30-Jun-2014 Nick Pelly <npelly@google.com> Bluetooth: Fallback to SCO on error code 0x10 (Connection Accept Timeout)

This is to support the Motorola HF850 carkit which reports the error
code 0x10 for an eSCO attempt, even though it advertises eSCO support.

With this patch we will retry with a SCO connection, which succeeds.

Signed-off-by: Nick Pelly <npelly@google.com>
Signed-off-by: Kiran Kumar Raparthy <kiran.kumar@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
bf19d51b768ceeccab12f932cac73b60b1d20bab 30-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Allow L2CAP getpeername() for BT_CONFIG state

We have all the necessary remote information for getpeername() when we
are in the BT_CONFIG state so this should be allowed. This is
particularly important for LE sockets where changing the security level
will temporarily move the socket into BT_CONFIG state.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
26b0f4e2f9d022193039a72db09c048b9ae93459 30-Jun-2014 Fabian Frederick <fabf@skynet.be> Bluetooth: constify seq_operations

bt_seq_ops is only used with __seq_open_private as
const struct seq_operations *

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
d4905f2453bd228d8ffc57f4e25bba0a8f52c805 26-Jun-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Connection parameters check helper

This patch renames l2cap_check_conn_param() to hci_check_conn_params()
and moves it to hci_core.h so it can reused in others files. This helper
will be reused in the next patch.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
c20c02d5c8d76f39be461c25bf5de3a1dc96885e 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Start background scanning only when controller is ready

When the controller is not active or in init/setup phase, do not
try to start or stop background scanning.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7c264b10006f3c10f7a9ef314a213f9784d9ca1f 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add default connection parameters before pairing

When trying to pair a new Bluetooth Low Energy device, then make sure
that the default connections parameters are in place before trying to
establish the first connection to that device. With the connection
parameters structure allocated, the slave preferred values can now
easily be tracked and all future connections will use the correct
values from that start decreasing connection establishment time.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
bf5b3c8be07905c242bb7f751dcb890b94c22d93 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide function to create and set connection parameters

In some cases it is useful to not overwrite connection parametes and
instead just create default ones if they don't exist. This function
does exactly that. hci_conn_params_add will allow to create new
default connection parameters. hci_conn_params_set will set the
values and also create new parameters if they don't exist.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
f1649577a6c20410335dbb4765e74e51fd5df585 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose default supervision timeout setting via debugfs

The controller has a default value for the supervision timeout. Expose
this via debugfs for testing purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
816a93d10a2809f09ce81e9fef638380d68d2c6d 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose default connection latency setting via debugfs

The controller has a default value for the connection latency. Expose
this via debugfs for testing purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
04fb7d9066dd9173ef0d4ccea8fe3bb59bd94605 30-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide defaults for LE connection latency and timeout

Store the connection latency and supervision timeout default values
with all the other controller defaults. And when needed use them
for new connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
8afef092a192cb946393bb11cc95b59739c1e57b 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add Device Added and Device Removed management events

When devices are added or removed, then make sure that events are send
out to all other clients so that the list of devices can be easily
tracked. This is especially important when external clients are
adding or removing devices within the auto-connection list.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
0b3c7d372b6a74531f1927a3962e41029e26d2d8 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Replace le_auto_conn debugfs with device_list entry

Since the auto-connection handling has gained offical management
command support, remove the le_auto_conn debugfs entry.

For debugging purposes replace it a simple device_list debugfs
entry that allows listing of the current internal auto-connection
list used for passive scanning.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2faade53e65f276cf1c30a885fb64808a083714e 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for Add/Remove Device management commands

This allows adding or removing devices from the background scanning
list the kernel maintains. Device flagged for auto-connection will
be automatically connected if they are found.

The passive scanning required for auto-connection will be started
and stopped on demand.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
037fc415bce5ac7604ac52216ec03d011f81e5b0 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use LE connection parameters if known

When the LE connection parameters for connection latency and
supervision timeout are known, then use then. If they are not
know fallback to defaults.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
f044eb0524a02ea7f921c9234fbdba43290da1e2 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store latency and supervision timeout in connection params

When the slave updates the connection parameters, store also the
connection latency and supervision timeout information in the
internal list of connection parameters for known devices.

Having these values available allowes the auto-connection
procedure to use the correct values from the beginning without
having to request an update on every connection establishment.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
1c1697c0cad41fa468e3cb6061ce74debb4f3733 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update background scanning from hci_conn_params_clear

When calling hci_conn_params_clear function, it should update the
background scanning properly and not require a separate call to
update it.

For the case when the function is used during unregister of a
controller, an extra safe guard is but in place.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
1089b67d8eb7fcdfae837a91aae9af94e329361c 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Clear pending connections from hci_conn_params_clear

When hci_conn_params_clear is called, it is always followed by a
call to hci_pend_le_conns_clear. So instead of making this explicit
just make sure it is always called. This makes this function similar
on how hci_conn_params_add and hci_conn_params_del work.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4b10966f0f204d80f087f955344cbf6074a5cf86 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move hci_pend_le_conn_* functions to different location

The hci_pend_le_conn_* function should be placed before their actual
users. So move them before hci_conn_params_* functions.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
6ab535a777d76a2b1e5ad03119cd0c1e5a366b06 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't use non-resolvable private address for passive scanning

The usage of non-resovlable private addresses for passive scanning is
a bad idea. Passive scanning will not send any SCAN_REQ and thus using
your identity address for passive scanning is not a privacy issue.

It is important to use the identity address during passive scanning
since that is the only way devices using direct advertising will be
reported correctly by the controller. This is overlooked detail in
the Bluetooth specification that current controllers are not able
to report direct advertising events for other than their current
address.

When remote peers are using direct advertising and scanning is done
with non-resolvable private address these devices will not be found.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
fee746b0babf128a50ece050ee6e63003ebb5ae1 29-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict access for raw-only controllers

Bluetooth controllers that are marked for raw-only usage can only be
used with user channel access. Any other operation should be rejected.

This simplifies the whole raw-only support since it now depends on
the fact that the controller is marked with HCI_QUIRK_RAW_DEVICE and
runtime raw access is restricted to user channel operation.

The kernel internal processing of HCI commands and events is designed
around the case that either the kernel has full control over the device
or that the device is driven from userspace. This now makes a clear
distinction between these two possible operation modes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
ci_sock.c
gmt.c
958684263d3efbc721fb2b86f94876893eb638d2 28-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for Get Clock Info mgmt command

This patch implements support for the Get Clock Information mgmt
command. This is done by performing one or two HCI_Read_Clock commands
and creating the response from the stored values in the hci_dev and
hci_conn structs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
33f35721030185a2c5a1bb8afd4c3744709745b5 28-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add tracking of local and piconet clock values

This patch adds support for storing the local and piconet clock values
from the HCI_Read_Clock command response to the hci_dev and hci_conn
structs. This will be later used in another patch to implement support
for the Get Clock Info mgmt command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
fca20018e7b86a8716511c7681115baa47aca8e4 28-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use kzalloc instead of kmalloc for pending mgmt commands

By using kzalloc we ensure that there are no struct members, such as the
user_data pointer, left uninitialized.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
730f091b056524df2cb1c5f345f2d24e44236c19 28-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increment management interface revision

This patch increments the management interface revision due to the
changes with the debug key command and other fixes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
df935429be40b02568d4bcf9ebfacf8011b85a85 27-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Send HCI_Read_Clock_Offset before disconnecting

When the connection is in master role and it is going to be
disconnected based on the disconnection timeout, then send
the HCI_Read_Clock_Offset command in an attempt to update the
clock offset value in the inquiry cache.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
40051e4686d6fa8743a38933727604f75bef05cf 27-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded hci_conn_disconnect abstraction

The abstraction of disconnect operation via hci_conn_disconnect is not
needed and it does not add any readability. Handle the difference of
AMP physical channels and BR/EDR/LE connection in the timeout callback.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
a2b1976b8e0184635a1119f8511fc3e68902e429 27-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove reason parameter from hci_amp_disconn function

The hci_amp_disconn function is a local function and there is no
need for a reason parameter. That one can be retrieved from the
hci_conn object easily.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
b10e8017bd9d02a3c7975c06d8fa2fc39df1731c 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary hcon->smp_conn variable

The smp_conn member of struct hci_conn was simply a pointer to the
l2cap_conn object. Since we already have hcon->l2cap_data that points to
the same thing there's no need to have this second variable. This patch
removes it and changes the single place that was using it to use
hcon->l2cap_data instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
642ac7745a45904d2a7c2463a3a3e60dc097be04 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing check for SMP session in smp_user_confirm_reply

The smp_user_confirm_reply() function is called whenever user space
sends a user confirmation reply mgmt command. In case of a misbehaving
user space, or if the SMP session was removed by the time the command
comes it is important that we return an appropriate error and do not try
to access the non-existent SMP context. This patch adds the appropriate
check for the HCI_CONN_LE_SMP_PEND flag before proceeding further.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
a9999348e70ebaf5ceaad8f23611d40a6db1e3bc 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary hci_dev_unlock for smp_user_confirm_reply

Now that the SMP context has it's own crypto handle it doesn't need to
lock the hci_dev anymore for most operations. This means that it is safe
to call smp_user_confirm_reply with the lock already held.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ec70f36f8b17dd21c0d64af4481aa3c898c1cec7 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update SMP crypto functions to take the SMP context

Passing the full SMP context instead of just the crypto context lets us
use the crypto handle from the context which in turn removes the need to
lock the hci_dev. Passing the SMP context instead of just the crypto
handle allows a bit more detailed logging which is helpful in
multi-adapter scenarios.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
6a7bd103c8a4286ef6f7134bfe6f104f32f2c4d4 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add dedicated AES instance for each SMP context

Many places have to be extra careful to not hold the hdev lock when
calling into the SMP code. This is because the SMP crypto functions use
the crypto handle that's part of the hci_dev struct. Giving the SMP
context its own handle helps simplifying the locking logic and removes
the risk for deadlocks.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
31dd624e1cf937655a06fa4eeec06f4bafa34ab7 27-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing hdev locking in smp_cmd_ident_addr_info

The hdev lock must be held before calling into smp_distribute_keys. Also
things such as hci_add_irk() require the lock. This patch fixes the
issue by adding the necessary locking into the smp_cmd_ident_addr_info
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
4dae27983eaaee15c6867561eb2c8d7b2d28d6cc 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert hci_conn->link_mode into flags

Since the link_mode member of the hci_conn struct is a bit field and we
already have a flags member as well it makes sense to merge these two
together. This patch moves all used link_mode bits into corresponding
flags. To keep backwards compatibility with user space we still need to
provide a get_link_mode() helper function for the ioctl's that expect a
link_mode style value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
mp.c
985d904902681d736924afe3f4dae212c0e5f6a4 24-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove ssp_debug_mode debugfs option

The ssp_debug_mode debugfs option for developers is no longer
needed. Support for using Secure Simple Pairing (SSP) debug
mode is exposed by the management interface now.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
b97109790c1fcbe6b5da21c441ba336cf1ab9a3c 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for mode 0x02 for mgmt_set_debug_keys

This patch adds a new valid mode 0x02 for the mgmt_set_debug_keys
command. The 0x02 mode sets the HCI_USE_DEBUG_KEYS flag which makes us
always use debug keys for pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
3769972badcd542913c460ca2834312cdff9f16c 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a new HCI_USE_DEBUG_KEYS flag

To pave the way for actively using debug keys for pairing this patch
adds a new HCI_USE_DEBUG_KEYS flag for the purpose. When the flag is set
we issue a HCI_Write_SSP_Debug mode whenever HCI_Write_SSP_Mode(0x01)
has been issued as well as before issuing a HCI_Write_SSP_Mode(0x00)
command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
58e9293c4e18b9b5f52822e7cbce589c70920721 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix ignoring debug keys in mgmt_load_link_keys

We should never allow user space to feed back debug keys to the kernel.
If the user desires to use debug keys require setting the appropriate
debug keys mode and performing a new pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
af6a9c321384400efab1726636e8189737bbbd09 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert hcon->flush_key to a proper flag

There's no point in having boolean variables in the hci_conn struct
since it already has a flags member. This patch converts the flush_key
member into a proper flag.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
6d5650c4e519794fcc441635ea54f47d68140c93 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't store debug keys if flag for them is not set

Instead of waiting for a disconnection to occur to remove a debug key
simply never store it in the list to begin with. This means we can also
remove the debug keys check when looking up keys in
hci_link_key_request_evt().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0663b297f1953e5d84928722e44f71272f5ff058 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename HCI_DEBUG_KEYS to HCI_KEEP_DEBUG_KEYS

We're planning to add a flag to actively use debug keys in addition to
simply just accepting them, which makes the current generically named
DEBUG_KEYS flag a bit confusing. Since the flag in practice affects
whether the kernel keeps debug keys around or not rename it to
HCI_KEEP_DEBUG_KEYS.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
7652ff6aeaf0eeaec1f2e7e2f3ce0e588447dbd1 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move mgmt event sending out from hci_add_link_key()

There are two callers of hci_add_link_key(). The first one is the HCI
Link Key Notification event and the second one the mgmt code that
receives a list of link keys from user space. Previously we've had the
hci_add_link_key() function being responsible for also emitting a mgmt
signal but for the latter use case this should not happen. Because of
this a rather awkward new_key paramter has been passed to the function.

This patch moves the mgmt event sending out from the hci_add_link_key()
function, thereby making the code a bit more understandable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
567fa2aa3dfad9848c25a226927a4ca5f94229ac 24-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update hci_add_link_key() to return pointer to key

By returning the added (or updated) key we pave the way for further
refactoring (in subsequent patches) that allows moving the mgmt event
sending out from this function (and thereby removal of the awkward
new_key parameter).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
80afeb6cec3739d3167e1fef6214224f0f588f13 23-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support LE slave connection update procedure

When the current LE connection parameters of a slave connection do not
match up with the controller defined values, then trigger the connection
update procedure to allow adjusting them.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
a720d7351e2571bf7498681970b076e366a7d221 23-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set default min/max connection interval for LE slaves

For all incoming LE connections, the minimum and maximum connection
interval is a value that should be copied from the controller default
values. This allows to properly check if the resulting connection
interval of a newly established connection is in the range we are
expecting.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
1855d92dce0dc0ed81a78eacae710529600513f4 23-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track LE connection parameter update event

When the LE controller changes its connection parameters, it will send
a connection parameter update event. Make sure that the new set of
parameters are stored in hci_conn struct and thus will properly update
the previous values retrieved from the connection complete event.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
e04fde60efabe27afdbe041e3e5a09ec752ec9d2 23-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store current LE connection parameters in hci_conn struct

The LE connection parameters are needed later on to be able to decide
if it is required to trigger connection update procedures. So when the
connection has been established successfully, store the current used
parameters in hci_conn struct.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
7f118253820fc3ad38659485adb3ebdfe64820e1 18-Jun-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6LoWPAN: Remove network devices when unloading

When the module is unloaded, unregister the network device
so that the system does not try to access non-existing device.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
18d93c176641cf7a3c0c452a6f03f46b5373d370 18-Jun-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6LoWPAN: Count module usage

Count how many 6LoWPAN connections there exists so that we
do not unload the module if there are still connections alive.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
5547e48c09d51ad21948c8090a34339939651450 18-Jun-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6LoWPAN: Create a kernel module

Instead of adding the 6LoWPAN functionality to Bluetooth module,
we create a separate kernel module for it.

Usage:

In the slave side do this:

$ modprobe bluetooth_6lowpan
$ echo 62 > /sys/kernel/debug/bluetooth/6lowpan_psm
$ hciconfig hci0 leadv

In the master side do this:

$ modprobe bluetooth_6lowpan
$ echo 62 > /sys/kernel/debug/bluetooth/6lowpan_psm
$ echo 'connect E0:06:E6:B7:2A:73 1' > \
/sys/kernel/debug/bluetooth/6lowpan_control

The 6LoWPAN functionality can be controlled by psm value. If it
is left to 0, then the module is disabled and all the 6LoWPAN
connections are dropped if there were any. In the above example,
the psm value is just an example and not a real value for
6LoWPAN service. The real psm value is yet to be defined in
Bluetooth specification.

The 6lowpan controlling interface is a temporary solution
until the specifications are ready.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
config
akefile
6b8d4a6a03144c5996f98db7f8256267b0d72a3a 18-Jun-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one

Create a CoC dynamically instead of one fixed channel for communication
to peer devices.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
lowpan.h
ci_core.c
ci_event.c
2cap_core.c
0498878b18993891f7b71c75b6adcb7c157501db 18-Jun-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: Provide L2CAP ops callback for memcpy_fromiovec

The highly optimized TX path for L2CAP channels and its fragmentation
within the HCI ACL packets requires to copy data from user provided
IO vectors and also kernel provided memory buffers.

This patch allows channel clients to provide a memcpy_fromiovec callback
to keep this optimized behavior, but adapt it to kernel vs user memory
for the TX path. For all kernel internal L2CAP channels, a default
implementation is provided that can be referenced.

In case of A2MP, this fixes a long-standing issue with wrongly accessing
kernel memory as user memory.

This patch originally by Marcel Holtmann.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
2cap_core.c
2cap_sock.c
111902f7236ff8139c30c2b9709c999fcb931399 21-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use separate dbg_flags to special debugfs options

All the special settings configured via debugfs are either developer
only options or temporary solutions. To not clutter the standard flags,
move them to their own dbg_flags entry.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
d97c9fb0c82afc6042004ed3f381d85ff31fadcc 18-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for master LTKs

When the rename of STK_SLAVE to simply STK happened we missed this place
in the ltk_type_master function. Now, checking for master is as simple
as checking whether the type is SMP_LTK. The helper function is kept
around for better readability in the (right now three) callers and for
simpler extension with new key types in the future.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
4ec86d4c86fe563482f183243f15bcd5fd3e65c5 17-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix validating IO capability values in mgmt commands

The valid range of IO capabilities for the Set IO Capability and Pair
Device mgmt commands is 0-4 (4 being the KeyboarDisplay capability for
SMP). We should return an invalid parameters error if user space gives
us a value outside of this range.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8a2936f44ad53ce4e734a0a0cc5bedc57711e87c 16-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add flexible buffer byte order swapping function

Since the SMP code needs to swap ordering of variable length buffers add
a convenience function that can be used for any length buffer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
533e35d40130c040e38ffa3ee0401c8c84da618d 16-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert SMP flags into an enum

There's no reason to have explicit values for these flags. Convert them
to an enum to be consistent with other similar flags.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
2ceba53936d6f2071659b87748d723021937d035 16-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove HCI prefix from SMP LTK defines

The LTK type has really nothing to do with HCI so it makes more sense to
have these in smp.h than hci.h. This patch moves the defines to smp.h
and removes the HCI_ prefix in the same go.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
mp.c
mp.h
7d5843b7b77cee26bd5e090bfa61780d75957648 16-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary SMP STK define

We never store the "master" type of STKs since we request encryption
directly with them so we only need one STK type (the one that's
looked-up on the slave side). Simply remove the unnecessary define and
rename the _SLAVE one to the shorter form.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
mp.c
c29d2444170a4e0709331e357a2738a02666a633 16-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing NULL check for smp_chan_create() return value

The smp_chan_create function may return NULL, e.g. in the case of memory
allocation failure, so we always need to check for this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
65cc2b49db63adf1455a9783234383fbec5b8314 16-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use struct delayed_work for HCI command timeout

Since the whole HCI command, event and data packet processing has been
migrated to use workqueues instead of tasklets, it makes sense to use
struct delayed_work instead of struct timer_list for the timeout
handling. This patch converts the hdev->cmd_timer to use workqueue
as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
d9fbd02be5c201c1659ee0d79c0820bb68d95c8c 08-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use explicit header and body length for L2CAP SKB allocation

When allocating the L2CAP SKB for transmission, provide the upper layers
with a clear distinction on what is the header and what is the body
portion of the SKB.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2cap_core.c
2cap_sock.c
8d46321c4f63f7c2be9e3ba0bb26cb437fc5eded 05-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Assign L2CAP socket priority when allocating SKB

The SKB for L2CAP sockets are all allocated in a central callback
in the socket support. Instead of having to pass around the socket
priority all the time, assign it to skb->priority when actually
allocating the SKB.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2cap_core.c
2cap_sock.c
67f86a45bb82091a2775561a1e498010afff54ee 08-Jun-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use const for struct l2cap_ops field

The struct l2cap_ops field should not allow any modifications and thus
it is better declared as const.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2cap_sock.c
1d56dc4f5f7cdf0ba99062d974b7586a28fc5cf4 17-Jun-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Fix for ACL disconnect when pairing fails

When pairing fails hci_conn refcnt drops below zero. This cause that
ACL link is not disconnected when disconnect timeout fires.

Probably this is because l2cap_conn_del calls l2cap_chan_del for each
channel, and inside l2cap_chan_del conn is dropped. After that loop
hci_chan_del is called which also drops conn.

Anyway, as it is desrcibed in hci_core.h, it is known that refcnt
drops below 0 sometimes and it should be fine. If so, let disconnect
link when hci_conn_timeout fires and refcnt is 0 or below. This patch
does it.

This affects PTS test SM_TC_JW_BV_05_C

Logs from scenario:

[69713.706227] [6515] pair_device:
[69713.706230] [6515] hci_conn_add: hci0 dst 00:1b:dc:06:06:22
[69713.706233] [6515] hci_dev_hold: hci0 orig refcnt 8
[69713.706235] [6515] hci_conn_init_sysfs: conn ffff88021f65a000
[69713.706239] [6515] hci_req_add_ev: hci0 opcode 0x200d plen 25
[69713.706242] [6515] hci_prepare_cmd: skb len 28
[69713.706243] [6515] hci_req_run: length 1
[69713.706248] [6515] hci_conn_hold: hcon ffff88021f65a000 orig refcnt 0
[69713.706251] [6515] hci_dev_put: hci0 orig refcnt 9
[69713.706281] [8909] hci_cmd_work: hci0 cmd_cnt 1 cmd queued 1
[69713.706288] [8909] hci_send_frame: hci0 type 1 len 28
[69713.706290] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 28
[69713.706316] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.706382] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.711664] [8909] hci_rx_work: hci0
[69713.711668] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 6
[69713.711680] [8909] hci_rx_work: hci0 Event packet
[69713.711683] [8909] hci_cs_le_create_conn: hci0 status 0x00
[69713.711685] [8909] hci_sent_cmd_data: hci0 opcode 0x200d
[69713.711688] [8909] hci_req_cmd_complete: opcode 0x200d status 0x00
[69713.711690] [8909] hci_sent_cmd_data: hci0 opcode 0x200d
[69713.711695] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.711744] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.818875] [8909] hci_rx_work: hci0
[69713.818889] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 21
[69713.818913] [8909] hci_rx_work: hci0 Event packet
[69713.818917] [8909] hci_le_conn_complete_evt: hci0 status 0x00
[69713.818922] [8909] hci_send_to_control: len 19
[69713.818927] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.818938] [8909] hci_conn_add_sysfs: conn ffff88021f65a000
[69713.818975] [6450] bt_sock_poll: sock ffff88005e758500, sk ffff88010323b800
[69713.818981] [6515] hci_sock_recvmsg: sock ffff88005e75a080, sk ffff88010323ac00
...
[69713.819021] [8909] hci_dev_hold: hci0 orig refcnt 10
[69713.819025] [8909] l2cap_connect_cfm: hcon ffff88021f65a000 bdaddr 00:1b:dc:06:06:22 status 0
[69713.819028] [8909] hci_chan_create: hci0 hcon ffff88021f65a000
[69713.819031] [8909] l2cap_conn_add: hcon ffff88021f65a000 conn ffff880221005c00 hchan ffff88020d60b1c0
[69713.819034] [8909] l2cap_conn_ready: conn ffff880221005c00
[69713.819036] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.819037] [8909] smp_conn_security: conn ffff880221005c00 hcon ffff88021f65a000 level 0x02
[69713.819039] [8909] smp_chan_create:
[69713.819041] [8909] hci_conn_hold: hcon ffff88021f65a000 orig refcnt 1
[69713.819043] [8909] smp_send_cmd: code 0x01
[69713.819045] [8909] hci_send_acl: hci0 chan ffff88020d60b1c0 flags 0x0000
[69713.819046] [5949] hci_sock_recvmsg: sock ffff8800941a9900, sk ffff88012bf4e800
[69713.819049] [8909] hci_queue_acl: hci0 nonfrag skb ffff88005157c100 len 15
[69713.819055] [5949] hci_sock_recvmsg: sock ffff8800941a9900, sk ffff88012bf4e800
[69713.819057] [8909] l2cap_le_conn_ready:
[69713.819064] [8909] l2cap_chan_create: chan ffff88005ede2c00
[69713.819066] [8909] l2cap_chan_hold: chan ffff88005ede2c00 orig refcnt 1
[69713.819069] [8909] l2cap_sock_init: sk ffff88005ede5800
[69713.819072] [8909] bt_accept_enqueue: parent ffff880160356000, sk ffff88005ede5800
[69713.819074] [8909] __l2cap_chan_add: conn ffff880221005c00, psm 0x00, dcid 0x0004
[69713.819076] [8909] l2cap_chan_hold: chan ffff88005ede2c00 orig refcnt 2
[69713.819078] [8909] hci_conn_hold: hcon ffff88021f65a000 orig refcnt 2
[69713.819080] [8909] smp_conn_security: conn ffff880221005c00 hcon ffff88021f65a000 level 0x01
[69713.819082] [8909] l2cap_sock_ready_cb: sk ffff88005ede5800, parent ffff880160356000
[69713.819086] [8909] le_pairing_complete_cb: status 0
[69713.819091] [8909] hci_tx_work: hci0 acl 10 sco 8 le 0
[69713.819093] [8909] hci_sched_acl: hci0
[69713.819094] [8909] hci_sched_sco: hci0
[69713.819096] [8909] hci_sched_esco: hci0
[69713.819098] [8909] hci_sched_le: hci0
[69713.819099] [8909] hci_chan_sent: hci0
[69713.819101] [8909] hci_chan_sent: chan ffff88020d60b1c0 quote 10
[69713.819104] [8909] hci_sched_le: chan ffff88020d60b1c0 skb ffff88005157c100 len 15 priority 7
[69713.819106] [8909] hci_send_frame: hci0 type 2 len 15
[69713.819108] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 15
[69713.819119] [8909] hci_chan_sent: hci0
[69713.819121] [8909] hci_prio_recalculate: hci0
[69713.819123] [8909] process_pending_rx:
[69713.819226] [6450] hci_sock_recvmsg: sock ffff88005e758780, sk ffff88010323d400
...
[69713.822022] [6450] l2cap_sock_accept: sk ffff880160356000 timeo 0
[69713.822024] [6450] bt_accept_dequeue: parent ffff880160356000
[69713.822026] [6450] bt_accept_unlink: sk ffff88005ede5800 state 1
[69713.822028] [6450] l2cap_sock_accept: new socket ffff88005ede5800
[69713.822368] [6450] l2cap_sock_getname: sock ffff8800941ab700, sk ffff88005ede5800
[69713.822375] [6450] l2cap_sock_getsockopt: sk ffff88005ede5800
[69713.822383] [6450] l2cap_sock_getname: sock ffff8800941ab700, sk ffff88005ede5800
[69713.822414] [6450] bt_sock_poll: sock ffff8800941ab700, sk ffff88005ede5800
...
[69713.823255] [6450] l2cap_sock_getname: sock ffff8800941ab700, sk ffff88005ede5800
[69713.823259] [6450] l2cap_sock_getsockopt: sk ffff88005ede5800
[69713.824322] [6450] l2cap_sock_getname: sock ffff8800941ab700, sk ffff88005ede5800
[69713.824330] [6450] l2cap_sock_getsockopt: sk ffff88005ede5800
[69713.825029] [6450] bt_sock_poll: sock ffff88005e758500, sk ffff88010323b800
...
[69713.825187] [6450] l2cap_sock_sendmsg: sock ffff8800941ab700, sk ffff88005ede5800
[69713.825189] [6450] bt_sock_wait_ready: sk ffff88005ede5800
[69713.825192] [6450] l2cap_create_basic_pdu: chan ffff88005ede2c00 len 3
[69713.825196] [6450] l2cap_do_send: chan ffff88005ede2c00, skb ffff880160b0b500 len 7 priority 0
[69713.825199] [6450] hci_send_acl: hci0 chan ffff88020d60b1c0 flags 0x0000
[69713.825201] [6450] hci_queue_acl: hci0 nonfrag skb ffff880160b0b500 len 11
[69713.825210] [8909] hci_tx_work: hci0 acl 9 sco 8 le 0
[69713.825213] [8909] hci_sched_acl: hci0
[69713.825214] [8909] hci_sched_sco: hci0
[69713.825216] [8909] hci_sched_esco: hci0
[69713.825217] [8909] hci_sched_le: hci0
[69713.825219] [8909] hci_chan_sent: hci0
[69713.825221] [8909] hci_chan_sent: chan ffff88020d60b1c0 quote 9
[69713.825223] [8909] hci_sched_le: chan ffff88020d60b1c0 skb ffff880160b0b500 len 11 priority 0
[69713.825225] [8909] hci_send_frame: hci0 type 2 len 11
[69713.825227] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 11
[69713.825242] [8909] hci_chan_sent: hci0
[69713.825253] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.825253] [8909] hci_prio_recalculate: hci0
[69713.825292] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.825768] [6450] bt_sock_poll: sock ffff88005e758500, sk ffff88010323b800
...
[69713.866902] [8909] hci_rx_work: hci0
[69713.866921] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 7
[69713.866928] [8909] hci_rx_work: hci0 Event packet
[69713.866931] [8909] hci_num_comp_pkts_evt: hci0 num_hndl 1
[69713.866937] [8909] hci_tx_work: hci0 acl 9 sco 8 le 0
[69713.866939] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.866940] [8909] hci_sched_acl: hci0
...
[69713.866944] [8909] hci_sched_le: hci0
[69713.866953] [8909] hci_chan_sent: hci0
[69713.866997] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.867840] [28074] hci_rx_work: hci0
[69713.867844] [28074] hci_send_to_monitor: hdev ffff88021f0c7000 len 7
[69713.867850] [28074] hci_rx_work: hci0 Event packet
[69713.867853] [28074] hci_num_comp_pkts_evt: hci0 num_hndl 1
[69713.867857] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69713.867858] [28074] hci_tx_work: hci0 acl 10 sco 8 le 0
[69713.867860] [28074] hci_sched_acl: hci0
[69713.867861] [28074] hci_sched_sco: hci0
[69713.867862] [28074] hci_sched_esco: hci0
[69713.867863] [28074] hci_sched_le: hci0
[69713.867865] [28074] hci_chan_sent: hci0
[69713.867888] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69714.145661] [8909] hci_rx_work: hci0
[69714.145666] [8909] hci_send_to_monitor: hdev ffff88021f0c7000 len 10
[69714.145676] [8909] hci_rx_work: hci0 ACL data packet
[69714.145679] [8909] hci_acldata_packet: hci0 len 6 handle 0x002d flags 0x0002
[69714.145681] [8909] hci_conn_enter_active_mode: hcon ffff88021f65a000 mode 0
[69714.145683] [8909] l2cap_recv_acldata: conn ffff880221005c00 len 6 flags 0x2
[69714.145693] [8909] l2cap_recv_frame: len 2, cid 0x0006
[69714.145696] [8909] hci_send_to_control: len 14
[69714.145710] [8909] smp_chan_destroy:
[69714.145713] [8909] pairing_complete: status 3
[69714.145714] [8909] cmd_complete: sock ffff88010323ac00
[69714.145717] [8909] hci_conn_drop: hcon ffff88021f65a000 orig refcnt 3
[69714.145719] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69714.145720] [6450] bt_sock_poll: sock ffff88005e758500, sk ffff88010323b800
[69714.145722] [6515] hci_sock_recvmsg: sock ffff88005e75a080, sk ffff88010323ac00
[69714.145724] [6450] bt_sock_poll: sock ffff8801db6b4f00, sk ffff880160351c00
...
[69714.145735] [6515] hci_sock_recvmsg: sock ffff88005e75a080, sk ffff88010323ac00
[69714.145737] [8909] hci_conn_drop: hcon ffff88021f65a000 orig refcnt 2
[69714.145739] [8909] l2cap_conn_del: hcon ffff88021f65a000 conn ffff880221005c00, err 13
[69714.145740] [6450] bt_sock_poll: sock ffff8801db6b5400, sk ffff88021e775000
[69714.145743] [6450] bt_sock_poll: sock ffff8801db6b5e00, sk ffff880160356000
[69714.145744] [8909] l2cap_chan_hold: chan ffff88005ede2c00 orig refcnt 3
[69714.145746] [6450] bt_sock_poll: sock ffff8800941ab700, sk ffff88005ede5800
[69714.145748] [8909] l2cap_chan_del: chan ffff88005ede2c00, conn ffff880221005c00, err 13
[69714.145749] [8909] l2cap_chan_put: chan ffff88005ede2c00 orig refcnt 4
[69714.145751] [8909] hci_conn_drop: hcon ffff88021f65a000 orig refcnt 1
[69714.145754] [6450] bt_sock_poll: sock ffff8800941ab700, sk ffff88005ede5800
[69714.145756] [8909] l2cap_chan_put: chan ffff88005ede2c00 orig refcnt 3
[69714.145759] [8909] hci_chan_del: hci0 hcon ffff88021f65a000 chan ffff88020d60b1c0
[69714.145766] [5949] hci_sock_recvmsg: sock ffff8800941a9680, sk ffff88012bf4d000
[69714.145787] [6515] hci_sock_release: sock ffff88005e75a080 sk ffff88010323ac00
[69714.146002] [6450] hci_sock_recvmsg: sock ffff88005e758780, sk ffff88010323d400
[69714.150795] [6450] l2cap_sock_release: sock ffff8800941ab700, sk ffff88005ede5800
[69714.150799] [6450] l2cap_sock_shutdown: sock ffff8800941ab700, sk ffff88005ede5800
[69714.150802] [6450] l2cap_chan_close: chan ffff88005ede2c00 state BT_CLOSED
[69714.150805] [6450] l2cap_sock_kill: sk ffff88005ede5800 state BT_CLOSED
[69714.150806] [6450] l2cap_chan_put: chan ffff88005ede2c00 orig refcnt 2
[69714.150808] [6450] l2cap_sock_destruct: sk ffff88005ede5800
[69714.150809] [6450] l2cap_chan_put: chan ffff88005ede2c00 orig refcnt 1
[69714.150811] [6450] l2cap_chan_destroy: chan ffff88005ede2c00
[69714.150970] [6450] bt_sock_poll: sock ffff88005e758500, sk ffff88010323b800
...
[69714.151991] [8909] hci_conn_drop: hcon ffff88021f65a000 orig refcnt 0
[69716.150339] [8909] hci_conn_timeout: hcon ffff88021f65a000 state BT_CONNECTED, refcnt -1

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2ed8f65ca262bca778e60053f667ce11b32db6b8 17-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix rejecting pairing in case of insufficient capabilities

If we need an MITM protected connection but the local and remote IO
capabilities cannot provide it we should reject the pairing attempt in
the appropriate way. This patch adds the missing checks for such a
situation to the smp_cmd_pairing_req() and smp_cmd_pairing_rsp()
functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
581370cc74ea75426421a1f5851ef05e2e995b01 17-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor authentication method lookup into its own function

We'll need to do authentication method lookups from more than one place,
so refactor the lookup into its own function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
c7262e711ae6e466baeb9ddc21d678c878469b1f 17-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix overriding higher security level in SMP

When we receive a pairing request or an internal request to start
pairing we shouldn't blindly overwrite the existing pending_sec_level
value as that may actually be higher than the new one. This patch fixes
the SMP code to only overwrite the value in case the new one is higher
than the old.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
92d1372e1a9fec00e146b74e8b9ad7a385b9b37f 13-Jun-2014 Marcin Kraglak <marcin.kraglak@tieto.com> Bluetooth: Allow change security level on ATT_CID in slave role

Kernel supports SMP Security Request so don't block increasing security
when we are slave.

Signed-off-by: Marcin Kraglak <marcin.kraglak@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2cap_sock.c
c73f94b8c093a615ce80eabbde0ac6eb9abfe31a 13-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix locking of hdev when calling into SMP code

The SMP code expects hdev to be unlocked since e.g. crypto functions
will try to (re)lock it. Therefore, we need to release the lock before
calling into smp.c from mgmt.c. Without this we risk a deadlock whenever
the smp_user_confirm_reply() function is called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
gmt.c
7ab56c3a6eccb215034b0cb096e0313441cbf2a4 12-Jun-2014 Jukka Taimisto <jtt@codenomicon.com> Bluetooth: Fix deadlock in l2cap_conn_del()

A deadlock occurs when PDU containing invalid SMP opcode is received on
Security Manager Channel over LE link and conn->pending_rx_work worker
has not run yet.

When LE link is created l2cap_conn_ready() is called and before
returning it schedules conn->pending_rx_work worker to hdev->workqueue.
Incoming data to SMP fixed channel is handled by l2cap_recv_frame()
which calls smp_sig_channel() to handle the SMP PDU. If
smp_sig_channel() indicates failure l2cap_conn_del() is called to delete
the connection. When deleting the connection, l2cap_conn_del() purges
the pending_rx queue and calls flush_work() to wait for the
pending_rx_work worker to complete.

Since incoming data is handled by a worker running from the same
workqueue as the pending_rx_work is being scheduled on, we will deadlock
on waiting for pending_rx_work to complete.

This patch fixes the deadlock by calling cancel_work_sync() instead of
flush_work().

Signed-off-by: Jukka Taimisto <jtt@codenomicon.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2cap_core.c
f8680f128b01212895a9afb31032f6ffe91bd771 10-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reuse hci_stop_discovery function when cleaning up HCI state

When cleaning up the HCI state as part of the power-off procedure we can
reuse the hci_stop_discovery() function instead of explicitly sending
HCI command related to discovery. The added benefit of this is that it
takes care of canceling name resolving and inquiry which were not
previously covered by the code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
gmt.c
21a60d307ddc2180cfa542a995d943d1034cf5c5 10-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor discovery stopping into its own function

We'll need to reuse the same logic for stopping discovery also when
cleaning up HCI state when powering off. This patch refactors the code
out to its own function that can later (in a subsequent patch) be used
also for the power off case.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
gmt.c
50143a433b70e3145bcf8a4a4e54f0c11bdee32b 10-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix indicating discovery state when canceling inquiry

When inquiry is canceled through the HCI_Cancel_Inquiry command there is
no Inquiry Complete event generated. Instead, all we get is the command
complete for the HCI_Inquiry_Cancel command. This means that we must
call the hci_discovery_set_state() function from the respective command
complete handler in order to ensure that user space knows the correct
discovery state.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_event.c
fff3490f47810e2d34b91fb9e31103e923b11c2f 10-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting correct authentication information for SMP STK

When we store the STK in slave role we should set the correct
authentication information for it. If the pairing is producing a HIGH
security level the STK is considered authenticated, and otherwise it's
considered unauthenticated. This patch fixes the value passed to the
hci_add_ltk() function when adding the STK on the slave side.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Marcin Kraglak <marcin.kraglak@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
mp.c
4ad51a75c70ba1ba6802fa7ff2ee6829b1c6e61a 09-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add clarifying comment for conn->auth_type

When responding to an IO capability request when we're the initiators of
the pairing we will not yet have the remote IO capability information.
Since the conn->auth_type variable is treated as an "absolute"
requirement instead of a hint of what's needed later in the user
confirmation request handler it's important that it doesn't have the
MITM bit set if there's any chance that the remote device doesn't have
the necessary IO capabilities.

This patch adds a clarifying comment so that conn->auth_type is left
untouched in this scenario.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
ba15a58b179ed76a7e887177f2b06de12c58ec8f 09-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SSP acceptor just-works confirmation without MITM

From the Bluetooth Core Specification 4.1 page 1958:

"if both devices have set the Authentication_Requirements parameter to
one of the MITM Protection Not Required options, authentication stage 1
shall function as if both devices set their IO capabilities to
DisplayOnly (e.g., Numeric comparison with automatic confirmation on
both devices)"

So far our implementation has done user confirmation for all just-works
cases regardless of the MITM requirements, however following the
specification to the word means that we should not be doing confirmation
when neither side has the MITM flag set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_event.c
e694788d73efe139b24f78b036deb97fe57fa8cb 10-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix check for connection encryption

The conn->link_key variable tracks the type of link key in use. It is
set whenever we respond to a link key request as well as when we get a
link key notification event.

These two events do not however always guarantee that encryption is
enabled: getting a link key request and responding to it may only mean
that the remote side has requested authentication but not encryption. On
the other hand, the encrypt change event is a certain guarantee that
encryption is enabled. The real encryption state is already tracked in
the conn->link_mode variable through the HCI_LM_ENCRYPT bit.

This patch fixes a check for encryption in the hci_conn_auth function to
use the proper conn->link_mode value and thereby eliminates the chance
of a false positive result.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_conn.c
b62b65055bcc5372d5c3f4103629176cb8db3678 04-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix incorrectly overriding conn->src_type

The src_type member of struct hci_conn should always reflect the address
type of the src_member. It should never be overridden. There is already
code in place in the command status handler of HCI_LE_Create_Connection
to copy the right initiator address into conn->init_addr_type.

Without this patch, if privacy is enabled, we will send the wrong
address type in the SMP identity address information PDU (it'll e.g.
contain our public address but a random address type).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_conn.c
f9da455b93f6ba076935b4ef4589f61e529ae046 12-Jun-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

1) Seccomp BPF filters can now be JIT'd, from Alexei Starovoitov.

2) Multiqueue support in xen-netback and xen-netfront, from Andrew J
Benniston.

3) Allow tweaking of aggregation settings in cdc_ncm driver, from Bjørn
Mork.

4) BPF now has a "random" opcode, from Chema Gonzalez.

5) Add more BPF documentation and improve test framework, from Daniel
Borkmann.

6) Support TCP fastopen over ipv6, from Daniel Lee.

7) Add software TSO helper functions and use them to support software
TSO in mvneta and mv643xx_eth drivers. From Ezequiel Garcia.

8) Support software TSO in fec driver too, from Nimrod Andy.

9) Add Broadcom SYSTEMPORT driver, from Florian Fainelli.

10) Handle broadcasts more gracefully over macvlan when there are large
numbers of interfaces configured, from Herbert Xu.

11) Allow more control over fwmark used for non-socket based responses,
from Lorenzo Colitti.

12) Do TCP congestion window limiting based upon measurements, from Neal
Cardwell.

13) Support busy polling in SCTP, from Neal Horman.

14) Allow RSS key to be configured via ethtool, from Venkata Duvvuru.

15) Bridge promisc mode handling improvements from Vlad Yasevich.

16) Don't use inetpeer entries to implement ID generation any more, it
performs poorly, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1522 commits)
rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
tcp: fixing TLP's FIN recovery
net: fec: Add software TSO support
net: fec: Add Scatter/gather support
net: fec: Increase buffer descriptor entry number
net: fec: Factorize feature setting
net: fec: Enable IP header hardware checksum
net: fec: Factorize the .xmit transmit function
bridge: fix compile error when compiling without IPv6 support
bridge: fix smatch warning / potential null pointer dereference
via-rhine: fix full-duplex with autoneg disable
bnx2x: Enlarge the dorq threshold for VFs
bnx2x: Check for UNDI in uncommon branch
bnx2x: Fix 1G-baseT link
bnx2x: Fix link for KR with swapped polarity lane
sctp: Fix sk_ack_backlog wrap-around problem
net/core: Add VF link state control policy
net/fsl: xgmac_mdio is dependent on OF_MDIO
net/fsl: Make xgmac_mdio read error message useful
net_sched: drr: warn when qdisc is not work conserving
...
bad93e9d4eeb0d2d6b79204d6cedc7f2e7b256f1 12-Jun-2014 Octavian Purdila <octavian.purdila@intel.com> net: add __pskb_copy_fclone and pskb_copy_for_clone

There are several instances where a pskb_copy or __pskb_copy is
immediately followed by an skb_clone.

Add a couple of new functions to allow the copy skb to be allocated
from the fclone cache and thus speed up subsequent skb_clone calls.

Cc: Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
Cc: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Cc: Marek Lindner <mareklindner@neomailbox.ch>
Cc: Simon Wunderlich <sw@simonwunderlich.de>
Cc: Antonio Quartulli <antonio@meshcoding.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Arvid Brodin <arvid.brodin@alten.se>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Cc: Lauro Ramos Venancio <lauro.venancio@openbossa.org>
Cc: Aloisio Almeida Jr <aloisio.almeida@openbossa.org>
Cc: Samuel Ortiz <sameo@linux.intel.com>
Cc: Jon Maloy <jon.maloy@ericsson.com>
Cc: Allan Stephens <allan.stephens@windriver.com>
Cc: Andrew Hendry <andrew.hendry@gmail.com>
Cc: Eric Dumazet <edumazet@google.com>
Reviewed-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
3f17ea6dea8ba5668873afa54628a91aaa3fb1c0 08-Jun-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'next' (accumulated 3.16 merge window patches) into master

Now that 3.15 is released, this merges the 'next' branch into 'master',
bringing us to the normal situation where my 'master' branch is the
merge window.

* accumulated work in next: (6809 commits)
ufs: sb mutex merge + mutex_destroy
powerpc: update comments for generic idle conversion
cris: update comments for generic idle conversion
idle: remove cpu_idle() forward declarations
nbd: zero from and len fields in NBD_CMD_DISCONNECT.
mm: convert some level-less printks to pr_*
MAINTAINERS: adi-buildroot-devel is moderated
MAINTAINERS: add linux-api for review of API/ABI changes
mm/kmemleak-test.c: use pr_fmt for logging
fs/dlm/debug_fs.c: replace seq_printf by seq_puts
fs/dlm/lockspace.c: convert simple_str to kstr
fs/dlm/config.c: convert simple_str to kstr
mm: mark remap_file_pages() syscall as deprecated
mm: memcontrol: remove unnecessary memcg argument from soft limit functions
mm: memcontrol: clean up memcg zoneinfo lookup
mm/memblock.c: call kmemleak directly from memblock_(alloc|free)
mm/mempool.c: update the kmemleak stack trace for mempool allocations
lib/radix-tree.c: update the kmemleak stack trace for radix tree allocations
mm: introduce kmemleak_update_trace()
mm/kmemleak.c: use %u to print ->checksum
...
67be1e4f4b0a512f6af3a7db681ae9b62d31de5e 05-Jun-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
776edb59317ada867dfcddde40b55648beeb0078 03-Jun-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next

Pull core locking updates from Ingo Molnar:
"The main changes in this cycle were:

- reduced/streamlined smp_mb__*() interface that allows more usecases
and makes the existing ones less buggy, especially in rarer
architectures

- add rwsem implementation comments

- bump up lockdep limits"

* 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits)
rwsem: Add comments to explain the meaning of the rwsem's count field
lockdep: Increase static allocations
arch: Mass conversion of smp_mb__*()
arch,doc: Convert smp_mb__*()
arch,xtensa: Convert smp_mb__*()
arch,x86: Convert smp_mb__*()
arch,tile: Convert smp_mb__*()
arch,sparc: Convert smp_mb__*()
arch,sh: Convert smp_mb__*()
arch,score: Convert smp_mb__*()
arch,s390: Convert smp_mb__*()
arch,powerpc: Convert smp_mb__*()
arch,parisc: Convert smp_mb__*()
arch,openrisc: Convert smp_mb__*()
arch,mn10300: Convert smp_mb__*()
arch,mips: Convert smp_mb__*()
arch,metag: Convert smp_mb__*()
arch,m68k: Convert smp_mb__*()
arch,m32r: Convert smp_mb__*()
arch,ia64: Convert smp_mb__*()
...
8a96f3cd22878fc0bb564a8478a6e17c0b8dca73 22-May-2014 Jukka Taimisto <jtt@codenomicon.com> Bluetooth: Fix L2CAP deadlock

-[0x01 Introduction

We have found a programming error causing a deadlock in Bluetooth subsystem
of Linux kernel. The problem is caused by missing release_sock() call when
L2CAP connection creation fails due full accept queue.

The issue can be reproduced with 3.15-rc5 kernel and is also present in
earlier kernels.

-[0x02 Details

The problem occurs when multiple L2CAP connections are created to a PSM which
contains listening socket (like SDP) and left pending, for example,
configuration (the underlying ACL link is not disconnected between
connections).

When L2CAP connection request is received and listening socket is found the
l2cap_sock_new_connection_cb() function (net/bluetooth/l2cap_sock.c) is called.
This function locks the 'parent' socket and then checks if the accept queue
is full.

1178 lock_sock(parent);
1179
1180 /* Check for backlog size */
1181 if (sk_acceptq_is_full(parent)) {
1182 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1183 return NULL;
1184 }

If case the accept queue is full NULL is returned, but the 'parent' socket
is not released. Thus when next L2CAP connection request is received the code
blocks on lock_sock() since the parent is still locked.

Also note that for connections already established and waiting for
configuration to complete a timeout will occur and l2cap_chan_timeout()
(net/bluetooth/l2cap_core.c) will be called. All threads calling this
function will also be blocked waiting for the channel mutex since the thread
which is waiting on lock_sock() alread holds the channel mutex.

We were able to reproduce this by sending continuously L2CAP connection
request followed by disconnection request containing invalid CID. This left
the created connections pending configuration.

After the deadlock occurs it is impossible to kill bluetoothd, btmon will not
get any more data etc. requiring reboot to recover.

-[0x03 Fix

Releasing the 'parent' socket when l2cap_sock_new_connection_cb() returns NULL
seems to fix the issue.

Signed-off-by: Jukka Taimisto <jtt@codenomicon.com>
Reported-by: Tommi Mäkilä <tmakila@codenomicon.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
2cap_sock.c
f3fb0b58c85666f73139963a7a04d7878f3d22c9 02-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing check for FIPS security level

When checking whether a legacy link key provides at least HIGH security
level we also need to check for FIPS level which is one step above HIGH.
This patch fixes a missing check in the hci_link_key_request_evt()
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_event.c
79897d2097a629179e142014ecd3cdce6eac7f0e 01-Jun-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix requiring SMP MITM for outgoing connections

Due to recent changes to the way that the MITM requirement is set for
outgoing pairing attempts we can no longer rely on the hcon->auth_type
variable (which is actually good since it was formed from BR/EDR
concepts that don't really exist for SMP).

To match the logic that BR/EDR now uses simply rely on the local IO
capability and/or needed security level to set the MITM requirement for
outgoing pairing requests.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
mp.c
6a5e81650aa8f6e636d9537c7f127c0ee4d55eae 28-May-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: l2cap: Set more channel defaults

Default values for various channel settings were missing. This
way channel users do not need to set default values themselves.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
62bbd5b35994eaf30519f126765d7f6af9cd3526 27-May-2014 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: 6LoWPAN: Fix MAC address universal/local bit handling

The universal/local bit handling was incorrectly done in the code.

So when setting EUI address from BD address we do this:
- If BD address type is PUBLIC, then we clear the universal bit
in EUI address. If the address type is RANDOM, then the universal
bit is set (BT 6lowpan draft chapter 3.2.2)
- After this we invert the universal/local bit according to RFC 2464

When figuring out BD address we do the reverse:
- Take EUI address from stateless IPv6 address, invert the
universal/local bit according to RFC 2464
- If universal bit is 1 in this modified EUI address, then address
type is set to RANDOM, otherwise it is PUBLIC

Note that 6lowpan_iphc.[ch] does the final toggling of U/L bit
before sending or receiving the network packet.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
lowpan.c
7e3691e13ab51f3491e996e2edaf99b173621288 30-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix authentication check for FIPS security level

When checking whether we need to request authentication or not we should
include HCI_SECURITY_FIPS to the levels that always need authentication.
This patch fixes check for it in the hci_outgoing_auth_needed()
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_event.c
61b433579b6ffecb1d3534fd482dcd48535277c8 29-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix properly ignoring LTKs of unknown types

In case there are new LTK types in the future we shouldn't just blindly
assume that != MGMT_LTK_UNAUTHENTICATED means that the key is
authenticated. This patch adds explicit checks for each allowed key type
in the form of a switch statement and skips any key which has an unknown
value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
gmt.c
a5eb1aeb25df89c627248a162cc35ffb556dc486 29-May-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next

Conflicts:
drivers/bluetooth/btusb.c
03c4444650969431b3a5effde4995de767e3013a 27-May-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
d7b2545023ecfde94d3ea9c03c5480ac18da96c9 23-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Clearly distinguish mgmt LTK type from authenticated property

On the mgmt level we have a key type parameter which currently accepts
two possible values: 0x00 for unauthenticated and 0x01 for
authenticated. However, in the internal struct smp_ltk representation we
have an explicit "authenticated" boolean value.

To make this distinction clear, add defines for the possible mgmt values
and do conversion to and from the internal authenticated value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
1cc6114402f864c3d090738df355d26c1fd374bb 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update smp_confirm to return a response code

Now that smp_confirm() is called "inline" we can have it return a
response code and have the sending of it be done in the shared place for
command handlers. One exception is when we're entering smp.c from mgmt.c
when user space responds to authentication, in which case we still need
our own code to call smp_failure().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
861580a970f1abe64193636eab9e5a1a7556a555 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update smp_random to return a response code

Since we're now calling smp_random() "inline" we can have it directly
return a response code and have the shared command handler send the
response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
4a74d65868f10dafe38765d4fe5bbf1e75f0623d 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename smp->smp_flags to smp->flags

There's no reason to have "smp" in this variable name since it is
already part of the SMP struct which provides sufficient context.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
9dd4dd275f2e6dcef1f798118babcb5947f64497 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary work structs from SMP code

When the SMP code was initially created (mid-2011) parts of the
Bluetooth subsystem were still not converted to use workqueues. This
meant that the crypto calls, which could sleep, couldn't be called
directly. Because of this the "confirm" and "random" work structs were
introduced.

These days the entire Bluetooth subsystem runs through workqueues which
makes these structs unnecessary. This patch removes them and converts
the calls to queue them to use direct function calls instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
1ef35827a999582669b38b71d3167907b4c2afd0 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting initial local auth_req value

There is no reason to have the initial local value conditional to
whether the remote value has bonding set or not. We can either way start
off with the value we received.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
4bc58f51e156227d139668199ffe5df2ccb2f3c2 20-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make SMP context private to smp.c

There are no users of the smp_chan struct outside of smp.c so move it
away from smp.h. The addition of the l2cap.h include to hci_core.c,
hci_conn.c and mgmt.c is something that should have been there already
previously to avoid warnings of undeclared struct l2cap_conn, but the
compiler warning was apparently shadowed away by the mention of
l2cap_conn in the struct smp_chan definition.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
gmt.c
mp.c
mp.h
f4e2dd53d5d876aaf33ec9c4d3dd0286a5bf89c5 16-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Add missing msecs to jiffies conversion

conn_info_age value is calculated in ms, so need to be converted to
jiffies.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
eed5daf318cf579f06c3e1eb47d014c35c84e3a3 14-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Add support for max_tx_power in Get Conn Info

This patch adds support for max_tx_power in Get Connection Information
request. Value is read only once for given connection and then always
returned in response as parameter.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d0455ed996df84fd2670a655fe13ab72f8264765 14-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Store max TX power level for connection

This patch adds support to store local maximum TX power level for
connection when reply for HCI_Read_Transmit_Power_Level is received.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
f7faab0c9d47f7d3fb25db42eff08497131ec8ba 14-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Avoid polling TX power for LE links

TX power for LE links is immutable thus we do not need to query for it
if already have value.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
dd9838087b8c2b45c7976e46290749732d7af9d5 14-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Add support to get connection information

This patch adds support for Get Connection Information mgmt command
which can be used to query for information about connection, i.e. RSSI
and local TX power level.

In general values cached in hci_conn are returned as long as they are
considered valid, i.e. do not exceed age limit set in hdev. This limit
is calculated as random value between min/max values to avoid client
trying to guess when to poll for updated information.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
31ad169148df2252a774c73c504aff43bfa4b656 14-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Add conn info lifetime parameters to debugfs

This patch adds conn_info_min_age and conn_info_max_age parameters to
debugfs which determine lifetime of connection information. Actual
lifetime will be random value between min and max age.

Default values for min and max age are 1000ms and 3000ms respectively.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
40b9397a1a61a37917b93e7d57e6f2faf3a086b4 14-May-2014 Samuel Ortiz <sameo@linux.intel.com> Bluetooth: Fix L2CAP LE debugfs entries permissions

0466 was probably meant to be 0644, there's no reason why everyone
except root could write there.

Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2cap_core.c
3231d65ffe36e177caf5006d4079867d9b7b2d4a 13-May-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
5a134faeef82b46ff4ad244d11d8c6be41679834 09-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Store TX power level for connection

This patch adds support to store local TX power level for connection
when reply for HCI_Read_Transmit_Power_Level is received.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
b75cf9cd162244fe1c29691a21acfb1e657101a7 09-May-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increment management interface revision

This patch increments the management interface revision due to the
changes with the Device Found management event and other fixes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
5ae76a94150c86a6e0ee84eb74e7f7e1909b8d39 08-May-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Store RSSI for connection

This patch adds support to store RSSI for connection when reply for
HCI_Read_RSSI is received.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
38e4a915663f3f3c03b753d90a34fbb6164ea55d 08-May-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for SMP Invalid Parameters error code

The Invalid Parameters error code is used to indicate that the command
length is invalid or that a parameter is outside of the specified range.
This error code wasn't clearly specified in the Bluetooth 4.0
specification but since 4.1 this has been fixed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
86aae6c7b577654b7293374973985a153e0c147e 29-Apr-2014 Libor Pechacek <lpechacek@suse.cz> Bluetooth: Convert RFCOMM spinlocks into mutexes

Enabling CONFIG_DEBUG_ATOMIC_SLEEP has shown that some rfcomm functions
acquiring spinlocks call sleeping locks further in the chain. Converting
the offending spinlocks into mutexes makes sleeping safe.

Signed-off-by: Libor Pechacek <lpechacek@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/tty.c
0006433a5be9e0e155ad493e33c6e9bf3868a87f 30-Apr-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
09da1f3463eb81d59685df723b1c5950b7570340 11-Apr-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix redundant encryption request for reauthentication

When we're performing reauthentication (in order to elevate the
security level from an unauthenticated key to an authenticated one) we
do not need to issue any encryption command once authentication
completes. Since the trigger for the encryption HCI command is the
ENCRYPT_PEND flag this flag should not be set in this scenario.
Instead, the REAUTH_PEND flag takes care of all necessary steps for
reauthentication.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_conn.c
9eb1fbfa0a737fd4d3a6d12d71c5ea9af622b887 11-Apr-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix triggering BR/EDR L2CAP Connect too early

Commit 1c2e004183178 introduced an event handler for the encryption key
refresh complete event with the intent of fixing some LE/SMP cases.
However, this event is shared with BR/EDR and there we actually want to
act only on the auth_complete event (which comes after the key refresh).

If we do not do this we may trigger an L2CAP Connect Request too early
and cause the remote side to return a security block error.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
ci_event.c
db5966816cd83b8daa1aee38cb1374794f1d8b8e 17-Apr-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Return EOPNOTSUPP for HCISETRAW ioctl command

The HCISETRAW ioctl command is not really useful. To utilize raw and
direct access to the HCI controller, the HCI User Channel feature has
been introduced. Return EOPNOTSUPP to indicate missing support for
this command.

For legacy reasons hcidump used to use HCISETRAW for permission check
to return proper error codes to users. To keep backwards compability
return EPERM in case the caller does not have CAP_NET_ADMIN capability.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
4e857c58efeb99393cba5a5d0d8ec7117183137c 17-Mar-2014 Peter Zijlstra <peterz@infradead.org> arch: Mass conversion of smp_mb__*()

Mostly scripted conversion of the smp_mb__* barriers.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/n/tip-55dhyhocezdw1dg7u19hmh1u@git.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: linux-arch@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
ci_event.c
676d23690fb62b5d51ba5d659935e9f7d9da9f8e 11-Apr-2014 David S. Miller <davem@davemloft.net> net: Fix use after free by removing length arg from sk_data_ready callbacks.

Several spots in the kernel perform a sequence like:

skb_queue_tail(&sk->s_receive_queue, skb);
sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up. So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument. And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.

Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_sock.c
fcomm/core.c
fcomm/sock.c
co.c
b16c6604885841e1b7d2eb09a3256bf6d3d4bc8a 08-Apr-2014 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Request MITM Protection when initiator

The GAP Specification gives the flexibility to decide whether MITM
Protection is requested or not (Bluetooth Core Specification v4.0
Volume 3, part C, section 6.5.3) when replying to an
HCI_EV_IO_CAPA_REQUEST event.

The recommendation is *not* to set this flag "unless the security
policy of an available local service requires MITM Protection"
(regardless of the bonding type). However, the kernel doesn't
necessarily have this information and therefore the safest choice is
to always use MITM Protection, also for General Bonding.

This patch changes the behavior for the General Bonding initiator
role, always requesting MITM Protection even if no high security level
is used. Depending on the remote capabilities, the protection might
not be actually used, and we will accept this locally unless of course
a high security level was originally required.

Note that this was already done for Dedicated Bonding. No-Bonding is
left unmodified because MITM Protection is normally not desired in
these cases.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Timo Mueller <timo.mueller@bmw-carit.de>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
7e74170af1fd5f09fb176759c1d0c0024548c057 08-Apr-2014 Timo Mueller <timo.mueller@bmw-carit.de> Bluetooth: Use MITM Protection when IO caps allow it

When responding to a remotely-initiated pairing procedure, a MITM
protected SSP associaton model can be used for pairing if both local
and remote IO capabilities are set to something other than
NoInputNoOutput, regardless of the bonding type (Dedicated or
General).

This was already done for Dedicated Bonding but this patch proposes to
use the same policy for General Bonding as well.

The GAP Specification gives the flexibility to decide whether MITM
Protection is used ot not (Bluetooth Core Specification v4.0 Volume 3,
part C, section 6.5.3).

Note however that the recommendation is *not* to set this flag "unless
the security policy of an available local service requires MITM
Protection" (for both Dedicated and General Bonding). However, as we are
already requiring MITM for Dedicated Bonding, we will follow this
behaviour also for General Bonding.

Signed-off-by: Timo Mueller <timo.mueller@bmw-carit.de>
Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
6fd6b915bd94cd81611254f318fa3bb769cc4afe 08-Apr-2014 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Refactor code for outgoing dedicated bonding

Do not always set the MITM protection requirement by default in the
field conn->auth_type, since this will be added later in
hci_io_capa_request_evt(), as part of the requirements specified in
HCI_OP_IO_CAPABILITY_REPLY.

This avoids a hackish exception for the auto-reject case, but doesn't
change the behavior of the code at all.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
b7f94c880839e85917369fe9097f861008b8c00e 08-Apr-2014 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Refactor hci_get_auth_req()

Refactor the code without changing its behavior by handling the
no-bonding cases first followed by General Bonding.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Timo Mueller <timo.mueller@bmw-carit.de>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
cd6362befe4cc7bf589a5236d2a780af2d47bcc9 03-Apr-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
"Here is my initial pull request for the networking subsystem during
this merge window:

1) Support for ESN in AH (RFC 4302) from Fan Du.

2) Add full kernel doc for ethtool command structures, from Ben
Hutchings.

3) Add BCM7xxx PHY driver, from Florian Fainelli.

4) Export computed TCP rate information in netlink socket dumps, from
Eric Dumazet.

5) Allow IPSEC SA to be dumped partially using a filter, from Nicolas
Dichtel.

6) Convert many drivers to pci_enable_msix_range(), from Alexander
Gordeev.

7) Record SKB timestamps more efficiently, from Eric Dumazet.

8) Switch to microsecond resolution for TCP round trip times, also
from Eric Dumazet.

9) Clean up and fix 6lowpan fragmentation handling by making use of
the existing inet_frag api for it's implementation.

10) Add TX grant mapping to xen-netback driver, from Zoltan Kiss.

11) Auto size SKB lengths when composing netlink messages based upon
past message sizes used, from Eric Dumazet.

12) qdisc dumps can take a long time, add a cond_resched(), From Eric
Dumazet.

13) Sanitize netpoll core and drivers wrt. SKB handling semantics.
Get rid of never-used-in-tree netpoll RX handling. From Eric W
Biederman.

14) Support inter-address-family and namespace changing in VTI tunnel
driver(s). From Steffen Klassert.

15) Add Altera TSE driver, from Vince Bridgers.

16) Optimizing csum_replace2() so that it doesn't adjust the checksum
by checksumming the entire header, from Eric Dumazet.

17) Expand BPF internal implementation for faster interpreting, more
direct translations into JIT'd code, and much cleaner uses of BPF
filtering in non-socket ocntexts. From Daniel Borkmann and Alexei
Starovoitov"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1976 commits)
netpoll: Use skb_irq_freeable to make zap_completion_queue safe.
net: Add a test to see if a skb is freeable in irq context
qlcnic: Fix build failure due to undefined reference to `vxlan_get_rx_port'
net: ptp: move PTP classifier in its own file
net: sxgbe: make "core_ops" static
net: sxgbe: fix logical vs bitwise operation
net: sxgbe: sxgbe_mdio_register() frees the bus
Call efx_set_channels() before efx->type->dimension_resources()
xen-netback: disable rogue vif in kthread context
net/mlx4: Set proper build dependancy with vxlan
be2net: fix build dependency on VxLAN
mac802154: make csma/cca parameters per-wpan
mac802154: allow only one WPAN to be up at any given time
net: filter: minor: fix kdoc in __sk_run_filter
netlink: don't compare the nul-termination in nla_strcmp
can: c_can: Avoid led toggling for every packet.
can: c_can: Simplify TX interrupt cleanup
can: c_can: Store dlc private
can: c_can: Reduce register access
can: c_can: Make the code readable
...
0f1b1e6d73cb989ce2c071edc57deade3b084dfe 03-Apr-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID updates from Jiri Kosina:
- substantial cleanup of the generic and transport layers, in the
direction of an ultimate goal of making struct hid_device completely
transport independent, by Benjamin Tissoires
- cp2112 driver from David Barksdale
- a lot of fixes and new hardware support (Dualshock 4) to hid-sony
driver, by Frank Praznik
- support for Win 8.1 multitouch protocol by Andrew Duggan
- other smaller fixes / device ID additions

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (75 commits)
HID: sony: fix force feedback mismerge
HID: sony: Set the quriks flag for Bluetooth controllers
HID: sony: Fix Sixaxis cable state detection
HID: uhid: Add UHID_CREATE2 + UHID_INPUT2
HID: hyperv: fix _raw_request() prototype
HID: hyperv: Implement a stub raw_request() entry point
HID: hid-sensor-hub: fix sleeping function called from invalid context
HID: multitouch: add support for Win 8.1 multitouch touchpads
HID: remove hid_output_raw_report transport implementations
HID: sony: do not rely on hid_output_raw_report
HID: cp2112: remove the last hid_output_raw_report() call
HID: cp2112: remove various hid_out_raw_report calls
HID: multitouch: add support of other generic collections in hid-mt
HID: multitouch: remove pen special handling
HID: multitouch: remove registered devices with default behavior
HID: hidp: Add a comment that some devices depend on the current behavior of uniq
HID: sony: Prevent duplicate controller connections.
HID: sony: Perform a boundry check on the sixaxis battery level index.
HID: sony: Fix work queue issues
HID: sony: Fix multi-line comment styling
...
ad295b6d5739ab24880a31be403bbc8fab62e177 01-Apr-2014 Jiri Kosina <jkosina@suse.cz> Merge branch 'for-3.15/hid-core-ll-transport-cleanup' into for-linus

Conflicts:
drivers/hid/hid-ids.h
drivers/hid/hid-sony.c
drivers/hid/i2c-hid/i2c-hid.c
ee5f68e6c2f183e6aade0e9c57af13d5eff44f2f 01-Apr-2014 Jiri Kosina <jkosina@suse.cz> Merge branch 'for-3.15/ll-driver-new-callbacks' into for-linus
96da266e77637ae892b196f377908c51fa9f2d1a 31-Mar-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
5c5b93e4be2fb52dca055e32e235453aa172500b 29-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix address in unmergeable device found events

When sending out a device found event caused by an advertising report in
the situation where we couldn't store the report as a pending one, the
code was incorrectly trying to use the address and address type from the
pending data. Since the pending data is cleared in the previous line
this causes a potentially incorrect address type and an address of
BDADDR_ANY. This patch fixes the call to use the address information
correctly from the received advertising report.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
3d5a76f08bbac55305da87f4c810279189f64297 27-Mar-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Keep msec in DISCOV_LE_TIMEOUT

To be consistent, lets use msec for this timeout as well.

Note: This define value is a minimum scan time taken from BT Core spec 4.0,
Vol 3, Part C, chapter 9.2.6

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b9a7a61e5c3e2f6316c2aedf4ca171bdee7a4804 27-Mar-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Add new debugfs parameter

With this patch it is possible to control discovery interleaved
timeout value from debugfs.

It is for fine tuning of this timeout.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
ae55f5982a8bc6adbafb337e0b781d30d5617782 27-Mar-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Keep msec in DISCOV_INTERLEAVED_TIMEOUT

Keep msec instead of jiffies in this define. This is needed by following
patch where we want this timeout to be exposed in debugfs.

Note: Value of this timeout comes from recommendation in BT Core Spec.4.0,
Vol 3, Part C, chapter 13.2.1.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8002d77ca9edbf81b81ab5154d75f7cce3d0511e 27-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary NULL check in hci_inquiry_cache_update

The ssp parameter is supposed to be a mandatory one and there are no
callers that would pass NULL to this function. Removing this unnecessary
NULL check also makes (false positive) static analyzer warnings go away.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ab0aa433e2f6c69e69b4d5a951c0b84e7b193f0d 26-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix RSSI value in device found event from disabling scan

When sending a pending device found event triggered by disabling LE
scanning we should use the stored RSSI instead of sending a zero value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
ff5cd29f5cb8de0f0bc9016874ddde467d4b0c85 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Store also RSSI for pending advertising reports

Especially in crowded environments it can become frequent that we have
to send out whatever pending event there is stored. Since user space
has its own filtering of small RSSI changes sending a 0 value will
essentially force user space to wake up the higher layers (e.g. over
D-Bus) even though the RSSI didn't actually change more than the
threshold value.

This patch adds storing also of the RSSI for pending advertising reports
so that we report an as accurate RSSI as possible when we have to send
out the stored information to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
474ee066f5abf7fc1e31ebf5865bf55d91fd83e9 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't send device found events for duplicate reports

Occasionally, during active scanning we will receive duplicate ADV_IND
reports from the same device before receiving the SCAN_RSP from them. In
order to not wake up user space unnecessarily it's better not to send
these extra events as they do not contain any new information.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
73cf71d9865ad83c2ab7d09bc71be129088e4ded 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix line splitting of mgmt_device_found parameters

The line was incorrectly split between the variable type and its name.
This patch fixes the issue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
01735bbd584593b874c2c9d85a5c0e2882a2dc06 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant NULL check

All callers of hci_inquiry_cache_update() pass a non-NULL ssp pointer to
it and even the function itself assumes in another place that the
pointer is non-NULL. Therefore, remove the redundant check.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
b9a6328f2a7f15490de7e45eabb025f8b74a81af 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Merge ADV_IND/ADV_SCAN_IND and SCAN_RSP together

To avoid too many events being sent to user space and to help parsing of
all available remote device data it makes sense for us to wait for the
scan response and send a single merged Device Found event to user space.

This patch adds a few new variables to hci_dev to track the last
received ADV_IND/ADV_SCAN_IND, i.e. those which will cause a SCAN_REQ to
be send in the case of active scanning. When the SCAN_RSP is received
the pending data is passed together with the SCAN_RSP to the
mgmt_device_found function which takes care of merging them into a
single Device Found event.

We also need a bit of extra logic to handle situations where we don't
receive a SCAN_RSP after caching some data. In such a scenario we simply
have to send out the pending data as it is and then operate on the new
report as if there was no pending data.

We also need to send out any pending data when scanning stops as
well as ensure that the storage is empty at the start of a new active
scanning session. These both cases are covered by the update to the
hci_cc_le_set_scan_enable function in this patch.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
3c857757ef6e5a4e472bd3e5c934709c2eb482af 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add directed advertising support through connect()

When we're in peripheral mode (HCI_ADVERTISING flag is set) the most
natural mapping of connect() is to perform directed advertising to the
peer device.

This patch does the necessary changes to enable directed advertising and
keeps the hci_conn state as BT_CONNECT in a similar way as is done for
central or BR/EDR connection initiation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
5d2e9fadf43e87e690bfbe607313bf9be47867e4 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add scan_rsp parameter to mgmt_device_found()

In preparation for being able to merge ADV_IND/ADV_SCAN_IND and SCAN_RSP
together into a single device found event add a second parameter to the
mgmt_device_found function. For now all callers pass NULL as this
parameters since we don't yet have storing of the last received
advertising report.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
ca5c4be716c50a245157d67b6e1dc97b2d89cdd4 25-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't send device found events during passive scanning

Passive LE scanning is only used by the kernel-internal connection
establishment procedure. It makes therefore little sense to send device
found events to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
43bb560583c9fb21bcec0cc68426a16bca8eb87a 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add error mapping for Directed Advertising Timeout

When a timeout occurs using directed advertising a 0x3c error gets
generated. Since the operation is analogous to conventional connection
creation map this to the usual EHOSTDOWN error.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ib.c
80c24ab85fc27a9683d732016bfa69033a292cf4 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix LE responder/initiator address setting

Once directed advertising is brought into the picture simply the lack of
an hci_conn object when an le_conn_complete event occurs is no longer a
reliable indication that the responder & initiator values need to be
set based on our advertising address type.

This patch moves the code for setting these values outside of the
"if (!conn)" branch and ensures that they get set for any connection
where we are in the slave role.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
9c84d1da974ee8b54fa49ae369648a0247b7cd6f 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move local identity address setting to a central place

Any time hci_conn_add is used for an LE connection we need to ensure
that the local identity address is correctly described in the src and
src_type variables. This patch moves setting these values directly into
hci_conn_add so that callers don't have to duplicate the effort
themselves.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
4408dd15d9cfcf78b819d2d4a5b43dc36056cab8 24-Mar-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use memdup_user in le_auto_conn_write()

This patch does a small code simplification replacing the tipical
kmalloc-copy_from_user sequence by memdup_user() helper.

Cc: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
4af605d8c4d3cf5170fdb40b5c77ea133761d2df 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor advertising report processing into its own function

As preparation for merging ADV_IND/ADV_SCAN_IND and SCAN_RSP together
into a single mgmt Device Found event refactor individual advertising
report handling into a separate function. This will help keep the code
more readable as more logic gets added.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e8b1ab9e6d30394e0df3e4f60bf56c4dc9bf0863 26-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix returning peer address in pending connect state

We should let user space request the peer address also in the pending
connect states, i.e. BT_CONNECT and BT_CONNECT2. There is existing user
space code that tries to do this and will fail without extending the set
of allowed states for the peer address information.

This patch adds the two states to the allowed ones in the L2CAP and
RFCOMM sock_getname functions, thereby preventing ENOTCONN from being
returned.

Reported-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
fcomm/sock.c
8396215d4865d66be9cdfcec8d135862e1fd98d1 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary assignment in SMP

The smp variable in smp_conn_security is not used anywhere before the
smp = smp_chan_create() call in the smp_conn_security function so it
makes no sense to assign any other value to it before that.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
61b3b2b6f4d754aaa84606e041556369bb5a107b 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix potential NULL pointer dereference in smp_conn_security

The smp pointer might not be initialized for jumps to the "done" label
in the smp_conn_security function. Furthermore doing the set_bit after
done might "overwrite" a previous value of the flag in case pairing was
already in progress. This patch moves the call to set_bit before the
label so that it is only done for a newly created smp context (as
returned by smp_chan_create).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
1d98bf4fda5f76563a9718b59e3ac5a65fd36a51 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove LTK re-encryption procedure

Due to several devices being unable to handle this procedure reliably
(resulting in forced disconnections before pairing completes) it's
better to remove it altogether.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
a82505c7bcbc1f8cce28d092aba01f62c7b85fa3 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't try to confirm locally initiated SMP pairing

In the case that the just-works model would be triggered we only want to
confirm remotely initiated pairings (i.e. those triggered by a Security
Request or Pairing Request). This patch adds the necessary check to the
tk_request function to fall back to the JUST_WORKS method in the case of
a locally initiated pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
edca792c036f48b15ee4d70045fb6722e8797281 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add SMP flag to track which side is the initiator

For remotely initiated just-works pairings we want to show the user a
confirmation dialog for the pairing. However, we can only know which
side was the initiator by tracking which side sends the first Security
Request or Pairing Request PDU. This patch adds a new SMP flag to
indicate whether our side was the initiator for the pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
4eb65e667ba7070e4798448f5ab8dbbaa4505db0 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP confirmation callback handling

In the case that a local pairing confirmation (JUST_CFM) has been
selected as the method we need to use the user confirm request mgmt
event for it with the confirm_hint set to 1 (to indicate confirmation
without any specific passkey value). Without this (if passkey_notify was
used) the pairing would never proceed. This patch adds the necessary
call to mgmt_user_confirm_request in this scenario.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
81d0c8ad7163d9860374e38a75e2e99d00ac8c17 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing cmd_status handler for LE_Start_Encryption

It is possible that the HCI_LE_Start_Encryption command fails in an
early stage and triggers a command status event with the failure code.
In such a case we need to properly notify the hci_conn object and
cleanly bring the connection down. This patch adds the missing command
status handler for this HCI command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0a66cf203676f794084c6a97189eb41565bfd6aa 24-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix potential NULL pointer dereference in SMP

If a sudden disconnection happens the l2cap_conn pointer may already
have been cleaned up by the time hci_conn_security gets called,
resulting in the following oops if we don't have a proper NULL check:

BUG: unable to handle kernel NULL pointer dereference at 000000c8
IP: [<c132e2ed>] smp_conn_security+0x26/0x151
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
CPU: 1 PID: 673 Comm: memcheck-x86-li Not tainted 3.14.0-rc2+ #437
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: f0ef0520 ti: f0d6a000 task.ti: f0d6a000
EIP: 0060:[<c132e2ed>] EFLAGS: 00010246 CPU: 1
EIP is at smp_conn_security+0x26/0x151
EAX: f0ec1770 EBX: f0ec1770 ECX: 00000002 EDX: 00000002
ESI: 00000002 EDI: 00000000 EBP: f0d6bdc0 ESP: f0d6bda0
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 80050033 CR2: 000000c8 CR3: 30f0f000 CR4: 00000690
Stack:
f4f55000 00000002 f0d6bdcc c1097a2b c1319f40 f0ec1770 00000002 f0d6bdd0
f0d6bde8 c1312a82 f0d6bdfc c1312a82 c1319f84 00000008 f4d81c20 f0e5fd86
f0ec1770 f0d6bdfc f0d6be28 c131be3b c131bdc1 f0d25270 c131be3b 00000008
Call Trace:
[<c1097a2b>] ? __kmalloc+0x118/0x128
[<c1319f40>] ? mgmt_pending_add+0x49/0x9b
[<c1312a82>] hci_conn_security+0x4a/0x1dd
[<c1312a82>] ? hci_conn_security+0x4a/0x1dd
[<c1319f84>] ? mgmt_pending_add+0x8d/0x9b
[<c131be3b>] pair_device+0x1e1/0x206
[<c131bdc1>] ? pair_device+0x167/0x206
[<c131be3b>] ? pair_device+0x1e1/0x206
[<c131ed44>] mgmt_control+0x275/0x2d6

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
533553f8738184bcf957d97fed9eb4d5f023e4a7 21-Mar-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track current configured LE scan type parameter

The LE scan type paramter defines if active scanning or passive scanning
is in use. Track the currently set value so it can be used for decision
making from other pieces in the core.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
49c0ca17ee8dd3530f688052d4eb2ae6d3e55119 21-Mar-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
61b1a7fbda6f761ebe16a62124578ca0779d9365 19-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix address value for early disconnection events

We need to ensure that we do not send events to user space with the
identity address if we have not yet notified user space of the IRK. The
code was previously trying to handle this for the mgmt_pair_device
response (which worked well enough) but this is not the only connection
related event that might be sent to user space before pairing is
successful: another important event is Device Disconnected.

The issue can actually be solved more simply than the solution
previously used for mgmt_pair_device. Since we do have the identity
address tracked as part of the remote IRK struct we can just copy it
over from there to the hci_conn struct once we've for real sent the mgmt
event for the new IRK.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
mp.c
39adbffe4b16285c54016d3e64471396354ae49f 20-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix passkey endianess in user_confirm and notify_passkey

The passkey_notify and user_confirm functions in mgmt.c were expecting
different endianess for the passkey, leading to a big endian bug and
sparse warning in recently added SMP code. This patch converts both
functions to expect host endianess and do the conversion to little
endian only when assigning to the mgmt event struct.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
mp.c
40b552aa5a0bfa785bc7ddb5c2d7965b1e0bb08d 19-Mar-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enforce strict Secure Connections Only mode security

In Secure Connections Only mode, it is required that Secure Connections
is used for pairing and that the link key is encrypted with AES-CCM using
a P-256 authenticated combination key. If this is not the case, then new
connection shall be refused or existing connections shall be dropped.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_event.c
4e7b2030c452e5d885d36d4f44ef33d6ceb9759a 19-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix Pair Device response parameters for pairing failure

It is possible that pairing fails after we've already received remote
identity information. One example of such a situation is when
re-encryption using the LTK fails. In this case the hci_conn object has
already been updated with the identity address but user space does not
yet know about it (since we didn't notify it of the new IRK yet).

To ensure user space doesn't get a Pair Device command response with an
unknown address always use the same address in the response as was used
for the original command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
01ad34d267475ac3387d7ab803a2225b392dae91 19-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP user passkey notification mgmt event

When performing SMP pairing with MITM protection one side needs to
enter the passkey while the other side displays to the user what needs
to be entered. Nowhere in the SMP specification does it say that the
displaying side needs to any kind of confirmation of the passkey, even
though a code comment in smp.c implies this.

This patch removes the misleading comment and converts the code to use
the passkey notification mgmt event instead of the passkey confirmation
mgmt event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
5ed884d765a240593c721711eb9e6d24ceba5e8b 19-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Increase SMP re-encryption delay to 500ms

In some cases the current 250ms delay is not enough for the remote to
receive the keys, as can be witnessed by the following log:

> ACL Data RX: Handle 64 flags 0x02 dlen 21 [hci1] 231.414217
SMP: Signing Information (0x0a) len 16
Signature key: 555bb66b7ab3abc9d5c287c97fe6eb29
< ACL Data TX: Handle 64 flags 0x00 dlen 21 [hci1] 231.414414
SMP: Encryption Information (0x06) len 16
Long term key: 2a7cdc233c9a4b1f3ed31dd9843fea29
< ACL Data TX: Handle 64 flags 0x00 dlen 15 [hci1] 231.414466
SMP: Master Identification (0x07) len 10
EDIV: 0xeccc
Rand: 0x322e0ef50bd9308a
< ACL Data TX: Handle 64 flags 0x00 dlen 21 [hci1] 231.414505
SMP: Signing Information (0x0a) len 16
Signature key: bbda1b2076e2325aa66fbcdd5388f745
> HCI Event: Number of Completed Packets (0x13) plen 5 [hci1] 231.483130
Num handles: 1
Handle: 64
Count: 2
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28 [hci1] 231.664211
Handle: 64
Random number: 0x5052ad2b75fed54b
Encrypted diversifier: 0xb7c2
Long term key: a336ede66711b49a84bde9b41426692e
> HCI Event: Command Status (0x0f) plen 4 [hci1] 231.666937
LE Start Encryption (0x08|0x0019) ncmd 1
Status: Success (0x00)
> HCI Event: Number of Completed Packets (0x13) plen 5 [hci1] 231.712646
Num handles: 1
Handle: 64
Count: 1
> HCI Event: Disconnect Complete (0x05) plen 4 [hci1] 232.562587
Status: Success (0x00)
Handle: 64
Reason: Remote User Terminated Connection (0x13)

As can be seen, the last key (Signing Information) is sent at 231.414505
but the completed packets event for it comes only at 231.712646,
i.e. roughly 298ms later.

To have a better margin of error this patch increases the delay to
500ms.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.h
18e4aeb9b8bacafd3deebd4763c0f21a9934ed72 19-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify logic when checking SMP_FLAG_TK_VALID

This is a trivial coding style simplification by instead of having an
extra early return to instead revert the if condition and do the single
needed queue_work() call there.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
2e2336445e696805b40d6a13cf25f26d49e20069 18-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix MITM flag when initiating SMP pairing

The pairing process initiated through mgmt sets the conn->auth_type
value regardless of BR/EDR or LE pairing. This value will contain the
MITM flag if the local IO capability allows it. When sending the SMP
pairing request we should check the value and ensure that the MITM bit
gets correctly set in the bonding flags.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
943a732ab6440f4edbccd8cd9044a588b35059a0 17-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix smp_e byte order to be consistent with SMP specification

The SMP specification is written with the assumption that both key
information, plaintextData and encryptedData follow the same little
endian byte ordering as the rest of SMP.

Since the kernel crypto routines expect big endian data the code has had
to do various byte swapping tricks to make the behavior as expected,
however the swapping has been scattered all around the place.

This patch centralizes the byte order swapping into the smp_e function
by making its public interface match what the other SMP functions expect
as per specification. The benefit is vastly simplified calls to smp_e.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
66bed1a24ec28e52fc2c7c0a2aa945a893bfa9bc 17-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix const declaration for swap function src parameter

To make it possible to (correctly) pass data declared as const as the
src parameter to the swap56 and swap128 functions declare this parameter
also as const.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
fdcc4beccb52f752799978c4da0dcd0faadbdcd4 14-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating SMP remote key distribution information

When performing pairing using SMP the remote may clear any key
distribution bits it wants in its pairing response. We must therefore
update our local variable accordingly, otherwise we might get stuck
waiting for keys that will never come.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
6fd182028c43baf1c7d017d52b0134ecadbdc447 09-Mar-2014 Benjamin Tissoires <benjamin.tissoires@redhat.com> HID: remove hid_output_raw_report transport implementations

Nobody calls hid_output_raw_report anymore, and nobody should.
We can now remove the various implementation in the different
transport drivers and the declarations.

Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
42775a34d23027b19e984956a539448f5e7ff075 13-Mar-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
drivers/net/wireless/ath/ath9k/recv.c
52d3ef5c2537d1b892d5fefff754b995394d7be3 13-Mar-2014 Arnd Bergmann <arnd@arndb.de> Bluetooth: make sure 6LOWPAN_IPHC is built-in if needed

Commit 975508879 "Bluetooth: make bluetooth 6lowpan as an option"
ensures that 6LOWPAN_IPHC is turned on when we have BT_6LOWPAN
enabled in Kconfig, but it allows building the IPHC code as
a loadable module even if the entire Bluetooth stack is built-in,
and that causes a link error.

We can solve that by moving the 'select' statement into CONFIG_BT,
which is a "tristate" option to enforce that 6LOWPAN_IPHC can
only be a module if BT also is a module.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
dcf4adbfdc7ad14ca50c1133f93f998c78493c2d 12-Mar-2014 Joe Perches <joe@perches.com> Bluetooth: Convert uses of __constant_<foo> to <foo>

The use of __constant_<foo> has been unnecessary for quite awhile now.

Make these uses consistent with the rest of the kernel.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
2cap_core.c
2cap_sock.c
gmt.c
fcomm/core.c
co.c
mp.c
4340a124dea6a6a66c7889261574a48e57e8782a 10-Mar-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Enable duplicates filter in background scan

To avoid flooding the host with useless advertising reports during
background scan, we enable the duplicates filter from controller.

However, enabling duplicates filter requires a small change in
background scan routine in order to fix the following scenario:
1) Background scan is running.
2) A device disconnects and starts advertising.
3) Before host gets the disconnect event, the advertising is reported
to host. Since there is no pending LE connection at that time,
nothing happens.
4) Host gets the disconnection event and adds a pending connection.
5) No advertising is reported (since controller is filtering) and the
connection is never established.

So, to address this scenario, we should always restart background scan
to unsure we don't miss any advertising report (due to duplicates
filter).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
27539bc441c833c958de1d0c04212cb78b2a08b0 10-Mar-2014 Andrew Earl <andrewx.earl@intel.com> Bluetooth: Fix aborting eSCO connection in case of error 0x20

Add additional error case to attempt alternative configuration for SCO. Error
occurs with Intel BT controller where fallback is not attempted as the error
0x20 Unsupported LMP Parameter value is not included in the list of errors
where a retry should be attempted.
The problem also affects PTS test case TC_HF_ACS_BV_05_I.

See the HCI log below for details:
< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 256 voice setting 0x0060 ptype 0x0380
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Max Slots Change (0x1b) plen 3
handle 256 slots 1
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x20 handle 0 bdaddr 00:80:98:09:0B:19 type eSCO
Error: Unsupported LMP Parameter Value
< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 256 voice setting 0x0060 ptype 0x0380
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Max Slots Change (0x1b) plen 3
handle 256 slots 5
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x20 handle 0 bdaddr 00:80:98:09:0B:19 type eSCO
Error: Unsupported LMP Parameter Value
< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 256 voice setting 0x0060 ptype 0x03c8
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Max Slots Change (0x1b) plen 3
handle 256 slots 1
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x00 handle 257 bdaddr 00:80:98:09:0B:19 type eSCO
Air mode: CVSD

See btmon log for further details:
> HCI Event (0x0f) plen 4 [hci0] 44.888063
Setup Synchronous Connection (0x01|0x0028) ncmd 1
Status: Success (0x00)
> HCI Event (0x1b) plen 3 [hci0] 44.893064
Handle: 256
Max slots: 1
> HCI Event (0x2c) plen 17 [hci0] 44.942080
Status: Unsupported LMP Parameter Value (0x20)
Handle: 0
Address: 00:1B:DC:06:04:B0 (OUI 00-1B-DC)
Link type: eSCO (0x02)
Transmission interval: 0x00
Retransmission window: 0x01
RX packet length: 0
TX packet length: 0
Air mode: CVSD (0x02)
> HCI Event (0x1b) plen 3 [hci0] 44.948054
Handle: 256
Max slots: 5

Signed-off-by: Andrew Earl <andrewx.earl@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
97550887973d04e344f5ccee392d7650d01f8f69 04-Mar-2014 Alexander Aring <alex.aring@gmail.com> Bluetooth: make bluetooth 6lowpan as an option

Currently you can have bluetooth 6lowpan without ipv6 enabled. This
doesn't make any sense. With this patch you can disable/enable bluetooth
6lowpan support at compile time.

The current bluetooth 6lowpan implementation doesn't check the return
value of 6lowpan function. Nevertheless I added -EOPNOTSUPP as return value
if 6lowpan bluetooth is disabled.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.h
config
akefile
53ac6ab612456a13bf0f6bad89c1503616e4de3b 10-Mar-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make LTK and CSRK only persisent when bonding

In case the pairable option has been disabled, the pairing procedure
does not create keys for bonding. This means that these generated keys
should not be stored persistently.

For LTK and CSRK this is important to tell userspace to not store these
new keys. They will be available for the lifetime of the device, but
after the next power cycle they should not be used anymore.

Inform userspace to actually store the keys persistently only if both
sides request bonding.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
mp.c
7ee4ea3692f20b87b0e0d3884d5b2d22ec1a2df0 09-Mar-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for handling signature resolving keys

The connection signature resolving key (CSRK) is used for attribute
protocol signed write procedures. This change generates a new local
key during pairing and requests the peer key as well.

Newly generated key and received key will be provided to userspace
using the New Signature Resolving Key management event.

The Master CSRK can be used for verification of remote signed write
PDUs and the Slave CSRK can be used for sending signed write PDUs
to the remote device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
mp.c
mp.h
0753c182ef11e27f8f3dea2dc9ca4bcf40019eb5 22-Dec-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix skb allocation check for A2MP

vtable's method alloc_skb() needs to return a ERR_PTR in case of err and
not a NULL.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2606ecbc4880b8641b5e455c80f4bd72c223ce86 07-Mar-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix expected key count debug logs

The debug logs for reporting a discrepancy between the expected amount
of keys and the actually received amount of keys got these value mixed
up. This patch fixes the issue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
cefc8c8a7c9e4867c45407f7f9a44fe80c5ea58a 05-Mar-2014 Alexander Aring <alex.aring@gmail.com> 6lowpan: move 6lowpan header to include/net

This header is used by bluetooth and ieee802154 branch. This patch
move this header to the include/net directory to avoid a use of a
relative path in include.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
lowpan.c
5981a8821b774ada0be512fd9bad7c241e17657e 25-Jul-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Fix removing Long Term Key

This patch fixes authentication failure on LE link re-connection when
BlueZ acts as slave (peripheral). LTK is removed from the internal list
after its first use causing PIN or Key missing reply when re-connecting
the link. The LE Long Term Key Request event indicates that the master
is attempting to encrypt or re-encrypt the link.

Pre-condition: BlueZ host paired and running as slave.
How to reproduce(master):

1) Establish an ACL LE encrypted link
2) Disconnect the link
3) Try to re-establish the ACL LE encrypted link (fails)

> HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 64
Role: Slave (0x01)
...
@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
> HCI Event: LE Meta Event (0x3e) plen 13
LE Long Term Key Request (0x05)
Handle: 64
Random number: 875be18439d9aa37
Encryption diversifier: 0x76ed
< HCI Command: LE Long Term Key Request Reply (0x08|0x001a) plen 18
Handle: 64
Long term key: 2aa531db2fce9f00a0569c7d23d17409
> HCI Event: Command Complete (0x0e) plen 6
LE Long Term Key Request Reply (0x08|0x001a) ncmd 1
Status: Success (0x00)
Handle: 64
> HCI Event: Encryption Change (0x08) plen 4
Status: Success (0x00)
Handle: 64
Encryption: Enabled with AES-CCM (0x01)
...
@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 3
< HCI Command: LE Set Advertise Enable (0x08|0x000a) plen 1
Advertising: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4
LE Set Advertise Enable (0x08|0x000a) ncmd 1
Status: Success (0x00)
> HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete (0x01)
Status: Success (0x00)
Handle: 64
Role: Slave (0x01)
...
@ Device Connected: 00:02:72:DC:29:C9 (1) flags 0x0000
> HCI Event: LE Meta Event (0x3e) plen 13
LE Long Term Key Request (0x05)
Handle: 64
Random number: 875be18439d9aa37
Encryption diversifier: 0x76ed
< HCI Command: LE Long Term Key Request Neg Reply (0x08|0x001b) plen 2
Handle: 64
> HCI Event: Command Complete (0x0e) plen 6
LE Long Term Key Request Neg Reply (0x08|0x001b) ncmd 1
Status: Success (0x00)
Handle: 64
> HCI Event: Disconnect Complete (0x05) plen 4
Status: Success (0x00)
Handle: 64
Reason: Authentication Failure (0x05)
@ Device Disconnected: 00:02:72:DC:29:C9 (1) reason 0

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
81ad6fd9698f659dbabdc6cd3e1667a98eb2be3b 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary stop_scan_complete function

The stop_scan_complete function was used as an intermediate step before
doing the actual connection creation. Since we're using hci_request
there's no reason to have this extra function around, i.e. we can simply
put both HCI commands into the same request.

The single task that the intermediate function had, i.e. indicating
discovery as stopped is now taken care of by a new
HCI_LE_SCAN_INTERRUPTED flag which allows us to do the discovery state
update when the stop scan command completes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
317ac8cb3f9fb58b9ec5764b766a449004ab2a62 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix trying to disable scanning twice

The discovery process has a timer for disabling scanning, however
scanning might be disabled through other means too like the auto-connect
process. We should therefore ensure that the timer is never active
after sending a HCI command to disable scanning.

There was some existing code in stop_scan_complete trying to avoid the
timer when a connect request interrupts a discovery procedure, but the
other way around was not covered. This patch covers both scenarios by
canceling the timer as soon as we get a successful command complete for
the disabling HCI command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
e3098be40bbde0fdd5fcfa6bf28491db421d333a 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Delay LTK encryption to let remote receive all keys

Some devices may refuse to re-encrypt with the LTK if they haven't
received all our keys yet. This patch adds a 250ms delay before
attempting re-encryption with the LTK.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
38ccdc93326f61b84734028e586ed522a53b733a 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Re-encrypt link after receiving an LTK

It's not strictly speaking required to re-encrypt a link once we receive
an LTK since the connection is already encrypted with the STK. However,
re-encrypting with the LTK allows us to verify that we've received an
LTK that actually works.

This patch updates the SMP code to request encrypting with the LTK in
case we're in master role and waits until the key refresh complete event
before notifying user space of the distributed keys.

A new flag is also added for the SMP context to ensure that we
re-encryption only once in case of multiple calls to smp_distribute_keys.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
9489eca4ab2fd5d9bbf3bab992168cc8107fc3e9 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add timeout for LE connection attempts

LE connection attempts do not have a controller side timeout in the same
way as BR/EDR has (in form of the page timeout). Since we always do
scanning before initiating connections the attempts are always expected
to succeed in some reasonable time.

This patch adds a timer which forces a cancellation of the connection
attempt within 20 seconds if it has not been successful by then. This
way we e.g. ensure that mgmt_pair_device times out eventually and gives
an error response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
b1cd5fd937e692276ac6c085684afb16a4e6e798 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hdev->init/resp_addr values for smp_c1 function

Now that we have nicely tracked values of the initiator and responder
address information we can pass that directly to the smp_c1 function
without worrying e.g. about who initiated the connection. This patch
updates the two places in smp.c to use the new variables.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
cb1d68f7a337142e283ef7fc78793a57ffb4cdc3 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track LE initiator and responder address information

For SMP we need the local and remote addresses (and their types) that
were used to establish the connection. These may be different from the
Identity Addresses or even the current RPA. To guarantee that we have
this information available and it is correct track these values
separately from the very beginning of the connection.

For outgoing connections we set the values as soon as we get a
successful command status for HCI_LE_Create_Connection (for which the
patch adds a command status handler function) and for incoming
connections as soon as we get a LE Connection Complete HCI event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
b46e00308929cc0317a021a7ac050790f023b1ca 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating connection state to BT_CONNECT too early

We shouldn't update the hci_conn state to BT_CONNECT until the moment
that we're ready to send the initiating HCI command for it. If the
connection has the BT_CONNECT state too early the code responsible for
updating the local random address may incorrectly think there's a
pending connection in progress and refuse to update the address.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
8d97250ea2231736225f2e99a91adb266eedfcbe 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add protections for updating local random address

Different controllers behave differently when HCI_Set_Random_Address is
called while they are advertising or have a HCI_LE_Create_Connection in
progress. Some take the newly written address into use for the pending
operation while others use the random address that we had at the time
that the operation started.

Due to this undefined behavior and for the fact that we want to reliably
determine the initiator address of all connections for the sake of SMP
it's best to simply prevent the random address update if we have these
problematic operations in progress.

This patch adds a set_random_addr() helper function for the use of
hci_update_random_address which contains the necessary checks for
advertising and ongoing LE connections.

One extra thing we need to do is to clear the HCI_ADVERTISING flag in
the enable_advertising() function before sending any commands. Since
re-enabling advertising happens by calling first disable_advertising()
and then enable_advertising() all while having the HCI_ADVERTISING flag
set. Clearing the flag lets the set_random_addr() function know that
it's safe to write a new address at least as far as advertising is
concerned.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
759331d7cc660be17bcdc5df53f196135f9dfaf6 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing SMP keys if pairing fails

If SMP fails we should not leave any keys (LTKs or IRKs) hanging around
the internal lists. This patch adds the necessary code to
smp_chan_destroy to remove any keys we may have in case of pairing
failure.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
fe39c7b2dacf7fd4dcddc26704d01315ab92b7cb 28-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use __le64 type for LE random numbers

The random numbers in Bluetooth Low Energy are 64-bit numbers and should
also be little endian since the HCI specification is little endian.

Change the whole Low Energy pairing to use __le64 instead of a byte
array.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
ci_event.c
gmt.c
mp.c
mp.h
a3172b7eb4a2719711187cfca12097d2326e85a7 28-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add timer to force power off

If some of the cleanup commands caused by mgmt_set_powered(off) never
complete we should still force the adapter to be powered down. This is
rather easy to do since hdev->power_off is already a delayed work
struct. This patch schedules this delayed work if at least one HCI
command was sent by the cleanup procedure.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c9910d0fb4fc2ede468b26d45a1d50c309897770 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix disconnecting connections in non-connected states

When powering off and disconnecting devices we should also consider
connections which have not yet reached the BT_CONNECTED state. They may
not have a valid handle yet and simply sending a HCI_Disconnect will not
work.

This patch updates the code to either disconnect, cancel connection
creation or reject incoming connection creation based on the current
conn->state value as well as the link type in question.

When the power off procedure results in canceling connection attempts
instead of disconnecting connections we get a connection failed event
instead of a disconnection event. Therefore, we also need to have extra
code in the mgmt_connect_failed function to check if we should proceed
with the power off or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
0f36b589e4eea0a0a27349992def2ea7beb45182 28-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track LE white list modification via HCI commands

When the LE white list gets changed via HCI commands make sure that
the internal storage of the white list entries gets updated.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
d2ab0ac18df8735fb1431e63446e803dcd2e7326 28-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for storing LE white list entries

The current LE white list entries require storing in the HCI controller
structure. So provide a storage and access functions for it. In addition
export the current list via debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
747d3f030190e58373849839c7757d3d58208b03 28-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Clear all LE white list entries when powering controller

When starting up a controller make sure that all LE white list entries
are cleared. Normally the HCI Reset takes care of this. This is just
in case no HCI Reset has been executed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
c9507490ab1769a808fcb4af1a27bd738f4b0407 28-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make hci_blacklist_clear function static

The hci_blacklist_clear function is not used outside of hci_core.c and
can be made static.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
a1f4c3188bb4d51a41d2026ee08a578f56c61e47 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add hci_copy_identity_address convenience function

The number of places needing the local Identity Address are starting to
grow so it's better to have a single place for the logic of determining
it. This patch adds a convenience function for getting the Identity
Address and updates the two current places needing this to use it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
56ed2cb88c7370d5aa88c92a2a0b1cb92c0979b9 27-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add tracking of advertising address type

To know the real source address for incoming connections (needed e.g.
for SMP) we should store the own_address_type parameter that was used
for the last HCI_LE_Write_Advertising_Parameters command. This patch
adds a proper command complete handler for the command and stores the
address type in a new adv_addr_type variable in the hci_dev struct.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
d3a2541d83dbdb4dd35eb34ac45b036acde278c6 27-Feb-2014 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Fix response on confirm_name

According to mgmt-api.txt, in case of confirm name command,
cmd_complete should be always use as a response. Not command status
as it is now for failures.
Using command complete on failure is actually better as client might
be interested in device address for which confirm name failed.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
dd2ef8e274b265a0af1cc0d3ddafd361fc3a00a6 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Update background scan parameters

If new scanning parameters are set while background scan is running,
we should restart background scanning so these parameters are updated.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8ef30fd3d1f08f9ffdf2495907f50f44f2101cd3 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Create hci_req_add_le_passive_scan helper

This patches creates the public hci_req_add_le_passive_scan helper so
it can be re-used outside hci_core.c in the next patch.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
7d474e06ef8ee3941a4a0dcb824b8e3006f25d3e 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add le_auto_conn file on debugfs

This patch adds to debugfs the le_auto_conn file. This file will be
used to test LE auto connection infrastructure.

This file accept writes in the following format:
"add <address> <address_type> [auto_connect]"
"del <address> <address_type>"
"clr"

The <address type> values are:
* 0 for public address
* 1 for random address

The [auto_connect] values are (for more details see struct hci_
conn_params):
* 0 for disabled (default)
* 1 for always
* 2 for link loss

So for instance, if you want the kernel autonomously establishes
connections with device AA:BB:CC:DD:EE:FF (public address) every
time the device enters in connectable mode (starts advertising),
you should run the command:
$ echo "add AA:BB:CC:DD:EE:FF 0 1" > /sys/kernel/debug/bluetooth/hci0/le_auto_conn

To delete the connection parameters for that device, run the command:
$ echo "del AA:BB:CC:DD:EE:FF 0" > /sys/kernel/debug/bluetooth/hci0/le_auto_conn

To clear the connection parameters list, run the command:
$ echo "clr" > /sys/kernel/debug/bluetooth/hci0/le_auto_conn

Finally. to get the list of connection parameters configured in kernel,
read the le_auto_conn file:
$ cat /sys/kernel/debug/bluetooth/hci0/le_auto_conn

This file is created only if LE is enabled.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
5b906a84a5b3458d810a9faab74783525f4a84d7 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Support resolvable private addresses

Only identity addresses are inserted into hdev->pend_le_conns. So,
in order to support resolvable private addresses in auto connection
mechanism, we should resolve the address before checking for pending
connections.

Thus, this patch adds an extra check in check_pending_le_conn() and
updates 'addr' and 'addr_type' variables before hci_pend_le_conn_
lookup().

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a9b0a04c2aac1e6e41e254221926bdce75321f55 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Connection parameters and resolvable address

We should only accept connection parameters from identity addresses
(public or random static). Thus, we should check the address type
in hci_conn_params_add().

Additionally, since the IRK is removed during unpair, we should also
remove the connection parameters from that device.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
6046dc3e0602256b9941241dfd6b2e4824999b01 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Auto connection and power on

When hdev is closed (e.g. Mgmt power off command, RFKILL or controller
is reset), the ongoing active connections are silently dropped by the
controller (no Disconnection Complete Event is sent to host). For that
reason, the devices that require HCI_AUTO_CONN_ALWAYS are not added to
hdev->pend_le_conns list and they won't auto connect.

So to fix this issue, during hdev closing, we remove all pending LE
connections. After adapter is powered on, we add a pending LE connection
for each HCI_AUTO_CONN_ALWAYS address.

This way, the auto connection mechanism works propely after a power
off and power on sequence as well as RFKILL block/unblock.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
c54c3860e3dbaa68128dbb288b2806dd86c230cc 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Temporarily stop background scanning on discovery

If the user sends a mgmt start discovery command while the background
scanning is running, we should temporarily stop it. Once the discovery
finishes, we start the background scanning again.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
cef952ce760a1113207b277af65a6ea2644a1b4a 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Connection parameters and auto connection

This patch modifies hci_conn_params_add() and hci_conn_params_del() so
they also add/delete pending LE connections according to the auto_
connect option. This way, background scan is automatically triggered/
untriggered when connection parameters are added/removed.

For instance, when a new connection parameters with HCI_AUTO_CONN_ALWAYS
option is added and we are not connected to the device, we add a pending
LE connection for that device.

Likewise, when the connection parameters are updated we add or delete
a pending LE connection according to its new auto_connect option.

Finally, when the connection parameter is deleted we also delete the
pending LE connection (if any).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
9fcb18ef3acb51e54b6bca6d2d803676ac86813d 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce LE auto connect options

This patch introduces the LE auto connection options: HCI_AUTO_CONN_
ALWAYS and HCI_AUTO_CONN_LINK_LOSS. Their working mechanism are
described as follows:

The HCI_AUTO_CONN_ALWAYS option configures the kernel to always re-
establish the connection, no matter the reason the connection was
terminated. This feature is required by some LE profiles such as
HID over GATT, Health Thermometer and Blood Pressure. These profiles
require the host autonomously connect to the device as soon as it
enters in connectable mode (start advertising) so the device is able
to delivery notifications or indications.

The BT_AUTO_CONN_LINK_LOSS option configures the kernel to re-
establish the connection in case the connection was terminated due
to a link loss. This feature is required by the majority of LE
profiles such as Proximity, Find Me, Cycling Speed and Cadence and
Time.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
a4790dbd43d1617b09d57e96494fde5a4b01980a 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce LE auto connection infrastructure

This patch introduces the LE auto connection infrastructure which
will be used to implement the LE auto connection options.

In summary, the auto connection mechanism works as follows: Once the
first pending LE connection is created, the background scanning is
started. When the target device is found in range, the kernel
autonomously starts the connection attempt. If connection is
established successfully, that pending LE connection is deleted and
the background is stopped.

To achieve that, this patch introduces the hci_update_background_scan()
which controls the background scanning state. This function starts or
stops the background scanning based on the hdev->pend_le_conns list. If
there is no pending LE connection, the background scanning is stopped.
Otherwise, we start the background scanning.

Then, every time a pending LE connection is added we call hci_update_
background_scan() so the background scanning is started (in case it is
not already running). Likewise, every time a pending LE connection is
deleted we call hci_update_background_scan() so the background scanning
is stopped (in case this was the last pending LE connection) or it is
started again (in case we have more pending LE connections). Finally,
we also call hci_update_background_scan() in hci_le_conn_failed() so
the background scan is restarted in case the connection establishment
fails. This way the background scanning keeps running until all pending
LE connection are established.

At this point, resolvable addresses are not support by this
infrastructure. The proper support is added in upcoming patches.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
77a77a30ae893a63467c51e45de18d0bdfa612e4 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce hdev->pend_le_conn list

This patch introduces the hdev->pend_le_conn list which holds the
device addresses the kernel should autonomously connect. It also
introduces some helper functions to manipulate the list.

The list and helper functions will be used by the next patch which
implements the LE auto connection infrastructure.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
6f77d8c757523f675679d845ff0e15d3276a168a 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Move address type conversion to outside hci_connect_le

This patch moves address type conversion (L2CAP address type to HCI
address type) to outside hci_connect_le. This way, we avoid back and
forth address type conversion in a comming patch.

So hci_connect_le() now expects 'dst_type' parameter in HCI address
type convention.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap_core.c
gmt.c
04a6c5898e8cbb46313b7d425001b701f0fa4e3d 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor HCI connection code

hci_connect() is a very simple and useless wrapper of hci_connect_acl
and hci_connect_le functions. Addtionally, all places where hci_connect
is called the link type value is passed explicitly. This way, we can
safely delete hci_connect, declare hci_connect_acl and hci_connect_le
in hci_core.h and call them directly.

No functionality is changed by this patch.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap_core.c
gmt.c
c99ed8343cdf84279f4d1937d25a3b644a14ed0d 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unused function

This patch removes hci_create_le_conn() since it is not used anymore.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2acf3d9066b36e1b05db42bfe43152eee07a5e9e 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Stop scanning on LE connection

Some LE controllers don't support scanning and creating a connection
at the same time. So we should always stop scanning in order to
establish the connection.

Since we may prematurely stop the discovery procedure in favor of
the connection establishment, we should also cancel hdev->le_scan_
disable delayed work and set the discovery state to DISCOVERY_STOPPED.

This change does a small improvement since it is not mandatory the
user stops scanning before connecting anymore. Moreover, this change
is required by upcoming LE auto connection mechanism in order to work
properly with controllers that don't support background scanning and
connection establishment at the same time.

In future, we might want to do a small optimization by checking if
controller is able to scan and connect at the same time. For now,
we want the simplest approach so we always stop scanning (even if
the controller is able to carry out both operations).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
06c053fb54c10be49ef30fc9b6b01e42cc9a1b61 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Declare le_conn_failed in hci_core.h

This patch adds the "hci_" prefix to le_conn_failed() helper and
declares it in hci_core.h so it can be reused in hci_event.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
b1efcc2870687ec3e3c51fa72210b8e4fa465df8 27-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Create hci_req_add_le_scan_disable helper

This patch moves stop LE scanning duplicate code to one single
place and reuses it. This will avoid more duplicate code in
upcoming patches.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
4bd6d38e7f58b163138d3fea8fa135de523bfb92 26-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded "force" parameter from smp_distribute_keys()

Now that to-be-received keys are properly tracked we no-longer need the
"force" parameter to smp_distribute_keys(). It was essentially acting as
an indicator whether all keys have been received, but now it's just
redundant together with smp->remote_key_dist.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
mp.c
mp.h
efabba37fec4cf093fedcfcba443d0f04b606eb4 26-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify logic for checking for SMP completion

Now that smp->remote_key_dist is tracking the keys we're still waiting
for we can use it to simplify the logic for checking whether we're done
with key distribution or not. At the same time the reliance on the
"force" parameter of smp_distribute_keys goes away and it can completely
be removed in a subsequent patch.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
9747a9f31756362e1b9d0b2347c25ae5120c3319 26-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track not yet received keys in SMP

To make is easier to track which keys we've received and which ones
we're still waiting for simply clear the corresponding key bits from
smp->remote_key_dist as they get received. This will allow us to
simplify the code for checking for SMP completion in subsequent patches.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
a9a58f861218aee89fbe8ed4db054a7eee6f58c2 25-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Ignore IRKs with no Identity Address

The Core Specification (4.1) leaves room for sending an SMP Identity
Address Information PDU with an all-zeros BD_ADDR value. This
essentially means that we would not have an Identity Address for the
device and the only means of identifying it would be the IRK value
itself.

Due to lack of any known implementations behaving like this it's best to
keep our implementation as simple as possible as far as handling such
situations is concerned. This patch updates the Identity Address
Information handler function to simply ignore the IRK received from such
a device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
a4858cb942b9afa57c1220aa5d9b536a0d7ec623 25-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix advertising address type when toggling connectable

When the connectable setting is toggled using mgmt_set_connectable the
HCI_CONNECTABLE flag will only be set once the related HCI commands
succeed. When determining what kind of advertising to do we need to
therefore also check whether there is a pending Set Connectable command
in addition to the current flag value.

The enable_advertising function was already taking care of this for the
advertising type with the help of the get_adv_type function, but was
failing to do the same for the address type selection. This patch
converts the get_adv_type function to be more generic in that it returns
the expected connectable state and updates the enable_advertising
function to use the return value both for the advertising type as well
as the advertising address type.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ede81a2a1250dc9296a2b9bf384bba4e336a02e2 25-Feb-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Fix NULL pointer dereference when sending data

When trying to allocate skb for new PDU, l2cap_chan is unlocked so we
can sleep waiting for memory as otherwise there's possible deadlock as
fixed in e454c84464. However, in a6a5568c03 lock was moved from socket
to channel level and it's no longer safe to just unlock and lock again
without checking l2cap_chan state since channel can be disconnected
when lock is not held.

This patch adds missing checks for l2cap_chan state when returning from
call which allocates skb.

Scenario is easily reproducible by running rfcomm-tester in a loop.

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa0442169>] l2cap_do_send+0x29/0x120 [bluetooth]
PGD 0
Oops: 0000 [#1] SMP
Modules linked in:
CPU: 7 PID: 4038 Comm: krfcommd Not tainted 3.14.0-rc2+ #15
Hardware name: Dell Inc. OptiPlex 790/0HY9JP, BIOS A10 11/24/2011
task: ffff8802bdd731c0 ti: ffff8801ec986000 task.ti: ffff8801ec986000
RIP: 0010:[<ffffffffa0442169>] [<ffffffffa0442169>] l2cap_do_send+0x29/0x120
RSP: 0018:ffff8801ec987ad8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff8800c5796800 RCX: 0000000000000000
RDX: ffff880410e7a800 RSI: ffff8802b6c1da00 RDI: ffff8800c5796800
RBP: ffff8801ec987af8 R08: 00000000000000c0 R09: 0000000000000300
R10: 000000000000573b R11: 000000000000573a R12: ffff8802b6c1da00
R13: 0000000000000000 R14: ffff8802b6c1da00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88042dce0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000041257c000 CR4: 00000000000407e0
Stack:
ffff8801ec987d78 ffff8800c5796800 ffff8801ec987d78 0000000000000000
ffff8801ec987ba8 ffffffffa0449e37 0000000000000004 ffff8801ec987af0
ffff8801ec987d40 0000000000000282 0000000000000000 ffffffff00000004
Call Trace:
[<ffffffffa0449e37>] l2cap_chan_send+0xaa7/0x1120 [bluetooth]
[<ffffffff81770100>] ? _raw_spin_unlock_bh+0x20/0x40
[<ffffffffa045188b>] l2cap_sock_sendmsg+0xcb/0x110 [bluetooth]
[<ffffffff81652b0f>] sock_sendmsg+0xaf/0xc0
[<ffffffff810a8381>] ? update_curr+0x141/0x200
[<ffffffff810a8961>] ? dequeue_entity+0x181/0x520
[<ffffffff81652b60>] kernel_sendmsg+0x40/0x60
[<ffffffffa04a8505>] rfcomm_send_frame+0x45/0x70 [rfcomm]
[<ffffffff810766f0>] ? internal_add_timer+0x20/0x50
[<ffffffffa04a8564>] rfcomm_send_cmd+0x34/0x60 [rfcomm]
[<ffffffffa04a8605>] rfcomm_send_disc+0x75/0xa0 [rfcomm]
[<ffffffffa04aacec>] rfcomm_run+0x8cc/0x1a30 [rfcomm]
[<ffffffffa04aa420>] ? rfcomm_check_accept+0xc0/0xc0 [rfcomm]
[<ffffffff8108e3a9>] kthread+0xc9/0xe0
[<ffffffff8108e2e0>] ? flush_kthread_worker+0xb0/0xb0
[<ffffffff817795fc>] ret_from_fork+0x7c/0xb0
[<ffffffff8108e2e0>] ? flush_kthread_worker+0xb0/0xb0
Code: 00 00 66 66 66 66 90 55 48 89 e5 48 83 ec 20 f6 05 d6 a3 02 00 04
RIP [<ffffffffa0442169>] l2cap_do_send+0x29/0x120 [bluetooth]
RSP <ffff8801ec987ad8>
CR2: 0000000000000000

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
8b064a3ad377c016a17e74f676e7a204c2b8c9f2 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Clean up HCI state when doing power off

To be friendly to user space and to behave well with controllers that
lack a proper internal power off procedure we should try to clean up as
much state as possible before requesting the HCI driver to power off.

This patch updates the power off procedure that's triggered by
mgmt_set_powered to clean any scan modes, stop LE scanning and
advertising and to disconnect any open connections.

The asynchronous cleanup procedure uses the HCI request framework,
however since HCI_Disconnect is only covered until its Command Status
event we need some extra tracking/waiting of disconnections. This is
done by monitoring when hci_conn_count() indicates that there are no
more connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7c4cfab8082f1398dc7bc091166dd302a44b015b 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't clear HCI_ADVERTISING when powering off

Once mgmt_set_powered(off) is updated to clear the scan mode we should
not just blindly clear the HCI_ADVERTISING flag in mgmt_advertising()
but first check if there is a pending set_powered operation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ce3f24cfb2a2287409acad3dd990570fe62d0af4 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't clear HCI_CONNECTABLE when powering off

Once mgmt_set_powered(off) is updated to clear the scan mode we should
not just blindly clear the HCI_CONNECTABLE flag in mgmt_connectable()
but first check if there is a pending set_powered operation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
bd107999338fbb2e084acebc635333a5cd156b09 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't clear HCI_DISCOVERABLE when powering off

Once mgmt_set_powered(off) is updated to clear the scan mode we should
not just blindly clear the HCI_DISCOVERABLE flag in mgmt_discoverable()
but first check if there is a pending set_powered operation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
12d4a3b2ccb3ac2bd56e7c216d6e7f44730006f3 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move check for MGMT_CONNECTED flag into mgmt.c

Once mgmt_set_powered(off) starts doing disconnections we'll need to
care about any disconnections in mgmt.c and not just those with the
MGMT_CONNECTED flag set. Therefore, move the check into mgmt.c from
hci_event.c.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
778b235a3be0588da1909f7ef75b4bc3dbc09dfc 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move HCI_ADVERTISING handling into mgmt.c

We'll soon need to make decisions on toggling the HCI_ADVERTISING flag
based on pending mgmt_set_powered commands. Therefore, move the handling
from hci_event.c into mgmt.c.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
4518bb0fb5eda46a9b118a6fbd9661e62a34a5b6 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix canceling RPA expiry timer

The RPA expiry timer is only initialized inside mgmt.c when we receive
the first command from user space. This action also involves setting the
HCI_MGMT flag for the first time so that flag acts as a good indicator
of whether the delayed work variable can be touched or not. This patch
fixes hci_dev_do_close to first check the flag.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
dccf2f65e68d2f5b5e86ae6cf9796cf558694953 20-Feb-2014 Frank Praznik <frank.praznik@oh.rr.com> HID: hidp: Add a comment that some devices depend on the current behavior of uniq

Add a comment noting that some devices depend on the destination address being
stored in uniq.

Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
c21c0ea07b30eb670be96e67199d1f984512ef96 24-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable RPA resolving if mgmt_set_privacy is called

A user space that supports the Set Privacy command is also expected to
be able to handle New IRK events. Therefore, set the HCI_RPA_RESOLVING
flag whenever the Set Privacy command is received.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
473deef2c9e99c548c04c58856bdf1e271806079 24-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Export current local RPA with identity information

The identity information in debugfs currently do not include the
current in use local RPA. Since the RPA is now stored in the
controller information, include it in the debugfs as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2b5224dca5a9257a3df8cc9f93978ecb3757b9c2 24-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store current RPA and update it if needed

The RPA needs to be stored to know which is the current one. Otherwise
it is impossible to ensure that always the correct RPA can be programmed
into the controller when it is needed.

Current code checks if the address in the controller is a RPA, but that
can potentially lead to using a RPA that can not be resolved with the
IRK that has been distributed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
41c90c186a3b51207cb1f2583fbadec3c76e4730 24-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use privacy mode for non-connectable advertising

When enabling non-connectable advertising, there is no need to advertise
with a public address or static address. In case LE privacy has not been
enabled a unresolvable private address will be used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
94b1fc92cd7cf550460ffd4bcc08c2707564aa49 24-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use unresolvable private address for active scanning

When running active scanning during LE discovery, do not reveal the own
identity to the peer devices. In case LE privacy has been enabled, then
a resolvable private address is used. If the LE privacy option is off,
then use an unresolvable private address.

The public address or static random address is never used in active
scanning anymore. This ensures that scan request are send using a
random address.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
gmt.c
ac345813c4ac5a0e66261e9812f0fe94729c0eb2 23-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose current identity information in debugfs

When using LE Privacy it is useful to know the local identity address,
identity address type and identity resolving key. For debugging purposes
add these information to debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7bf32048b1af87942d311ef1620995ffc89c07d8 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded hdev->own_addr_type

Now that the identity address type is always looked up for all
successful connections, the hdev->own_addr_type variable has become
completely unnecessary. Simply remove it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
e26b1ffa11bb1e0afa194823623ee64b7e143993 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting correct src_type when connecting LE

This patch ensures that conn->src_type contains the same address type as
is used for initiating the connection while the connection attempt is in
progress. Once connected this value will be overwritten with the
identity address type.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
62b04cd124cb76ce0b9a6391c6c046c08c1ac8b7 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for Set Privacy command

This patch adds support for handling the Set Privacy mgmt command,
including copying the value to hdev->irk and toggling the HCI_PRIVACY
flag.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c982b2ea29af7a78685b9e32ea028917a07b783e 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add debugfs entry for RPA regeneration timeout

This patch adds a rpa_timeout debugfs entry which can be used to set the
RPA regeneration timeout to something else than the default 15 minutes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
8f71c6c3157d12c90d3cf920dd5e94045679fdce 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't write static address during power on

Since we always update the random address before enabling advertising,
scanning and initiating LE connections there is no need to write the
random address add power on.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d9483943601ba7095af42a159faacf7746a74bc9 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_update_random_address() for initiating LE scan

When we start LE scanning we need to update the local random address if
necessary. This patch updates the code to use hci_update_random_address()
for setting the own_address_type scan parameter and updating the local
random address if necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8f2a0601a5d68d0dbd2221613dda7fb6fee32a6b 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_update_random_address() for enabling advertising

When we enable advertising we need to update the local random address if
necessary. This patch takes advantage of the hci_update_random_address()
function to set the own_address_type variable and to update the local
random address if necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
85030be4c5ce39e709b2cb5d4f8ee8779af8e50b 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use hci_update_random_address() when connecting LE

When we initiate LE connections we need to update the local random
address if necessary. This patch updates the LE connection creation
mechanism to use the new hci_update_random_address() function to set the
own_address_type parameter and to update the local random address if
necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ebd3a74765377b7528bb372aab2890638790301d 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add hci_update_random_address() convenience function

This patch adds a convenience function for updating the local random
address which is needed before advertising, scanning and initiating LE
connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
d6bfd59caef7e543c7786af9664309dd1a7f6396 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add timer for regenerating local RPA

This patch adds a timer for updating the local RPA periodically. The
default timeout is set to 15 minutes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
b1e2b3ae97620752905e58a9682fad7222796566 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add SMP function for generating RPAs

We need a function in smp.c to generate Resolvable Random Addresses in
order to support privacy. The local RPA will need to be generated before
advertising, scanning or connecting and regenerated at periodic
intervals. This patch adds the necessary function for RPA generation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
82d4b3592378e88ddbb42a8db9bd4a99c399c3c4 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set the correct values for Identity Address Information

The SMP Identity Address Information PDU should contain our Identity
Address. This patch updates the code to copy the correct values from the
hci_conn object.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
7be2edbbb87a34fbf1441991a679af94fe1d981d 23-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Ensure hci_conn always contains the local identity address

To be consistent with the remote address info in hci_conn we want it to
also contain the local identity address information. This patch updates
the code to copy the right values in place whenever an LE connection has
been established.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0f4bd942f13dd15a1b290953cdd7cd6aca11be1f 22-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add Privacy flag to mgmt supported/current settings

This patch makes sure that the Privacy flag is available in the mgmt
supported settings for all LE capable controllers and in the current
settings whenever the HCI_PRIVACY flag is set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
199a2fb14d1d4cb2a1eb2fe05b725f36bb4f55ba 22-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move enable/disable_advertising higher up in mgmt.c

These functions will soon be needed by the RPA regeneration timeout so
move them higher up in mgmt.c to avoid a forward declaration.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
863efaf224d24705c0ffdc59f2a0ec68f2d85b4f 22-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add initial code for distributing local IRK

This code adds a HCI_PRIVACY flag to track whether Privacy support is
enabled (meaning we have a local IRK) and makes sure the IRK is
distributed during SMP key distribution in case this flag is set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
524237cb4b566ae73ec24c56852489b85e426241 22-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add helper variables to smp_distribute_keys()

This patch a couple of helper variables to the smp_distribute_keys
function in order to avoid long chains of dereferences and thereby help
readability.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
1b60ef210e90cc116b9c976ff9fb8b656b3ebb76 22-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issue with missing management event opcode

The event opcode for New Identity Resolving Key event is missing from
supported event list. Just add it there.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
668b7b19820b0801c425d31cc27fd6f499050e5c 21-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix iterating wrong list in hci_remove_irk()

We should be iterating hdev->identity_resolving_keys in the
hci_remove_irk() function instead of hdev->long_term_keys. This patch
fixes the issue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
a747439957ee2d1696a2a1494e5ce0516e153f10 20-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increase minor version of core module

With the addition of Resolvable Private Address (RPA) resolution
support for Bluetooth Low Energy connections, it makes sense to
increase the minor version of the Bluetooth core module.

The module version is not used anywhere, but it gives a nice extra
hint for debugging purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
3f959d46a60c20eedf6f228e49d820c5922ec68f 20-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide option for changing LE advertising channel map

For testing purposes it is useful to provide an option to change the
advertising channel map. So add a debugfs option to allow this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
b1765e7afe8710ef4366dc722cc5bd487eb07973 20-Feb-2014 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Fix channel check when binding RFCOMM sock

When binding RFCOMM socket with non-zero channel we're checking if
there is already any other socket which has the same channel number
assigned and then fail. This check does not consider situation where
we have another socket connected to remote device on given channel
number in which case we still should be able to bind local socket.

This patch changes __rfcomm_get_sock_by_addr() to return only sockets
in either BT_BOUND or BT_LISTEN states, also name is updated to better
describe what this function does now.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
7a4cd51dec96b42d899ed7b2207c9ef810534451 20-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track the current configured random address

For Bluetooth controllers with LE support, track the value of the
currently configured random address. It is important to know what
the current random address is to avoid unneeded attempts to set
a new address. This will become important when introducing the
LE privacy support in the future.

In addition expose the current configured random address via
debugfs for debugging purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
b32bba6ced5696593a6bae5fdc69dc79c0a97ef5 20-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Replace own_address_type with force_static_address debugfs

The own_address_type debugfs option does not providing enough
flexibity for interacting with the upcoming LE privacy support.

What really is needed is an option to force using the static address
compared to the public address. The new force_static_address debugfs
option does exactly that. In addition it is also only available when
the controller does actually have a public address. For single mode
LE only controllers this option will not be available.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
5192d30114771ac5956d750ec506dc574411cc70 20-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add comment explainging store hint for long term keys

The code itself is not descriptive on what store hint is used for
long term keys and why. So add some extensive comment here. Similar
to what has already been done for identity resolving key store hint.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
bab6d1e594ef4dd76ee5a369da96d572c43c7489 19-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't send store hint for devices using identity addresses

The identity resolving keys should only be stored for devices using
resolvable random addresses. If the device is already using an
identity address, inform it about the new identity resolving key,
but tell userspace that this key is not persistent.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
95fbac8a8e459262c580ee4172e4713cdc60929b 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for sending New IRK event

This patch adds the necessary helper function to send the New IRK mgmt
event and makes sure that the function is called at when SMP key
distribution has completed. The event is sent before the New LTK event
so user space knows which remote device to associate with the keys.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
mp.c
35d702719d6464a9de2bf98d536c6e054f0a8f7e 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move SMP LTK notification after key distribution

This patch moves the SMP Long Term Key notification over mgmt from the
hci_add_ltk function to smp.c when both sides have completed their key
distribution. This way we are also able to update the identity address
into the mgmt_new_ltk event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
mp.c
23d0e128e38049734c7ecc0987de02486d1ded3e 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track SMP keys in the SMP context

As preparation to do mgmt notification in a single place at the end of
the key distribution, store the keys that need to be notified within the
SMP context.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
ba74b666b5e581ef3d4912af73774fab48c03198 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move New LTK store hint evaluation into mgmt_new_ltk

It's simpler (one less if-statement) to just evaluate the appropriate
value for store_hint in the mgmt_new_ltk function than to pass a boolean
parameter to the function. Furthermore, this simplifies moving the mgmt
event emission out from hci_add_ltk in subsequent patches.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
ca9142b8825c159897cc4a246ea27585c82add4b 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Return added key when adding LTKs and IRKs

The SMP code will need to postpone the mgmt event emission for the IRK
and LTKs. To avoid extra lookups at the end of the key distribution
simply return the added value from the add_ltk and add_irk functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
0a14ab416d7754be0bb0d4306c996f72f52fa5bf 19-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Avoid using GFP_ATOMIC where not necessary

The various pieces of data cached in the hci_dev structure do not need
to be allocated using GFP_ATOMIC since they are never added from
interrupt context. This patch updates these allocations to use
GFP_KERNEL instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
d66c295031aec712e179d21de66602d631390f34 19-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use same LE min/max connection event length during update

During LE connection establishment the value 0x0000 is used for min/max
connection event length. So use the same value when the peripheral is
requesting an update of the the connection paramters.

For some reason the value 0x0001 got used in the connection update and
0x0000 in the connection creation. Using the same value for both just
makes sense.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
3698d70469d165d01fefcad9a56172742157ff95 19-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose current list of identity resolving keys via debugfs

For debugging purposes expose the current list of identity resolving
keys via debugfs. This file is read-only and limited to root access.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
edb4b46651c87f1579154298c41f9c1a753565a3 19-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix wrong identity address during connection failures

When the connection attempt fails, the address information are not
provided in the HCI_LE_Connection_Complete event. So use the original
information from the connection to reconstruct the identity address.

This is important when a connection attempt has been made using the
identity address, but the cached resolvable random address has changed
in the meantime. The failure event needs to use the identity address
and not the resolvable random address.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_event.c
64c7b77c124c71166d1dd49fc7e8d6fee7d9b01b 18-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use connection address for reporting connection failures

When reporting connect failed events to userspace, use the address
of the connection and not the address from the HCI event.

This change is strictly speaking not needed since BR/EDR does not
have the concept of resolvable random addresses. It is more for
making the code consistent.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
01fdb0fc6e937eeff7b20d0e217408cee9ec05af 18-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Report identity address when remote device connects

When the remote device has been successfully connected, report the
identity address (public address or static random address).

Currently the address from the HCI_LE_Connection_Complete event is
used. This was no problem so far, but since now known resolvable
random addresses are converted into identities, it is important to
use the identity of the connection and not the address report by
HCI event.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
525b870974802a5b72a81a4c7dbf9a706a659b46 19-Feb-2014 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID update from Jiri Kosina:

- fixes for several bugs in incorrect allocations of buffers by David
Herrmann and Benjamin Tissoires.

- support for a few new device IDs by Archana Patni, Benjamin
Tissoires, Huei-Horng Yo, Reyad Attiyat and Yufeng Shen

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: hyperv: make sure input buffer is big enough
HID: Bluetooth: hidp: make sure input buffers are big enough
HID: hid-sensor-hub: quirk for STM Sensor hub
HID: apple: add Apple wireless keyboard 2011 JIS model support
HID: fix buffer allocations
HID: multitouch: add FocalTech FTxxxx support
HID: microsoft: Add ID's for Surface Type/Touch Cover 2
HID: usbhid: quirk for CY-TM75 75 inch Touch Overlay
2c96e03def3b1ba47a5d0ec0c8ef7935a9bfb3a0 18-Feb-2014 Szymon Janc <szymon.janc@gmail.com> Bluetooth: Print error when dropping L2CAP data

Silently dropping L2CAP data (i.e. due to remote device not obeying
negotiated MTU) is confusing and makes debugging harder.

Signed-off-by: Szymon Janc <szymon.janc@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
5cedbb8d7aee79a8bbfc8e5b91bc1353ffb0f7b0 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use Identity Address in Device Found event

Whenever a device uses an RPA we want to have user space identify it by
its Identity Address if we've got an IRK available for it. This patch
updates the Device Found mgmt event to contain the Identity Address if
an IRK is available for the device in question.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
1ebfcc1f5884509925522ab76c17db9befe0aac9 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Look up RPA for connection requests with Identity Address

We need to check whether there's a matching IRK and RPA when we're
requested to connect to a remote LE device based on its Identity
Address. This patch updates the hci_connect_le function to do an extra
call to hci_find_irk_by_addr and uses the RPA if it's cached. This is
particularly important once we start exposing the Identity Address to
user space instead of the RPA in events such as Device Connected and
Device Found.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
6cfc9988bd3e5d2931365da76db9b5a7334494b6 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't try to look up private addresses as Identity Address

Identity Addresses are either public or static random. When looking up
addresses based on the Identity Address it doesn't make sense to go
through the IRK list if we're given a private random address. This patch
fixes (or rather improves) the hci_find_irk_by_addr function to bail out
early if given a private random address.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
f4a407bef20c0e63fcd910a9404418522abff4ab 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Wait for SMP key distribution completion when pairing

When we initiate pairing through mgmt_pair_device the code has so far
been waiting for a successful HCI Encrypt Change event in order to
respond to the mgmt command. However, putting privacy into the play we
actually want the key distribution to be complete before replying so
that we can include the Identity Address in the mgmt response.

This patch updates the various hci_conn callbacks for LE in mgmt.c to
only respond in the case of failure, and adds a new mgmt_smp_complete
function that the SMP code will call once key distribution has been
completed.

Since the smp_chan_destroy function that's used to indicate completion
and clean up the SMP context can be called from various places,
including outside of smp.c, the easiest way to track failure vs success
is a new flag that we set once key distribution has been successfully
completed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
mp.c
mp.h
387a33e304caeeabf0c2439607fa6e726666bdf0 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating Identity Address in L2CAP channels

When we receive a remote identity address during SMP key distribution we
should ensure that any associated L2CAP channel instances get their
address information correspondingly updated (so that e.g. doing
getpeername on associated sockets returns the correct address).

This patch adds a new L2CAP core function l2cap_conn_update_id_addr()
which is used to iterate through all L2CAP channels associated with a
connection and update their address information.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
mp.c
68d6f6ded5bdaa89f9da0144359a7c5565991f8d 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track the LE Identity Address in struct hci_conn

Since we want user space to see and use the LE Identity Address whenever
interfacing with the kernel it makes sense to track that instead of the
real address (the two will only be different in the case of an RPA).
This patch adds the necessary updates to when an LE connection gets
established and when receiving the Identity Address from a remote
device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
mp.c
893ce8b1b3d92cbddcf34bb92c7d24720efc7fed 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove SMP data specific crypto context

Now that each HCI device has its own AES crypto context we don't need
the one stored in the SMP data any more. This patch removes the variable
from struct smp_chan and updates the SMP code to use the per-hdev crypto
context.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
a7ec73386ce2a8ab351ee8ab6a1e5475f72617dc 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix removing any IRKs when unpairing devices

When mgmt_unpair_device is called we should also remove any associated
IRKs. This patch adds a hci_remove_irk convenience function and ensures
that it's called when mgmt_unpair_device is called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
b7d448d74a09af412d778918415fe2ea4d5c2de4 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix completing SMP as peripheral when no keys are expected

When we're the acceptors (peripheral/slave) of an SMP procedure and
we've completed distributing our keys we should only stick around
waiting for keys from the remote side if any of the initiator
distribution bits were actually set. This patch fixes the
smp_distribute_keys function to clear the SMP context when this
situation occurs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
c51ffa0b2fb23ec19b2d01597506d8c953ed1218 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_remove_ltk failure when no match is found

There is code (in mgmt.c) that depends on the hci_remove_ltk function to
fail if no match is found. This patch adds tracking of removed LTKs
(there can be up to two: one for master and another for slave) in the
hci_remove_ltk function and returns -ENOENT of no matches were found.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
35f7498a87794ca531335f7c782e5b9495fec6d6 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove return values from functions that don't need them

There are many functions that never fail but still declare an integer
return value for no reason. This patch converts these functions to use a
void return value to avoid any confusion of whether they can fail or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
e0b2b27e622da0ba8a3d253b985d3d8f174b4313 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing address type check for removing LTKs

When removing Long Term Keys we should also be checking that the given
address type (public vs random) matches. This patch updates the
hci_remove_ltk function to take an extra parameter and uses it for
address type matching.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
6131ddc8eb9bad8c4ff37e097b2537c819b76cc0 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix properly ignoring unexpected SMP PDUs

If we didn't request certain pieces of information during the key
distribution negotiation we should properly ignore those PDUs if the
peer incorrectly sends them. This includes the Encryption Information
and Master Identification PDUs if the EncKey bit was not set, and the
Identity Information and Identity Address Information PDUs if the IdKey
bit was not set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
fd349c020c5b6f7a6e17cb8b4e821ff9b6f71ba6 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable support for remote IRK distribution

This patch does the necessary changes to request the remote device to
distribute its IRK to us during the SMP pairing procedure. This includes
setting the right key distribution values in the pairing
request/response and handling of the two related SMP PDUs, i.e. Identity
Information and Identity Address Information.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
41edf1601af3b25461d91e73834dc89510bca8e5 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Implement mgmt_load_irks command

This patch implements the Load IRKs command for the management
interface. The command is used to load the kernel with the initial set
of IRKs. It also sets a HCI_RPA_RESOLVING flag to indicate that we can
start requesting devices to distribute their IRK to us.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
970c4e46037ab8ece3940afc9fcf916d3ed7e003 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add basic IRK management support

This patch adds the initial IRK storage and management functions to the
HCI core. This includes storing a list of IRKs per HCI device and the
ability to add, remove and lookup entries in that list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
99780a7b639e73d8f8f291fa1a981db883aec47f 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add AES crypto context for each HCI device

Previously the crypto context has only been available for LE SMP
sessions, but now that we'll need to perform operations also during
discovery it makes sense to have this context part of the hci_dev
struct. Later, the context can be removed from the SMP context.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
60478054a6af7aa8cceb8218d29d27f165f1c9d3 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add smp_irk_matches helper function

This patch adds a helper function to check whether a given IRK matches a
given Resolvable Private Address (RPA). The function will be needed for
implementing the rest of address resolving support.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
6bfdfe3cd68d5a797e0ebfb57068fe7f9c20c93a 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix minor whitespace issues in SMP code

This patch fixes a couple of unnecessary empty lines in the SMP code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
c46b98bea5691c0ed99da85cf0cb87bc146468e9 18-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing PDU length checks for SMP

For each received SMP PDU we need to check that we have enough data to
fit the specified size of the PDU. This patch adds the necessary checks
for each SMP PDU handler and ensures that buffer overflows do not occur
if to little data has been received.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
a4b1b5877b514b276f0f31efe02388a9c2836728 19-Dec-2013 David Herrmann <dh.herrmann@gmail.com> HID: Bluetooth: hidp: make sure input buffers are big enough

HID core expects the input buffers to be at least of size 4096
(HID_MAX_BUFFER_SIZE). Other sizes will result in buffer-overflows if an
input-report is smaller than advertised. We could, like i2c, compute the
biggest report-size instead of using HID_MAX_BUFFER_SIZE, but this will
blow up if report-descriptors are changed after ->start() has been called.
So lets be safe and just use the biggest buffer we have.

Note that this adds an additional copy to the HIDP input path. If there is
a way to make sure the skb-buf is big enough, we should use that instead.

The best way would be to make hid-core honor the @size argument, though,
that sounds easier than it is. So lets just fix the buffer-overflows for
now and afterwards look for a faster way for all transport drivers.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
c6beca0e0dc70c439894337e82609ec3b79ed900 17-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow HCI User Channel usage for controllers without address

Trying to setup HCI User Channel usage for LE only controllers without
a public address or configured static address will fail with an error
saying that no address is available.

In case of HCI User Channel the requirement for a valid address is not
needed. So allow skipping this extra validation step.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
c6521401d668538784e27d5746e7035fcf1107a8 17-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add missing index added event on user channel failure

When the setup of user channel fails, the index added event is not sent
and will cause issues with user interaction. This problem can be easily
triggered with a LE only controller without a public address. In that
case hci_dev_open() fails and that error case is not sending an event
saying that the controller is available for normal use again.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
0fe442ff854b7bf93e57c7f3964b05a6438de3db 16-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix sending wrong store hint for new long term keys

The long term keys should only be stored when they belong to an
indentity address. The identity address can either be a public
address or a random static address.

For all other addresses (unresovable or resolvable) tell userspace
that the long term key is not persistent.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
490cb0b318a0619ae545e63d6773f01caf29d4a0 16-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict long term keys to public and static addresses

The long term keys should be associated with an identity address. Valid
identity addresses are public addresses or static addresses. So only
allow these two as valid address information for long term keys.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cafebc058bf86e63fff5354864781d3de11e41d3 05-Feb-2014 Benjamin Tissoires <benjamin.tissoires@redhat.com> HID: remove hid_get_raw_report in struct hid_device

dev->hid_get_raw_report(X) and hid_hw_raw_request(X, HID_REQ_GET_REPORT)
are strictly equivalent. Switch the hid subsystem to the hid_hw notation
and remove the field .hid_get_raw_report in struct hid_device.

Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
e9d5da97a6a8da75f8a58b722bbd59ef474e0f47 05-Feb-2014 Benjamin Tissoires <benjamin.tissoires@redhat.com> HID: HIDp: remove duplicated coded

- Move hidp_output_report() above
- Removed duplicated code in hidp_output_raw_report()

Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
2f0cd0300e8f73c1a02bd11a6185a5c8534f4b09 05-Feb-2014 Benjamin Tissoires <benjamin.tissoires@redhat.com> HID: HIDp: remove hidp_hidinput_event

hidp uses its own ->hidinput_input_event() instead of the generic binding
in hid-input.
Moving the handling of LEDs towards hidp_hidinput_event() allows two things:
- remove hidinput_input_event definitively from struct hid_device
- hidraw user space programs can also set the LEDs

Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
8981be9b2fe5553af35a43865d9ab4271c3aa2e2 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix write_room() calculation

The skb truesize of a 12-byte payload with a 10-byte head/tail
reserve is 768 bytes. Consequently, even with 40 tx_credits, at
most 6 packets could be queued at any one time:

40 tx_credits * 127-byte mtu < 768-byte truesize * 7

This error could also cause the tx queue to apparently stall if
credit flow control is disabled (where tx_credits is fixed at 5),
or if the receiver only granted a limited number of tx credits
(eg., less than 7).

Instead, track the outstanding number of queued packets not yet sent
in wmem_alloc and allow for a maximum of 40 queued packets. Report
the space avail for a single write() as the mtu * number of packets
left before reaching the maximum.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
b16b4351313fb89ccb4c227d432d16aa32ffec72 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Refactor write_room() calculation

Compute the amount of space available for a single write()
within rfcomm_room(); clamp to 0 for negative values. Note
this patch does not change the result of the computation.

Report the amount of room returned in the debug printk.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
72e5108c6d637ea2f4c0e64b09621a79f363b664 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Don't fail RFCOMM tty writes

The tty driver api design prefers no-fail writes if the driver
write_room() method has previously indicated space is available
to accept writes. Since this is trivially possible for the
RFCOMM tty driver, do so.

Introduce rfcomm_dlc_send_noerror(), which queues but does not
schedule the krfcomm thread if the dlc is not yet connected
(and thus does not error based on the connection state).
The mtu size test is also unnecessary since the caller already
chunks the written data into mtu size.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/tty.c
5326a4ee982703ddba14a9821fe5cb10d122e1b0 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Force -EIO from tty read/write if .activate() fails

If rfcomm_dlc_open() fails, set tty into error state which returns
-EIO from reads and writes.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
fb856e50900a84dd9f8d50d3882eb4a26ba6ea54 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Cleanup RFCOMM device registration error handling

If RFCOMM tty device registration fails, cleanup by releasing
the tty_port reference to trigger rfcomm_dev destruction
(rather than open-coding it).

The dlc reference release is moved into rfcomm_dev_add(),
which ensures cleanup in both error paths -- ie., if
__rfcomm_dev_add() fails or if tty_port_register_device() fails.

Fixes releasing the module reference if device registration fails.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
f355095756c2a0b77a5b0aa0384c0c09d9735252 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Refactor rfcomm_dev_add()

Move rfcomm_dev allocation and initialization into new function,
__rfcomm_dev_add(), to simplify resource release in error handling.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
033ace99c444daa4141b84419f670513ce637b77 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Serialize RFCOMMCREATEDEV and RFCOMMRELEASEDEV ioctls

At least two different race conditions exist with multiple concurrent
RFCOMMCREATEDEV and RFCOMMRELEASEDEV ioctls:
* Multiple concurrent RFCOMMCREATEDEVs with RFCOMM_REUSE_DLC can
mistakenly share the same DLC.
* RFCOMMRELEASEDEV can destruct the rfcomm_dev still being
constructed by RFCOMMCREATEDEV.

Introduce rfcomm_ioctl_mutex to serialize these add/remove operations.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
7611fcedd6caae0586397508a2414788d87a231c 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Rename __rfcomm_dev_get() to __rfcomm_dev_lookup()

Functions which search lists for matching id's are more
commonly named *_lookup, which is the convention in the
bluetooth core as well.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
b4d21f193985218c6c75969376249f69e49eb6ee 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix RFCOMM parent device for reused dlc

The RFCOMM tty device is parented to the acl link device when
the dlc state_change(BT_CONNECTED) notification is received.
However, if the dlc from the RFCOMM socket is being reused
(RFCOMM_REUSE_DLC is set), then the dlc may already be connected,
and no notification will occur.

Instead, always parent the RFCOMM tty device to the acl link
device at registration time. If the acl link device is not available
(eg, because the dlc is not connected) then the tty will remain
unparented until the BT_CONNECTED notification is received.

Fixes regression with ModemManager when the rfcomm device is
created with the flag RFCOMM_REUSE_DLC.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
b92483d54abb4ff288accc36bf1daef44dea9fbe 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix unsafe RFCOMM device parenting

Accessing the results of hci_conn_hash_lookup_ba() is unsafe without
holding the hci_dev_lock() during the lookup. For example:

CPU 0 | CPU 1
hci_conn_hash_lookup_ba | hci_conn_del
rcu_read_lock | hci_conn_hash_del
list_for_each_entry_rcu | list_del_rcu
if (.....) | synchronize_rcu
rcu_read_unlock |
| hci_conn_del_sysfs
| hci_dev_put
| hci_conn_put
| put_device (last reference)
| bt_link_release
| kfree(conn)
return p << just freed |

Even if a hci_conn reference were taken (via hci_conn_get), would
not guarantee the lifetime of the sysfs device, but only safe
access to the in-memory structure.

Ensure the hci_conn device stays valid while the rfcomm device
is reparented; rename rfcomm_get_device() to rfcomm_reparent_device()
and perform the reparenting within the function while holding the
hci_dev_lock.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
c4fd318d6ebc16bd64ca7b9c06f21b7f33bb462e 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Directly close dlc for not yet started RFCOMM session

If the RFCOMM session has not yet been started (ie., session is
still in BT_BOUND state) when a dlc is closed, directly close and
unlink the dlc rather than sending a DISC frame that is never
sent.

This allows the dlci to be immediately reused rather than waiting
for a 20 second timeout.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
f622357a5e83e3a812ca985a78e86d750c98228b 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Refactor dlc disconnect logic in rfcomm_dlc_close()

Prepare for directly closing dlc if the RFCOMM session has not
yet been started; refactor the dlc disconnect logic into a separate
local function, __rfcomm_dlc_disconn(). Retains functional
equivalence.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
5998e04063563ff2ffc779510f072ff0ff94163b 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Refactor deferred setup test in rfcomm_dlc_close()

Prepare for directly closing dlc if the RFCOMM session has not
yet been started; refactor the deferred setup test for only those
dlc states to which the test applies. Retains functional
equivalence.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
4339c25afb0d49878fba5a989618ffe807aa46cd 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Simplify RFCOMM session state eval

Merge conditional test for BT_LISTEN session state into following
switch statement (which is functionally equivalent).

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
c10a848cea89a8f0418fa0efec33c4e8507aab4b 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Verify dlci not in use before rfcomm_dev create

Only one session/channel combination may be in use at any one
time. However, the failure does not occur until the tty is
opened (in rfcomm_dlc_open()).

Because these settings are actually bound at rfcomm device
creation (via RFCOMMCREATEDEV ioctl), validate and fail before
creating the rfcomm tty device.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/tty.c
c949c224cfd7d5445ef947e8b93c0657323d5be5 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix RFCOMM tty teardown race

RFCOMM tty device teardown can race with new tty device registration
for the same device id:

CPU 0 | CPU 1
rfcomm_dev_add | rfcomm_dev_destruct
| spin_lock
| list_del <== dev_id no longer used
| spin_unlock
spin_lock | .
[search rfcomm_dev_list] | .
[dev_id not in use] | .
[initialize new rfcomm_dev] | .
spin_unlock | .
| .
tty_port_register_device | tty_unregister_device

Don't remove rfcomm_dev from the device list until after tty device
unregistration has completed.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
80ea73378af46b0023eb2f400d26c2a60248ffaa 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix unreleased rfcomm_dev reference

When RFCOMM_RELEASE_ONHUP is set, the rfcomm tty driver 'takes over'
the initial rfcomm_dev reference created by the RFCOMMCREATEDEV ioctl.
The assumption is that the rfcomm tty driver will release the
rfcomm_dev reference when the tty is freed (in rfcomm_tty_cleanup()).
However, if the tty is never opened, the 'take over' never occurs,
so when RFCOMMRELEASEDEV ioctl is called, the reference is not
released.

Track the state of the reference 'take over' so that the release
is guaranteed by either the RFCOMMRELEASEDEV ioctl or the rfcomm tty
driver.

Note that the synchronous hangup in rfcomm_release_dev() ensures
that rfcomm_tty_install() cannot race with the RFCOMMRELEASEDEV ioctl.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
1c64834e0624c61735308138e67cc3b527f41621 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Release rfcomm_dev only once

No logic prevents an rfcomm_dev from being released multiple
times. For example, if the rfcomm_dev ref count is large due
to pending tx, then multiple RFCOMMRELEASEDEV ioctls may
mistakenly release the rfcomm_dev too many times. Note that
concurrent ioctls are not required to create this condition.

Introduce RFCOMM_DEV_RELEASED status bit which guarantees the
rfcomm_dev can only be released once.

NB: Since the flags are exported to userspace, introduce the status
field to track state for which userspace should not be aware.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
960603a54aa0d5f4f1c4f1037bcaee571d03cb1e 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Exclude released devices from RFCOMMGETDEVLIST ioctl

When enumerating RFCOMM devices in the rfcomm_dev_list, holding
the rfcomm_dev_lock only guarantees the existence of the enumerated
rfcomm_dev in memory, and not safe access to its state. Testing
the device state (such as RFCOMM_TTY_RELEASED) does not guarantee
the device will remain in that state for the subsequent access
to the rfcomm_dev's fields, nor guarantee that teardown has not
commenced.

Obtain an rfcomm_dev reference for the duration of rfcomm_dev
access.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
082a1532fc7607727f759c069eb8dd9fa5ae3f37 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix racy acquire of rfcomm_dev reference

rfcomm_dev_get() can return a rfcomm_dev reference for a
device for which destruction may be commencing. This can happen
on tty destruction, which calls rfcomm_tty_cleanup(), the last
port reference may have been released but RFCOMM_TTY_RELEASED
was not set. The following race is also possible:

CPU 0 | CPU 1
| rfcomm_release_dev
rfcomm_dev_get | .
spin_lock | .
dev = __rfcomm_dev_get | .
if dev | .
if test_bit(TTY_RELEASED) | .
| !test_and_set_bit(TTY_RELEASED)
| tty_port_put <<<< last reference
else |
tty_port_get |

The reference acquire is bogus because destruction will commence
with the release of the last reference.

Ignore the external state change of TTY_RELEASED and instead rely
on the reference acquire itself to determine if the reference is
valid.

Cc: Jiri Slaby <jslaby@suse.cz>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
f87c24e74e88d767e7024c4464d0d1fb3642fb5e 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Revert "Bluetooth: Move rfcomm_get_device() before rfcomm_dev_activate()"

This reverts commit e228b63390536f5b737056059a9a04ea016b1abf.

This is the third of a 3-patch revert, together with
Revert "Bluetooth: Remove rfcomm_carrier_raised()" and
Revert "Bluetooth: Always wait for a connection on RFCOMM open()".

Commit 4a2fb3ecc7467c775b154813861f25a0ddc11aa0,
"Bluetooth: Always wait for a connection on RFCOMM open()" open-codes
blocking on tty open(), rather than using the default behavior
implemented by the tty port.

The reasons for reverting that patch are detailed in that changelog;
this patch restores required functionality for that revert.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
136c373bf0e8c445fc028427674817333df602e3 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Revert "Bluetooth: Always wait for a connection on RFCOMM open()"

This reverts commit 4a2fb3ecc7467c775b154813861f25a0ddc11aa0.

This is the second of a 3-patch revert, together with
Revert "Bluetooth: Remove rfcomm_carrier_raised()" and
Revert "Bluetooth: Move rfcomm_get_device() before rfcomm_dev_activate()".

Before commit cad348a17e170451ea8688b532a6ca3e98c63b60,
Bluetooth: Implement .activate, .shutdown and .carrier_raised methods,
tty_port_block_til_ready() was open-coded in rfcomm_tty_install() as
part of the RFCOMM tty open().

Unfortunately, it did not implement non-blocking open nor CLOCAL open,
but rather always blocked for carrier. This is not the expected or
typical behavior for ttys, and prevents several common terminal
programming idioms from working (eg., opening in non-blocking
mode to initialize desired termios settings then re-opening for
connection).

Commit cad348a17e170451ea8688b532a6ca3e98c63b60,
Bluetooth: Implement .activate, .shutdown and .carrier_raised methods,
added the necessary tty_port methods to use the default tty_port_open().
However, this triggered two important user-space regressions.

The first regression involves the complicated mechanism for reparenting
the rfcomm tty device to the ACL link device which represents an
open link to a specific bluetooth host. This regression causes ModemManager
to conclude the rfcomm tty device does not front a modem so it makes
no attempt to initialize an attached modem. This regression is
caused by the lack of a device_move() if the dlc is already open (and
not specifically related to the open-coded block_til_ready()).

A more appropriate solution is submitted in
"Bluetooth: Fix unsafe RFCOMM device parenting" and
"Bluetooth: Fix RFCOMM parent device for reused dlc"

The second regression involves "rfcomm bind" and wvdial (a ppp dialer).
rfcomm bind creates a device node for a /dev/rfcomm<n>. wvdial opens
that device in non-blocking mode (because it expects the connection
to have already been established). In addition, subsequent writes
to the rfcomm tty device fail (because the link is not yet connected;
rfcomm connection begins with the actual tty open()).

However, restoring the original behavior (in the patch which
this reverts) was undesirable.

Firstly, the original reporter notes that a trivial userspace
"workaround" already exists: rfcomm connect, which creates the
device node and establishes the expected connection.

Secondly, the failed writes occur because the rfcomm tty driver
does not buffer writes to an unconnected device; this contrasts with
the dozen of other tty drivers (in fact, all of them) that do just
that. The submitted patch "Bluetooth: Don't fail RFCOMM tty writes"
corrects this.

Thirdly, it was a long-standing bug to block on non-blocking open,
which is re-fixed by revert.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
7f717b91dd68db1fa01d396d03997ed1b748659f 10-Feb-2014 Peter Hurley <peter@hurleysoftware.com> Revert "Bluetooth: Remove rfcomm_carrier_raised()"

This reverts commit f86772af6a0f643d3e13eb3f4f9213ae0c333ee4.

This is the first of a 3-patch revert, together with
Revert "Bluetooth: Always wait for a connection on RFCOMM open()" and
Revert "Bluetooth: Move rfcomm_get_device() before rfcomm_dev_activate()".

Commit 4a2fb3ecc7467c775b154813861f25a0ddc11aa0,
"Bluetooth: Always wait for a connection on RFCOMM open()" open-codes
blocking on tty open(), rather than using the default behavior
implemented by the tty port.

The reasons for reverting that patch are detailed in that changelog;
this patch restores required functionality for that revert.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
9b7655eafeeec9e74e97e9056e820ede8d18093e 14-Feb-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable LE L2CAP CoC support by default

Now that the LE L2CAP Connection Oriented Channel support has undergone a
decent amount of testing we can make it officially supported. This patch
removes the enable_lecoc module parameter which was previously needed to
enable support for LE L2CAP CoC.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
4292f1f3370193fd3f2e4f849211fd9596ce832f 03-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use connection parameters if any

This patch changes hci_connect_le() so it uses the connection
parameters specified for the certain device. If no parameters
were configured, we use the default values.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
15819a7065ac46eb804498bb7ccbba60d8f7d4d5 03-Feb-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce connection parameters list

This patch adds to hdev the connection parameters list (hdev->le_
conn_params). The elements from this list (struct hci_conn_params)
contains the connection parameters (for now, minimum and maximum
connection interval) that should be used during the connection
establishment.

Moreover, this patch adds helper functions to manipulate hdev->le_
conn_params list. Some of these functions are also declared in
hci_core.h since they will be used outside hci_core.c in upcoming
patches.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
914a6ffe42259267239a23d4f23ef06b0a0369a4 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track if link is using P-256 authenticated combination key

When the ACL link is using P-256 authenticated combination key, mark
the link mode as HCI_LM_FIPS.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
9cb2e030e6a0787f5c216702e6e78dd85ffe04c4 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Include security level 4 in connections check

This check is only used for RFCOMM connections and most likely no
RFCOMM based profile will require security level 4 secure connection
security policy. In case it ever does make sure that seucrity level 4
is treated as sufficient security level.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
0ab04a9c0e8e37ca495fb08c8b83615c5f144551 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command for Secure Connection Only Mode

With support for Secure Connections it is possible to switch the
controller into a mode that is called Secure Connections Only. In
this mode only security level 4 connections are allowed (with the
exception of security level 0 approved services).

This patch just introduces the management command and setting of the
right internal flags to enable this mode. It does not yet enforce it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
d40f3eef0b9b70d15d5fd0031c0633d4a9ed78cd 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Rename authentication to key_type in mgmt_ltk_info

The field is not a boolean, it is actually a field for a key type. So
name it properly.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
f8159247755e77d8264ccce84054ff893275115e 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove check for valid LTK authenticated parameter

The LTK authenticated parameter is the key type of the LTK and similar
to link keys there is no need to check the currently supported values.

For possible future improvements, the kernel will only use key types
it knows about and just ignore all the other ones.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
abf76bad8fb503fb21fb0eba854fa048c75ff123 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track the AES-CCM encryption status of LE and BR/EDR links

When encryption for LE links has been enabled, it will always be use
AES-CCM encryption. In case of BR/EDR Secure Connections, the link
will also use AES-CCM encryption. In both cases track the AES-CCM
status in the connection flags.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
dc8357cc72976f2fbe955e2ad4bba9e0e8ba5022 01-Feb-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove one level of indentation from hci_encrypt_change_evt

The function already has an unlock label which means the one extra level
on indentation is not useful and just makes the code more complex. So
remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
626bee82b8f306baf8d37fb3f9208b861708a1a5 31-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove use_debug_keys debugfs entry

Since the use of debug keys can now be identified from the current
settings information, this debugfs entry is no longer necessary.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4e39ac81366583486b857c88656409e56befefdf 31-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command to allow use of debug keys

Originally allowing the use of debug keys was done via the Load Link
Keys management command. However this is BR/EDR specific and to be
flexible and allow extending this to LE as well, make this an independent
command.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
b1de97d8c06d9d8d38e85dc5b0cf3630372e702c 31-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management setting for use of debug keys

When the controller has been enabled to allow usage of debug keys, then
clearly identify that in the current settings information.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
9bb3c01fdb2201d405dfff8950145640b2355ec4 30-Jan-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Introduce le_conn_failed() helper

This patch moves connection attempt failure code to its own function
so it can be reused in the next patch.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
1e406eefbe41467c00973939c2b61b37bf0e1323 30-Jan-2014 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Save connection interval parameters in hci_conn

This patch creates two new fields in struct hci_conn to save the
minimum and maximum connection interval values used to establish
the connection this object represents.

This change is required in order to know what parameters the
connection is currently using.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
98a0b845c63cb74e90a72d1e864ea4be968bdd83 31-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix differentiating stored master vs slave LTK types

If LTK distribution happens in both directions we will have two LTKs for
the same remote device: one which is used when we're connecting as
master and another when we're connecting as slave. When looking up LTKs
from the locally stored list we shouldn't blindly return the first match
but also consider which type of key is in question. If we do not do this
we may end up selecting an incorrect encryption key for a connection.

This patch fixes the issue by always specifying to the LTK lookup
functions whether we're looking for a master or a slave key.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
mp.c
a513e260ce25eaa5e8c6b834a70085be1d6f40c0 31-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary LTK type check from hci_add_ltk

All callers of hci_add_ltk pass a valid value to it. There are no places
where e.g. user space, the controller or the remote peer would be able
to cause invalid values to be passed. Therefore, just remove the
potentially confusing check from the beginning of the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
21b93b75ad1090dd9aed69b56292648bac6666a9 31-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make LTK key type check more readable

Instead of magic bitwise operations simply compare with the two possible
type values that we are interested in.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
f813f1be1f82a09720e94533f46ac79276eb037d 31-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix long_term_keys debugfs output

The code was previously iterating the wrong list (and what's worse
casting entries to a type which they were not) and also missing a proper
line terminator when printing each entry. The code now also prints the
LTK type in hex for easier comparison with the kernel-defined values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
e834004b8a940ab28dace6043985ae2adf305661 30-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove Simultaneous LE & BR/EDR flags from AD

Starting with the 4.1 Core Specification these flags are no longer used
and should always be cleared. From volume 3, part C, section 13.1.1:

"The 'Simultaneous LE and BR/EDR to Same Device Capable (Controller)'
and ‘Simultaneous LE and BR/EDR to Same Device Capable (Host)’ bits in
the Flags AD type shall be set to ‘0’."

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
0cf73b9fa51be32042dad09953f7a82f19933e97 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Enable LTK distribution to slave devices

So far we've only been requesting the LTK to be distributed to the
master (initiator) of pairing, which is usually enough since it's the
master that will establish future connections and initiate encryption.
However, in the case that both devices support switching to the opposing
role (which seems to be increasingly common) pairing will have to
performed again since the "new" master will not have all information.

As there is no real harm in it, this patch updates the code to always
try distributing the LTK also to the slave device, thereby enabling role
switches for future connections.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Vinicius Gomes <vcgomes@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
40456644295998321b8743b72c9cc0e4db937959 29-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increment management interface revision

This patch increments the management interface revision due to the
various fixes, improvements and other changes that have been made.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
7b25c9b3c90150164f36b16cc0107d774eaec68f 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary check for chan->psm

Now that ATT sockets have been converted to use the new L2CAP_CHAN_FIXED
type there is no need to have an extra check for chan->psm in the
l2cap_chan_close function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
d7e5e76b6f4c5848ad3093493bdb226c27d8350e 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Always use l2cap_chan->psm for returning PSM to user space

The l2cap_chan->psm value is always set to a valid value for a
connection oriented channel. The l2cap_chan->sport is used for tracking
local PSM allocations but will not always have a proper value, such as
with connected sockets derived from a listening socket. This patch fixes
the sock_getname callback to always use chan->psm when returning address
information.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
35364c99d20edc7329843e2a6dad6851d77eafd7 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refuse peer RFCOMM address reading when not connected

When we're not connected the peer address information is undefined. This
patch fixes the remote address getting to return a proper error in case
the sate is anything else than BT_CONNECTED.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
b783fbc3a55691f978b9f78d552a0d7e7d2705ad 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refuse peer L2CAP address reading when not connected

When we're not connected the peer address information is undefined. This
patch fixes the remote address getting to return a proper error in case
the state is anything else than BT_CONNECTED.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
61202e4de92d9bf7169dd5f2ef2d6c6e5683ec53 29-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Free up l2cap_chan->sport when initiating a connection

The sport variable is used to track the allocation of the local PSM
database to ensure no two sockets take the same local PSM. It is
acquired upon bind() but needs to be freed up if the socket ends up
becoming a client one. This patch adds the clearing of the value when
l2cap_chan_connect is called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
0f1bfe4e5eb8db9841b57ade1384b9a8ffcd38c3 28-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix disconnecting L2CAP when a credits overflow occurs

The L2CAP specification requires us to disconnect an L2CAP channel if
the remote side gives us credits beyond 65535. This patch makes sure we
disconnect the channel in such a situation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
dfd9774c5ad4abe9d51e52056e441eaf983b9080 28-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix disconnecting L2CAP channel for credits violation

The L2CAP specification requires us to disconnect a channel if the
remote device sends us data when it doesn't have any credits to do so.
This patch makes sure that we send the appropriate L2CAP Disconnect
request in this situation.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
d1d79413ec066b9d13390590be3ff684e2dd3631 28-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix respecting le_default_mps value

There's a le_default_mps variable that can be modified through debugfs
but it was never actually used for determining our MPS value. This patch
fixes the MPS initialization to use the variable instead of a fixed
value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
7a8e5a31ecd50ace4fce57304c8fdd206f013fde 25-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix CID initialization for fixed channels

Fixed channels have the same source and destination CID. Ensure that the
values get properly initialized when receiving incoming connections and
deriving values from the parent socket.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
e0c888ad739513b9baae5c25e85dd6490595e5be 25-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix BT_SECURITY socket option for fixed channels (ATT)

The BT_SECURITY option should also be allowed for fixed channels, so
punch the appropriate hole for it when checking for the channel type.
The main user of fixed CID user space sockets is right now ATT (which is
broken without this patch).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
21626e6214f92aaae580052c760dc85f83b5faef 24-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Switch ATT channels to use L2CAP_CHAN_FIXED

ATT channels are not connection oriented so having them use
L2CAP_CHAN_CONN_ORIENTED is quite confusing. Instead, use the new
L2CAP_CHAN_FIXED type and ensure that the MTU and CID values get
properly set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
2338a7e0440d646c194d421748ea36665e648384 24-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename L2CAP_CHAN_CONN_FIX_A2MP to L2CAP_CHAN_FIXED

There's no reason why A2MP should need or deserve its on channel type.
Instead we should be able to group all fixed CID users under a single
channel type and reuse as much code as possible for them. Where CID
specific exceptions are needed the chan-scid value can be used.

This patch renames the current A2MP channel type to a generic one and
thereby paves the way to allow converting ATT and SMP (and any future
fixed channel protocols) to use the new channel type.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
2cap_core.c
03a0c5d61c878e3196b80fa9dc9fbae0fb2eb8f8 18-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless l2cap_seq_list_remove function

The only user of l2cap_seq_list_remove() was l2cap_seq_list_pop() which
only removes the head, meaning only the "else if (seq_list->head ==
seq)" branch was ever being used. This patch moves the code from this
branch straight into l2cap_seq_list_pop() and removes the (now useless)
l2cap_seq_list_remove().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
61a939c68ee033d43be3aa436d95eb8afdd16142 17-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Queue incoming ACL data until BT_CONNECTED state is reached

This patch adds a queue for incoming L2CAP data that's received before
l2cap_connect_cfm is called and processes the data once
l2cap_connect_cfm is called. This way we ensure that we have e.g. all
remote features before processing L2CAP signaling data (which is very
important for making the correct security decisions).

The processing of the pending rx data needs to be done through
queue_work since unlike l2cap_recv_acldata, l2cap_connect_cfm is called
with the hci_dev lock held which could cause potential deadlocks.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
162b49e75cf2c6858852e7a0ae2c2e30e51f0e09 17-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reorder L2CAP functions to avoid forward declarations

This patch moves the l2cap_conn_add, is_valid_psm and l2cap_chan_connect
functions further down in l2cap_core.c. The patch doesn't contain
anything else except the relocation of these functions. By moving the
functions further down the patch enables a subsequent patch that adds a
pending RX queue to be implemented without a forward declaration of a
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
134c2a89af22f500b1d7525d663fddda345ff01e 16-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add debugfs entry to show Secure Connections Only mode

For debugging purposes of Secure Connection Only support a simple
debugfs entry is used to indicate if this mode is active or not.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2c068e0b924c6fabd9a2ac59bc451b4b656cbae3 16-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Handle security level 4 for RFCOMM connections

With the introduction of security level 4, the RFCOMM sockets need to
be made aware of this new level. This change ensures that the pairing
requirements are set correctly for these connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/core.c
fcomm/sock.c
7d513e9243afd01df315db45ffe96a6e3688e612 16-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Handle security level 4 for L2CAP connections

With the introduction of security level 4, the L2CAP sockets need to
be made aware of this new level. This change ensures that the pairing
requirements are set correctly for these connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
7b5a9241b780ea2f77e71647bc0d3c9708c18ef1 16-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce requirements for security level 4

The security level 4 is a new strong security requirement that is based
around 128-bit equivalent strength for link and encryption keys required
using FIPS approved algorithms. Which means that E0, SAFER+ and P-192
are not allowed. Only connections created with P-256 resulting from
using Secure Connections support are allowed.

This security level needs to be enforced when Secure Connection Only
mode is enabled for a controller or a service requires FIPS compliant
strong security. Currently it is not possible to enable either of
these two cases. This patch just puts in the foundation for being
able to handle security level 4 in the future.

It should be noted that devices or services with security level 4
requirement can only communicate using Bluetooth 4.1 controllers
with support for Secure Connections. There is no backward compatibilty
if used with older hardware.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
eb9a8f3fb6762a4e6ae0aa9e96532c9c544f400e 16-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Track Secure Connections support of remote devices

It is important to know if Secure Connections support has been enabled
for a given remote device. The information is provided in the remote
host features page. So track this information and provide a simple
helper function to extract the status.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
eadd663a6ab78df479d116a59368a70dc60d8288 13-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt error code for negative PIN response

The NOT_PAIRED status is only really suitable for operations where being
paired is a pre-requisite. Using it e.g. for the mgmt_pair_device
command seems unintuitive. In the case that either the local or the
remote user responds with a negative PIN Code response the "PIN or Key
Missing" HCI status will be generated. This patch changes the mapping of
this status from the NOT_PAIRED mgmt status to the more intuitive
AUTH_FAILED mgmt status.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b848079a5e55480e16439af62c94f02ca1e33b08 07-Jan-2014 Wei Yongjun <yongjun_wei@trendmicro.com.cn> Bluetooth: Convert to use ATTRIBUTE_GROUPS macro

Use ATTRIBUTE_GROUPS macro to reduce the number of lines of code.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
ec1091131f9b53ea280247b5a01a617ce87d399e 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for remote OOB input of P-256 data

The current management interface only allows to provide the remote
OOB input of P-192 data. This extends the command to also accept
P-256 data as well. To make this backwards compatible, the userspace
can decide to only provide P-192 data or the combined P-192 and P-256
data. It is also allowed to leave the P-192 data empty if userspace
only has the remote P-256 data.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
0798872ef1ad6433362faca1d16a31ad7ad72638 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add internal function for storing P-192 and P-256 data

Add function to allow adding P-192 and P-256 data to the internal
storage. This also fixes a few coding style issues from the previous
helper functions for the out-of-band credentials storage.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
519ca9d017ab7eb4a15787bd8f2d867bebe375bc 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide remote OOB data for Secure Connections

When Secure Connections has been enabled it is possible to provide P-192
and/or P-256 data during the pairing process. The internal out-of-band
credentials storage has been extended to also hold P-256 data.

Initially the P-256 data will be empty and with Secure Connections enabled
no P-256 data will be provided. This is according to the specification
since it might be possible that the remote side did not provide either
of the out-of-band credentials.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
5afeac149ebc94485b750eb841d0f971ea9772cd 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add debugfs quirk for forcing Secure Connections support

The Bluetooth 4.1 specification with Secure Connections support has
just been released and controllers with this feature are still in
an early stage.

A handful of controllers have already support for it, but they do
not always identify this feature correctly. This debugfs entry
allows to tell the kernel that the controller can be treated as
it would fully support Secure Connections.

Using debugfs to force Secure Connections support of course does
not make this feature magically appear in all controllers. This
is a debug functionality for early adopters. Once the majority
of controllers matures this quirk will be removed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
4d2d27962642e23f88745b0430d47c3ff75afdd3 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for local OOB data with Secure Connections

For Secure Connections support and the usage of out-of-band pairing,
it is needed to read the P-256 hash and randomizer or P-192 hash and
randomizer. This change will read P-192 data when Secure Connections
is disabled and P-192 and P-256 data when it is enabled.

The difference is between using HCI Read Local OOB Data and using the
new HCI Read Local OOB Extended Data command. The first one has been
introduced with Bluetooth 2.1 and returns only the P-192 data.

< HCI Command: Read Local OOB Data (0x03|0x0057) plen 0
> HCI Event: Command Complete (0x0e) plen 36
Read Local OOB Data (0x03|0x0057) ncmd 1
Status: Success (0x00)
Hash C from P-192: 975a59baa1c4eee391477cb410b23e6d
Randomizer R with P-192: 9ee63b7dec411d3b467c5ae446df7f7d

The second command has been introduced with Bluetooth 4.1 and will
return P-192 and P-256 data.

< HCI Command: Read Local OOB Extended Data (0x03|0x007d) plen 0
> HCI Event: Command Complete (0x0e) plen 68
Read Local OOB Extended Data (0x03|0x007d) ncmd 1
Status: Success (0x00)
Hash C from P-192: 6489731804b156fa6355efb8124a1389
Randomizer R with P-192: 4781d5352fb215b2958222b3937b6026
Hash C from P-256: 69ef8a928b9d07fc149e630e74ecb991
Randomizer R with P-256: 4781d5352fb215b2958222b3937b6026

The change for the management interface is transparent and no change
is required for existing userspace. The Secure Connections feature
needs to be manually enabled. When it is disabled, then userspace
only gets the P-192 returned and with Secure Connections enabled,
userspace gets P-192 and P-256 in an extended structure.

It is also acceptable to just ignore the P-256 data since it is not
required to support them. The pairing with out-of-band credentials
will still succeed. However then of course no Secure Connection will
b established.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
8e99113277fb9f7b8b28fbcc866a359d2fa1ba41 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Limit acceptable link key types to only supported ones

The link keys that are loaded by userspace during controller setup
should be limited to actual valid and supported types. With the
support for Secure Connections, it is limited to types 0x00 - 0x08
at the moment. Reject any other link key types.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
a6d0d690e1bd56ce031f38a3144cb9f6ea23456f 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable Secure Connection during power on if configured

If support for Secure Connection has been configured, then make sure
to send the appropiate HCI command to enable it when powering on the
controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
eac83dc632a7afba72f7084266bc310219486253 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command for enabling Secure Connections

The support for Secure Connections need to be explicitly enabled by
userspace. This is required since only userspace that can handle the
new link key types should enable support for Secure Connections.

This command handling is similar to how Secure Simple Pairing enabling
is done. It also tracks the case when Secure Connections support is
enabled via raw HCI commands. This makes sure that the host features
page is updated as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
e98d2ce293a941d41b5c8435975ff25a1b858bf9 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add flags and setting for Secure Connections support

The MGMT_SETTING_SECURE_CONN setting is used to track the support and
status for Secure Connections from the management interface. For HCI
based tracking HCI_SC_ENABLED flag is used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
40c59fcbcdc25d5b1aafef23b94167c2376b0dce 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable Authenticated Payload Timeout Expired event

With Secure Connections capable controllers, the authenticated payload
timeout can trigger. Enable the event so the controller informs the
host when this happens.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
66138ce8e556a8ddd13baf035fb3a8d0d6dd4bb5 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for handling P-256 derived link keys

Before being able to enable Secure Connections support, the core needs
to know on how to handle P-256 derived link keys. The difference between
authenticated and unauthenticated P-256 derived link keys is the same as
its P-192 counter parts.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_event.c
11015c7903c74350402f8753339c48bee0186e90 10-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add definitions for new link key types

With the introduction of Secure Connections, the list of link key types
got extended by P-256 versions of authenticated and unauthenticated
link keys.

To avoid any confusion the previous authenticated and unauthenticated
link key types got ammended with a P912 postfix. And the two new keys
have a P256 postfix now. Existing code using the previous definitions
has been adjusted.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_event.c
264b8b4e973f8741adf530a388be72af4bfee953 08-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix outgoing authentication requirement check

The check for HIGH security level dates back to pre-mgmt times when a
raw L2CAP socket with HIGH security level was used to trigger dedicated
bonding. For legacy pairing checking for the security level was the only
way to catch the need to authenticate in all scenarios. With mgmt
however, the pair_device command does not use HIGH security but MEDIUM
security. Therefore, the existing code would never trigger
authentication for a non-SSP connection without an MITM requirement
(e.g. if user space provided a NoInputNoOutput IO capability). In such a
scenario the mgmt_pair_device command would return success without
actually triggering any kind of pairing.

This patch updates the authentication requirement check to also consider
MEDIUM security level, and thereby ensures that mgmt_pair_device will
always trigger authentication.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0a7f364e812285246cd617a51194a3f8bd0e8daa 22-Jan-2014 Frank Praznik <frank.praznik@oh.rr.com> HID: Add the transport-driver functions to the HIDP driver.

Add raw_request, set_raw_report and output_report transport-driver functions to
the HIDP driver.

Signed-off-by: Frank Praznik <frank.praznik@oh.rr.com>
Acked-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
342dfc306fb32155314dad277f3c3686b83fb9f1 17-Jan-2014 Steffen Hurrle <steffen@hurrle.net> net: add build-time checks for msg->msg_name size

This is a follow-up patch to f3d3342602f8bc ("net: rework recvmsg
handler msg_name and msg_namelen logic").

DECLARE_SOCKADDR validates that the structure we use for writing the
name information to is not larger than the buffer which is reserved
for msg->msg_name (which is 128 bytes). Also use DECLARE_SOCKADDR
consistently in sendmsg code paths.

Signed-off-by: Steffen Hurrle <steffen@hurrle.net>
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_sock.c
c91514972b9bb8d9419c4b7fa30e0bca7eb60291 17-Jan-2014 Stephen Warren <swarren@nvidia.com> Bluetooth: remove direct compilation of 6lowpan_iphc.c

It's now built as a separate utility module, and enabling BT selects
that module in Kconfig. This fixes:

net/ieee802154/built-in.o:(___ksymtab_gpl+lowpan_process_data+0x0): multiple definition of `__ksymtab_lowpan_process_data'
net/bluetooth/built-in.o:(___ksymtab_gpl+lowpan_process_data+0x0): first defined here
net/ieee802154/built-in.o:(___ksymtab_gpl+lowpan_header_compress+0x0): multiple definition of `__ksymtab_lowpan_header_compress'
net/bluetooth/built-in.o:(___ksymtab_gpl+lowpan_header_compress+0x0): first defined here
net/ieee802154/built-in.o: In function `lowpan_header_compress':
net/ieee802154/6lowpan_iphc.c:606: multiple definition of `lowpan_header_compress'
net/bluetooth/built-in.o:/home/swarren/shared/git_wa/kernel/kernel.git/net/bluetooth/../ieee802154/6lowpan_iphc.c:606: first defined here
net/ieee802154/built-in.o: In function `lowpan_process_data':
net/ieee802154/6lowpan_iphc.c:344: multiple definition of `lowpan_process_data'
net/bluetooth/built-in.o:/home/swarren/shared/git_wa/kernel/kernel.git/net/bluetooth/../ieee802154/6lowpan_iphc.c:344: first defined here
make[1]: *** [net/built-in.o] Error 1

(this change probably simply wasn't "git add"d to a53d34c3465b)

Fixes: a53d34c3465b ("net: move 6lowpan compression code to separate module")
Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
akefile
a53d34c3465b8a840f7400932ae1b0a9f9ed6bef 14-Jan-2014 Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com> net: move 6lowpan compression code to separate module

IEEE 802.15.4 and Bluetooth networking stacks share 6lowpan compression
code. Instead of introducing Makefile/Kconfig hacks, build this code as
a separate module referenced from both ieee802154 and bluetooth modules.

This fixes the following build error observed in some kernel
configurations:

net/built-in.o: In function `header_create': 6lowpan.c:(.text+0x166149): undefined reference to `lowpan_header_compress'
net/built-in.o: In function `bt_6lowpan_recv': (.text+0x166b3c): undefined reference to `lowpan_process_data'

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin@mentor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
config
235f93922878234f3d99a4205ebe3634ee955919 10-Jan-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
net/ieee802154/6lowpan.c
300e5fd160114920079dd3ec132e5c01d00e4a1d 08-Jan-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
e825eb1d7e06f616003c17e2e8e421c2e5e44142 07-Jan-2014 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Fix 6loWPAN peer lookup

This patch fixes peer address lookup for 6loWPAN over Bluetooth Low
Energy links.

ADDR_LE_DEV_PUBLIC, and ADDR_LE_DEV_RANDOM are the values allowed for
"dst_type" field in the hci_conn struct for LE links.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
lowpan.c
b071a620995def138bf5f5da8440d93bde4171d3 07-Jan-2014 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Fix setting Universal/Local bit

This patch fixes the Bluetooth Low Energy Address type checking when
setting Universal/Local bit for the 6loWPAN network device or for the
peer device connection.

ADDR_LE_DEV_PUBLIC or ADDR_LE_DEV_RANDOM are the values allowed for
"src_type" and "dst_type" in the hci_conn struct. The Bluetooth link
type can be obtainned reading the "type" field in the same struct.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
lowpan.c
56a4342dfe3145cd66f766adccb28fd9b571606d 06-Jan-2014 David S. Miller <davem@davemloft.net> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
net/ipv6/ip6_tunnel.c
net/ipv6/ip6_vti.c

ipv6 tunnel statistic bug fixes conflicting with consolidation into
generic sw per-cpu net stats.

qlogic conflict between queue counting bug fix and the addition
of multiple MAC address support.

Signed-off-by: David S. Miller <davem@davemloft.net>
f86772af6a0f643d3e13eb3f4f9213ae0c333ee4 06-Jan-2014 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Remove rfcomm_carrier_raised()

Remove the rfcomm_carrier_raised() definition as that function isn't
used anymore.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
4a2fb3ecc7467c775b154813861f25a0ddc11aa0 06-Jan-2014 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Always wait for a connection on RFCOMM open()

This patch fixes two regressions introduced with the recent rfcomm tty
rework.

The current code uses the carrier_raised() method to wait for the
bluetooth connection when a process opens the tty.

However processes may open the port with the O_NONBLOCK flag or set the
CLOCAL termios flag: in these cases the open() syscall returns
immediately without waiting for the bluetooth connection to
complete.

This behaviour confuses userspace which expects an established bluetooth
connection.

The patch restores the old behaviour by waiting for the connection in
rfcomm_dev_activate() and removes carrier_raised() from the tty_port ops.

As a side effect the new code also fixes the case in which the rfcomm
tty device is created with the flag RFCOMM_REUSE_DLC: the old code
didn't call device_move() and ModemManager skipped the detection
probe. Now device_move() is always called inside rfcomm_dev_activate().

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reported-by: Andrey Vihrov <andrey.vihrov@gmail.com>
Reported-by: Beson Chow <blc+bluez@mail.vanade.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
e228b63390536f5b737056059a9a04ea016b1abf 06-Jan-2014 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Move rfcomm_get_device() before rfcomm_dev_activate()

This is a preparatory patch which moves the rfcomm_get_device()
definition before rfcomm_dev_activate() where it will be used.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
5b899241874dcc1a2b932a668731c80a3a869575 06-Jan-2014 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Release RFCOMM port when the last user closes the TTY

This patch fixes a userspace regression introduced by the commit
29cd718b.

If the rfcomm device was created with the flag RFCOMM_RELEASE_ONHUP the
user space expects that the tty_port is released as soon as the last
process closes the tty.

The current code attempts to release the port in the function
rfcomm_dev_state_change(). However it won't get a reference to the
relevant tty to send a HUP: at that point the tty is already destroyed
and therefore NULL.

This patch fixes the regression by taking over the tty refcount in the
tty install method(). This way the tty_port is automatically released as
soon as the tty is destroyed.

As a consequence the check for RFCOMM_RELEASE_ONHUP flag in the hangup()
method is now redundant. Instead we have to be careful with the reference
counting in the rfcomm_release_dev() function.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reported-by: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
9d1cd503c7618d2eb00746fa1ebb06a723e108b4 06-Jan-2014 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
cb6ca8e1ed922082bacc6e5e5ee040491a443ea2 06-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Default to no security with L2CAP RAW sockets

L2CAP RAW sockets can be used for things which do not involve
establishing actual connection oriented L2CAP channels. One example of
such usage is the l2ping tool. The default security level for L2CAP
sockets is LOW, which implies that for SSP based connection
authentication is still requested (although with no MITM requirement),
which is not what we want (or need) for things like l2ping. Therefore,
default to one lower level, i.e. BT_SECURITY_SDP, for L2CAP RAW sockets
in order not to trigger unwanted authentication requests.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
8cef8f50d47169b122d7e2dc51fd4370fadd6bfa 06-Jan-2014 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix NULL pointer dereference when disconnecting

When disconnecting it is possible that the l2cap_conn pointer is already
NULL when bt_6lowpan_del_conn() is entered. Looking at l2cap_conn_del
also verifies this as there's a NULL check there too. This patch adds
the missing NULL check without which the following bug may occur:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<c131e9c7>] bt_6lowpan_del_conn+0x19/0x12a
*pde = 00000000
Oops: 0000 [#1] SMP
CPU: 1 PID: 52 Comm: kworker/u5:1 Not tainted 3.12.0+ #196
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Workqueue: hci0 hci_rx_work
task: f6259b00 ti: f48c0000 task.ti: f48c0000
EIP: 0060:[<c131e9c7>] EFLAGS: 00010282 CPU: 1
EIP is at bt_6lowpan_del_conn+0x19/0x12a
EAX: 00000000 EBX: ef094e10 ECX: 00000000 EDX: 00000016
ESI: 00000000 EDI: f48c1e60 EBP: f48c1e50 ESP: f48c1e34
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 30c65000 CR4: 00000690
Stack:
f4d38000 00000000 f4d38000 00000002 ef094e10 00000016 f48c1e60 f48c1e70
c1316bed f48c1e84 c1316bed 00000000 00000001 ef094e10 f48c1e84 f48c1ed0
c1303cc6 c1303c7b f31f331a c1303cc6 f6e7d1c0 f3f8ea16 f3f8f380 f4d38008
Call Trace:
[<c1316bed>] l2cap_disconn_cfm+0x3f/0x5b
[<c1316bed>] ? l2cap_disconn_cfm+0x3f/0x5b
[<c1303cc6>] hci_event_packet+0x645/0x2117
[<c1303c7b>] ? hci_event_packet+0x5fa/0x2117
[<c1303cc6>] ? hci_event_packet+0x645/0x2117
[<c12681bd>] ? __kfree_skb+0x65/0x68
[<c12681eb>] ? kfree_skb+0x2b/0x2e
[<c130d3fb>] ? hci_send_to_sock+0x18d/0x199
[<c12fa327>] hci_rx_work+0xf9/0x295
[<c12fa327>] ? hci_rx_work+0xf9/0x295
[<c1036d25>] process_one_work+0x128/0x1df
[<c1346a39>] ? _raw_spin_unlock_irq+0x8/0x12
[<c1036d25>] ? process_one_work+0x128/0x1df
[<c103713a>] worker_thread+0x127/0x1c4
[<c1037013>] ? rescuer_thread+0x216/0x216
[<c103aec6>] kthread+0x88/0x8d
[<c1040000>] ? task_rq_lock+0x37/0x6e
[<c13474b7>] ret_from_kernel_thread+0x1b/0x28
[<c103ae3e>] ? __kthread_parkme+0x50/0x50
Code: 05 b8 f4 ff ff ff 8d 65 f4 5b 5e 5f 5d 8d 67 f8 5f c3 57 8d 7c 24 08 83 e4 f8 ff 77 fc 55 89 e5 57 56f
EIP: [<c131e9c7>] bt_6lowpan_del_conn+0x19/0x12a SS:ESP 0068:f48c1e34
CR2: 0000000000000000

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
f9f462faa02777f497eb25255683a94e0c054de6 03-Jan-2014 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add quirk for disabling Delete Stored Link Key command

Some controller pretend they support the Delete Stored Link Key command,
but in reality they really don't support it.

< HCI Command: Delete Stored Link Key (0x03|0x0012) plen 7
bdaddr 00:00:00:00:00:00 all 1
> HCI Event: Command Complete (0x0e) plen 4
Delete Stored Link Key (0x03|0x0012) ncmd 1
status 0x11 deleted 0
Error: Unsupported Feature or Parameter Value

Not correctly supporting this command causes the controller setup to
fail and will make a device not work. However sending the command for
controller that handle stored link keys is important. This quirk
allows a driver to disable the command if it knows that this command
handling is broken.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
b7e047358449f8eb5cba8197b42280b676b82e54 18-Dec-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
1bc5ad168f441f6f8bfd944288a5f7b4963ac1f6 17-Dec-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix HCI User Channel permission check in hci_sock_sendmsg

The HCI User Channel is an admin operation which enforces CAP_NET_ADMIN
when binding the socket. Problem now is that it then requires also
CAP_NET_RAW when calling into hci_sock_sendmsg. This is not intended
and just an oversight since general HCI sockets (which do not require
special permission to bind) and HCI User Channel share the same code
path here.

Remove the extra CAP_NET_RAW check for HCI User Channel write operation
since the permission check has already been enforced when binding the
socket. This also makes it possible to open HCI User Channel from a
privileged process and then hand the file descriptor to an unprivilged
process.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
787949039fcd87b58aabeb494d031912209086ae 14-Dec-2013 Wei Yongjun <yongjun_wei@trendmicro.com.cn> Bluetooth: fix return value check

In case of error, the function bt_skb_alloc() returns NULL pointer
not ERR_PTR(). The IS_ERR() test in the return value check should
be replaced with NULL test.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
05c75e36710f74fc5a7618966b78818ec0d62567 13-Dec-2013 Wei Yongjun <yongjun_wei@trendmicro.com.cn> Bluetooth: remove unused including <linux/version.h>

Remove including <linux/version.h> that don't need it.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
f647a52e1576f9c92cc9c02d5756cd0207295a2b 13-Dec-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
841a5ec72c028432f716670c4a7c2e1b70ee1341 12-Dec-2013 Alexander Aring <alex.aring@gmail.com> 6lowpan: fix/move/cleanup debug functions

There are several issues on current debug behaviour.
This patch fix the following issues:

- Fix debug printout only if DEBUG is defined.
- Move debug functions of 6LoWPAN code into 6lowpan header.
- Cleanup codestyle of debug functions.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
30d3db44bb337321b25344eea3ed6a64ee16fcc8 12-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix test for lookup_dev return value

The condition wouldn't have previously caused -ENOENT to be returned if
dev was NULL. The proper condition should be if (!dev || !dev->netdev).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
d0746f3ecc884a5b044d92d463f0e2ec1507fc78 12-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing 6lowpan.h include

The 6lowpan.c file was missing an #include statement for 6lowpan.h.
Without it we get the following type of warnings:

net/bluetooth/6lowpan.c:320:5: warning: symbol 'bt_6lowpan_recv' was not declared. Should it be static?
net/bluetooth/6lowpan.c:737:5: warning: symbol 'bt_6lowpan_add_conn' was not declared. Should it be static?
net/bluetooth/6lowpan.c:805:5: warning: symbol 'bt_6lowpan_del_conn' was not declared. Should it be static?
net/bluetooth/6lowpan.c:878:5: warning: symbol 'bt_6lowpan_init' was not declared. Should it be static?
net/bluetooth/6lowpan.c:883:6: warning: symbol 'bt_6lowpan_cleanup' was not declared. Should it be static?

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
89863109e3dd562529ffd8a559b0de068d1d8502 11-Dec-2013 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: Manually enable or disable 6LoWPAN between devices

This is a temporary patch where user can manually enable or
disable BT 6LoWPAN functionality between devices.
Eventually the connection is established automatically if
the devices are advertising suitable capability and this patch
can be removed.

Before connecting the devices do this

echo Y > /sys/kernel/debug/bluetooth/hci0/6lowpan

This enables 6LoWPAN support and creates the bt0 interface
automatically when devices are finally connected.

Rebooting or unloading the bluetooth kernel module will also clear the
settings from the kernel.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
18722c247023035b9e2e2a08a887adec2a9a6e49 11-Dec-2013 Jukka Rissanen <jukka.rissanen@linux.intel.com> Bluetooth: Enable 6LoWPAN support for BT LE devices

This is initial version of
http://tools.ietf.org/html/draft-ietf-6lo-btle-00

By default the 6LoWPAN support is not activated and user
needs to tweak /sys/kernel/debug/bluetooth/hci0/6lowpan
file.

The kernel needs IPv6 support before 6LoWPAN is usable.

Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
lowpan.c
lowpan.h
akefile
ci_event.c
2cap_core.c
71fb419724fadab4efdf98210aa3fe053bd81d29 10-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix handling of L2CAP Command Reject over LE

If we receive an L2CAP command reject message over LE we should take
appropriate action on the corresponding channel. This is particularly
important when trying to interact with a remote pre-4.1 system using LE
CoC signaling messages. If we don't react to the command reject the
corresponding socket would not be notified until a connection timeout
occurs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
53b834d2333aec1e60fcbfadfddd4ad472329570 08-Dec-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use macros for connectionless slave broadcast features

Add the LMP feature constants for connectionless slave broadcast
and use them for capability testing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
c6d1649050aa7da42f9c0901dc7fa3971254648f 07-Dec-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increase minor version of core module

With the addition of L2CAP Connection Oriented Channels for Bluetooth
Low Energy connections, it makes sense to increase the minor version
of the Bluetooth core module.

The module version is not used anywhere, but it gives a nice extra
hint for debugging purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
c057b190b82063c57cb8b2b575a00520f9976e2b 06-Dec-2013 Jeff Kirsher <jeffrey.t.kirsher@intel.com> net/*: Fix FSF address in file headers

Several files refer to an old address for the Free Software Foundation
in the file header comment. Resolve by replacing the address with
the URL <http://www.gnu.org/licenses/> so that we do not have to keep
updating the header comments anytime the address changes.

CC: John Fastabend <john.r.fastabend@intel.com>
CC: Alex Duyck <alexander.h.duyck@intel.com>
CC: Marcel Holtmann <marcel@holtmann.org>
CC: Gustavo Padovan <gustavo@padovan.org>
CC: Johan Hedberg <johan.hedberg@gmail.com>
CC: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
c8afe8d0ad796b6dae545ceeed652b2c52ca7cf6 06-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix valid LE PSM check

The range of valid LE PSMs is 0x0001-0x00ff so the check should be for
"less than or equal to" instead of "less than".

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
f1324ea50b2e48d30fbeac591771fdceac9315ca 06-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use min_t for calculating chan->mps

Since there's a nice convenient helper for calculating the minimum of
two values, let's use that one.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
0ce43ce60d5e0c079d33be1fe33ba92828c7e5da 05-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify l2cap_chan initialization for LE CoC

The values in l2cap_chan that are used for actually transmitting data
only need to be initialized right after we've received an L2CAP Connect
Request or just before we send one. The only thing that we need to
initialize though bind() and connect() is the chan->mode value. This way
all other initializations can be done in the l2cap_le_flowctl_init
function (which now becomes private to l2cap_core.c) and the
l2cap_le_flowctl_start function can be completely removed.

Also, since the l2cap_sock_init function initializes the imtu and omtu
to adequate values these do not need to be part of l2cap_le_flowctl_init.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
f15b8ecf9895941ef50134ff604be8bd2c6b1b78 03-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add debugfs controls for LE CoC MPS and Credits

This patch adds entries to debugfs to control the values used for the
MPS and Credits for LE Flow Control Mode.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
4946096d43d1d02fb07cc80f82e1747b01571c41 08-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix validating LE PSM values

LE PSM values have different ranges than those for BR/EDR. The valid
ranges for fixed, SIG assigned values is 0x0001-0x007f and for dynamic
PSM values 0x0080-0x00ff. We need to ensure that bind() and connect()
calls conform to these ranges when operating on LE CoC sockets.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
e77af7559238895ec5fd1706762e1c9f890dcc7e 08-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix CID ranges for LE CoC CID allocations

LE CoC used differend CIC ranges than BR/EDR L2CAP. The start of the
range is the same (0x0040) but the range ends at 0x007f (unlike BR/EDR
where it goes all the way to 0xffff).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
aeddd075d5483cc9a34cd98b0df967f28d651f93 07-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing of chan->omtu for LE CoC channels

The outgoing MTU should only be set upon channel creation to the initial
minimum value (23) or from a remote connect req/rsp PDU.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
3916aed81f1fd07f71a597080690d36f02e88850 07-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Limit LE MPS to the MTU value

It doesn't make sense to have an MPS value greater than the configured
MTU value since we will then not be able to fill up the packets to their
full possible size. We need to set the MPS both in flowctl_init()
as well as flowctl_start() since the imtu may change after init() but
start() is only called after we've sent the LE Connection Request PDU
which depends on having a valid MPS value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
029727a39a4316c081347749d5c25f76d5eb891c 07-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix suspending the L2CAP socket if we start with 0 credits

If the peer gives us zero credits in its connection request or response
we must call the suspend channel callback so the BT_SK_SUSPEND flag gets
set and user space is blocked from sending data to the socket.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
595177f311f5d42804f729e927f7eac87bbcc21b 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix LE L2CAP Connect Request handling together with SMP

Unlike BR/EDR, for LE when we're in the BT_CONNECT state we may or may
not have already have sent the Connect Request. This means that we need
some extra tracking of the request. This patch adds an extra channel
flag to prevent the request from being sent a second time.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
aac23bf636593cc2d67144aed373a46a1a5f76b1 01-Jun-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Implement LE L2CAP reassembly

When receiving fragments over an LE Connection oriented Channel they
need to be collected up and eventually merged into a single SDU. This
patch adds the necessary code for collecting up the fragment skbs to the
channel context and passing them to the recv() callback when the entire
SDU has been received.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
177f8f2b1259a1292a09a1b7563ebb90675f88ff 31-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add LE L2CAP segmentation support for outgoing data

This patch adds segmentation support for outgoing data packets. Packets
are segmented based on the MTU and MPS values. The l2cap_chan struct
already contains many helpful variables from BR/EDR Enhanced L2CAP which
can be used for this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
837776f7904024df451422f32b09c67e88ae2aa2 15-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce L2CAP channel callback for suspending

Setting the BT_SK_SUSPEND socket flag from the L2CAP core is causing a
dependency on the socket. So instead of doing that, use a channel
callback into the socket handling to suspend.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
3af8ace653c83c663d4b97c6ea7f01463d366bf9 03-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reject LE CoC commands when the feature is not enabled

Since LE CoC support needs to be enabled through a module option for now
we need to reject any related signaling PDUs in addition to rejecting
the creation of LE CoC sockets (which we already do).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
fad5fc89594de31388572a26f33caa7c30a23782 05-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add LE flow control discipline

This patch adds the necessary discipline for reacting to LE L2CAP
Credits packets, sending those packets, and modifying the known credits
accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
b1c325c23d75c5e27607fdcc89bc9bf80af0ba9b 05-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Implement returning of LE L2CAP credits

We should return credits to the remote side whenever they fall below a
certain level (in our case under half of the initially given amount).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
1f435424ce2c93c31c3887ec67e3afb6056f18f6 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add new BT_SNDMTU and BT_RCVMTU socket options

This patch adds new socket options for LE sockets since the existing
L2CAP_OPTIONS socket option is not usable for LE. For now, the new
socket options also require LE CoC support to be explicitly enabled to
leave some playroom in case something needs to be changed in a backwards
incompatible way.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
64b4f8dc763d5c26dea0f483d6e475540eaf9759 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Limit L2CAP_OPTIONS socket option usage with LE

Most of the values in L2CAP_OPTIONS are not applicable for LE and those
that are have different semantics. It makes therefore sense to
completely block this socket option for LE and add (in a separate patch)
a new socket option for tweaking the values that do make sense (mainly
the send and receive MTU). Legacy user space ATT code still depends on
getsockopt for L2CAP_OPTIONS though so we need to plug a hole for that
for backwards compatibility.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
0cd75f7ed740a8c605fe55ac71a9b5162c612422 17-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track LE L2CAP credits in l2cap_chan

This patch adds tracking of L2CAP connection oriented channel local and
remote credits to struct l2cap_chan and ensures that connect requests
and responses contain the right values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
3831971355d901ccfb76533a422b4395072849a3 16-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add LE L2CAP flow control mode

The LE connection oriented channels have their own mode with its own
data transfer rules. In order to implement this properly we need to
distinguish L2CAP channels operating in this mode from other modes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
b5ecba642290a0f28a2dca15e4fdf2a9779bc116 01-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make l2cap_le_sig_cmd logic consistent

This patch makes the error handling and return logic of l2cap_le_sig_cmd
consistent with its BR/EDR counterpart.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
3defe01a4839978f0822b63f21bb6ed676e866e3 15-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add L2CAP Disconnect suppport for LE

The normal L2CAP Disconnect request and response are also used for LE
connection oriented channels. Therefore, we can simply use the existing
handler functions for terminating LE based L2CAP channels.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
cea04ce35eb3e2e53e7c7bb8ebe9c10312f79b84 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP channel closing for LE connections

Sending of the L2CAP Disconnect request should also be performed for LE
based channels. The proper thing to do is therefore to look at whether
there's a PSM specified for the channel instead of looking at the link
type.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add basic LE L2CAP connect request receiving support

This patch adds the necessary boiler plate code to handle receiving
L2CAP connect requests over LE and respond to them with a proper connect
response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
791d60f71a8d743df17a5029bb080a24afc4fff6 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor L2CAP connect rejection to its own function

We'll need to have a separate code path for LE based connection
rejection so it's cleaner to move out the response construction code
into its own function (and later a second one for LE).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
ad32a2f5ced269f5516950fc8f52b6673462d208 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add smp_sufficient_security helper function

This function is needed both by the smp_conn_security function as well
as upcoming code to check for the security requirements when receiving
an L2CAP connect request over LE.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
mp.h
f1496dee9cbde2a62821f4441dadb0d3360f60c3 13-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add initial code for LE L2CAP Connect Request

This patch adds the necessary code to send an LE L2CAP Connect Request
and handle its response when user space has provided us with an LE
socket with a PSM instead of a fixed CID.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
96ac34fb4050e358eed55ac93572f58191a304aa 13-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move LE L2CAP initiator procedure to its own function

Once connection oriented L2CAP channels over LE are supported they will
need a completely separate handling from BR/EDR channels.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
203e639ecbcc66c7c4d55f1f59bc61a1c1ca495d 15-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass command length to LE signaling channel handlers

The LE signaling PDU length is already calculated in the
l2cap_le_sig_channel function so we can just pass the value to the
various handler functions to avoid unnecessary recalculations (byte
order conversions). Right now the only user is the connection parameter
update procedure, but as new LE signaling operations become available
(for connection oriented channels) they will also be able to make use of
the value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
a17de2fe02b1853f115a841bf707f6a75bc6da22 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Allow l2cap_chan_check_security() to be used for LE links.

With connection oriented L2CAP channels some code paths will be shared
with BR/EDR links. It is therefore necessary to allow the
l2cap_chan_check_security function to be usable also for LE links in
addition to BR/EDR ones. This means that smp_conn_security() needs to be
called instead of hci_conn_security() in the case of an LE link.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
bf20fd4ec1d39df78e31fd7c7a4066f69b8bcd8a 14-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update l2cap_global_chan_by_psm() to take a link type

Once connection oriented L2CAP channels become possible for LE we need
to be able to specify the link type we're interested in when looking up
L2CAP channels. Therefore, add a link_type parameter to the
l2cap_global_chan_by_psm() function which gets compared to the address
type associated with each l2cap_chan.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
9149761ad74f618371b58fd37141d4c3706d88fc 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add module parameter to enable LE CoC support

Along with the L2CAP Connection Oriented Channels features it is now
allowed to use both custom fixed CIDs as well as PSM based (connection
oriented connections). Since the support for this (with the subsequent
patches) is still on an experimental stage, add a module parameter to
enable it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
6d3c15da1ddbffff2d0f50132a239209b2fa138e 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary braces from one-line if-statement

This patch is just a trivial coding style fix to remove unnecessary
braces from a one-line if-statement.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
201a5929c8c788f9ef53b010065c9ce70c9c06f0 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove dead code from SMP encryption function

The AES cipher is used in ECB mode by SMP and therefore doesn't use an
IV (crypto_blkcipher_ivsize returns 0) so the code trying to set the IV
was never getting called. Simply remove this code to avoid anyone from
thinking it actually makes some difference.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
e84a6b139bdd3af2914f194ff840b1a36fa55598 02-Dec-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless smp_rand function

This function was always just making a single get_random_bytes() call
and always returning the value 0. It's simpler to just call
get_random_bytes() directly where needed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
3846220b0df414816d00365cec559ff3c8b7c4bf 07-Nov-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor hci_disconn_complete_evt

hci_disconn_complete_evt() logic is more complicated than what it
should be, making it hard to follow and add new features.

So this patch does some code refactoring by handling the error cases
in the beginning of the function and by moving the main flow into the
first level of function scope. No change is done in the event handling
logic itself.

Besides organizing this messy code, this patch makes easier to add
code for handling LE auto connection (which will be added in a further
patch).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
abf54a506d06e0b3ba2c408040e647791af37937 07-Nov-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unneeded check in hci_disconn_complete_evt()

According to b644ba336 (patch that introduced HCI_CONN_MGMT_CONNECTED
flag), the HCI_CONN_MGMT_CONNECTED flag tracks when mgmt has been
notified about the connection.

That being said, there is no point in calling mgmt_disconnect_failed()
conditionally based on this flag. mgmt_disconnect_failed() removes
pending MGMT_OP_DISCONNECT commands, it doesn't matter if that
connection was notified or not.

Moreover, if the Disconnection Complete event has status then we have
nothing else to do but call mgmt_disconnect_failed() and return.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
84794e119a22f67f2cac3f0ae958f2d69c46fa1e 06-Nov-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary 'send' parameter from smp_failure()

The send parameter has only been used for determining whether to send a
Pairing Failed PDU or not. However, the function can equally well use
the already existing reason parameter to make this choice and send the
PDU whenever a non-zero value was passed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
4ebbd5357531694b9243b176674ae27edf5bd8e1 30-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove link type check in hci_disconn_complete_evt()

We can safely remove the link type check from hci_disconn_complete_
evt() since this check in not required for mgmt_disconnect_failed()
and mgmt_device_disconnected() does it internally.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
57eb776feac497c8e5b561c0a24156245f0c08db 30-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add an extra check in mgmt_device_disconnected()

This patch adds an extra check in mgmt_device_disconnected() so we only
send the "Device Disconnected" event if it is ACL_LINK or LE_LINK link
type.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
3655bba8fe693e31c44c43cd30a9aaeee8bd45df 30-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check address in mgmt_disconnect_failed()

Check the address and address type in mgmt_disconnect_failed() otherwise
we may wrongly fail the MGMT_OP_DISCONNECT command.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6a070e6e81adfaed060c5696ef3388126d2165b1 31-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store supported commands only during setup procedure

The list of supported commands of a controller can not change during
its lifetime. So store the list just once during the setup procedure
and not every time the HCI command is executed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
d3d5dd3eb45c37141096c65a3742f4cf38f785ea 31-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove debug statement for features complete event

The complete list of local features are available through debugfs and
so there is no need to add a debug print here.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
bef34c0aa1bdd5bc106697bd7340eb212dcf3c85 29-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set default own address type only during controller setup

The default own address type is currently set at every power on of
a controller. This overwrites the value set via debugfs. To avoid
this issue, set the default own address type only during controller
setup.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
33337dcb891e54d63433101af21fbff0b3f87bfa 23-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix limited discoverable mode for Zeevo modules

There is an old Panasonic module with a Zeevo chip in there that is
not really operating according to Bluetooth core specification when
it comes to setting the IAC LAP for limited discoverable mode.

For reference, this is the vendor information about this module:

< HCI Command: Read Local Version Information (0x04|0x0001) plen 0
> HCI Event: Command Complete (0x0e) plen 12
Read Local Version Information (0x04|0x0001) ncmd 1
Status: Success (0x00)
HCI version: Bluetooth 1.2 (0x02) - Revision 196 (0x00c4)
LMP version: Bluetooth 1.2 (0x02) - Subversion 61 (0x003d)
Manufacturer: Zeevo, Inc. (18)

The module reports only the support for one IAC at a time. And that
is totally acceptable according to the Bluetooth core specification
since the minimum supported IAC is only one.

< HCI Command: Read Number of Supported IAC (0x03|0x0038) plen 0
> HCI Event: Command Complete (0x0e) plen 5
Read Number of Supported IAC (0x03|0x0038) ncmd 1
Status: Success (0x00)
Number of IAC: 1

The problem arises when trying to program two IAC into the module
on a controller that only supports one.

< HCI Command: Write Current IAC LAP (0x03|0x003a) plen 7
Number of IAC: 2
Access code: 0x9e8b00 (Limited Inquiry)
Access code: 0x9e8b33 (General Inquiry)
> HCI Event: Command Status (0x0f) plen 4
Write Current IAC LAP (0x03|0x003a) ncmd 1
Status: Unknown HCI Command (0x01)

While this looks strange, but according to the Bluetooth core
specification it is a legal operation. The controller has to
ignore the other values and only program as many as it supports.

This command shall clear any existing IACs and stores Num_Current_IAC
and the IAC_LAPs in to the controller. If Num_Current_IAC is greater
than Num_Support_IAC then only the first Num_Support_IAC shall be
stored in the controller, and a Command Complete event with error
code Success (0x00) shall be generated.

This specific controller has a bug here and just returns an error. So
in case the number of supported IAC is less than two and the limited
discoverable mode is requested, now only the LIAC is written to
the controller.

< HCI Command: Write Current IAC LAP (0x03|0x003a) plen 4
Number of IAC: 1
Access code: 0x9e8b00 (Limited Inquiry)
> HCI Event: Command Complete (0x0e) plen 4
Write Current IAC LAP (0x03|0x003a) ncmd 1
Status: Success (0x00)

All other controllers that only support one IAC seem to handle this
perfectly fine, but this fix will only write the LIAC for these
controllers as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
7acd71879ce408af2d2ca3cd3ec3a86d0667ceae 21-Nov-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
f3d3342602f8bcbf37d7c46641cb9bca7618eb1c 21-Nov-2013 Hannes Frederic Sowa <hannes@stressinduktion.org> net: rework recvmsg handler msg_name and msg_namelen logic

This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.

This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.

Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.

Also document these changes in include/linux/net.h as suggested by David
Miller.

Changes since RFC:

Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.

With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
msg->msg_name = NULL
".

This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.

Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.

Cc: David Miller <davem@davemloft.net>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
ci_sock.c
fcomm/sock.c
co.c
32019c739c95d056575e0bb2381f2846c0c49944 15-Nov-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
86ca9eac31d0d8c4fe61b5726e6d63197bc435a6 05-Nov-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix rejecting SMP security request in slave role

The SMP security request is for a slave role device to request the
master role device to initiate a pairing request. If we receive this
command while we're in the slave role we should reject it appropriately.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
31e8ce80baa7eaed9eec611deba982b24beed9e5 05-Nov-2013 Seung-Woo Kim <sw0312.kim@samsung.com> Bluetooth: Fix crash in l2cap_chan_send after l2cap_chan_del

Removing a bond and disconnecting from a specific remote device
can cause l2cap_chan_send() is called after l2cap_chan_del() is
called. This causes following crash.

[ 1384.972086] Unable to handle kernel NULL pointer dereference at virtual address 00000008
[ 1384.972090] pgd = c0004000
[ 1384.972125] [00000008] *pgd=00000000
[ 1384.972137] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 1384.972144] Modules linked in:
[ 1384.972156] CPU: 0 PID: 841 Comm: krfcommd Not tainted 3.10.14-gdf22a71-dirty #435
[ 1384.972162] task: df29a100 ti: df178000 task.ti: df178000
[ 1384.972182] PC is at l2cap_create_basic_pdu+0x30/0x1ac
[ 1384.972191] LR is at l2cap_chan_send+0x100/0x1d4
[ 1384.972198] pc : [<c051d250>] lr : [<c0521c78>] psr: 40000113
[ 1384.972198] sp : df179d40 ip : c083a010 fp : 00000008
[ 1384.972202] r10: 00000004 r9 : 0000065a r8 : 000003f5
[ 1384.972206] r7 : 00000000 r6 : 00000000 r5 : df179e84 r4 : da557000
[ 1384.972210] r3 : 00000000 r2 : 00000004 r1 : df179e84 r0 : 00000000
[ 1384.972215] Flags: nZcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 1384.972220] Control: 10c53c7d Table: 5c8b004a DAC: 00000015
[ 1384.972224] Process krfcommd (pid: 841, stack limit = 0xdf178238)
[ 1384.972229] Stack: (0xdf179d40 to 0xdf17a000)
[ 1384.972238] 9d40: 00000000 da557000 00000004 df179e84 00000004 000003f5 0000065a 00000000
[ 1384.972245] 9d60: 00000008 c0521c78 df179e84 da557000 00000004 da557204 de0c6800 df179e84
[ 1384.972253] 9d80: da557000 00000004 da557204 c0526b7c 00000004 df724000 df179e84 00000004
[ 1384.972260] 9da0: df179db0 df29a100 c083bc48 c045481c 00000001 00000000 00000000 00000000
[ 1384.972267] 9dc0: 00000000 df29a100 00000000 00000000 00000000 00000000 df179e10 00000000
[ 1384.972274] 9de0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1384.972281] 9e00: 00000000 00000000 00000000 00000000 df179e4c c000ec80 c0b538c0 00000004
[ 1384.972288] 9e20: df724000 df178000 00000000 df179e84 c0b538c0 00000000 df178000 c07f4570
[ 1384.972295] 9e40: dcad9c00 df179e74 c07f4394 df179e60 df178000 00000000 df179e84 de247010
[ 1384.972303] 9e60: 00000043 c0454dec 00000001 00000004 df315c00 c0530598 00000004 df315c0c
[ 1384.972310] 9e80: ffffc32c 00000000 00000000 df179ea0 00000001 00000000 00000000 00000000
[ 1384.972317] 9ea0: df179ebc 00000004 df315c00 c05df838 00000000 c0530810 c07d08c0 d7017303
[ 1384.972325] 9ec0: 6ec245b9 00000000 df315c00 c0531b04 c07f3fe0 c07f4018 da67a300 df315c00
[ 1384.972332] 9ee0: 00000000 c05334e0 df315c00 df315b80 df315c00 de0c6800 da67a300 00000000
[ 1384.972339] 9f00: de0c684c c0533674 df204100 df315c00 df315c00 df204100 df315c00 c082b138
[ 1384.972347] 9f20: c053385c c0533754 a0000113 df178000 00000001 c083bc48 00000000 c053385c
[ 1384.972354] 9f40: 00000000 00000000 00000000 c05338c4 00000000 df9f0000 df9f5ee4 df179f6c
[ 1384.972360] 9f60: df178000 c0049db4 00000000 00000000 c07f3ff8 00000000 00000000 00000000
[ 1384.972368] 9f80: df179f80 df179f80 00000000 00000000 df179f90 df179f90 df9f5ee4 c0049cfc
[ 1384.972374] 9fa0: 00000000 00000000 00000000 c000f168 00000000 00000000 00000000 00000000
[ 1384.972381] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 1384.972388] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00010000 00000600
[ 1384.972411] [<c051d250>] (l2cap_create_basic_pdu+0x30/0x1ac) from [<c0521c78>] (l2cap_chan_send+0x100/0x1d4)
[ 1384.972425] [<c0521c78>] (l2cap_chan_send+0x100/0x1d4) from [<c0526b7c>] (l2cap_sock_sendmsg+0xa8/0x104)
[ 1384.972440] [<c0526b7c>] (l2cap_sock_sendmsg+0xa8/0x104) from [<c045481c>] (sock_sendmsg+0xac/0xcc)
[ 1384.972453] [<c045481c>] (sock_sendmsg+0xac/0xcc) from [<c0454dec>] (kernel_sendmsg+0x2c/0x34)
[ 1384.972469] [<c0454dec>] (kernel_sendmsg+0x2c/0x34) from [<c0530598>] (rfcomm_send_frame+0x58/0x7c)
[ 1384.972481] [<c0530598>] (rfcomm_send_frame+0x58/0x7c) from [<c0530810>] (rfcomm_send_ua+0x98/0xbc)
[ 1384.972494] [<c0530810>] (rfcomm_send_ua+0x98/0xbc) from [<c0531b04>] (rfcomm_recv_disc+0xac/0x100)
[ 1384.972506] [<c0531b04>] (rfcomm_recv_disc+0xac/0x100) from [<c05334e0>] (rfcomm_recv_frame+0x144/0x264)
[ 1384.972519] [<c05334e0>] (rfcomm_recv_frame+0x144/0x264) from [<c0533674>] (rfcomm_process_rx+0x74/0xfc)
[ 1384.972531] [<c0533674>] (rfcomm_process_rx+0x74/0xfc) from [<c0533754>] (rfcomm_process_sessions+0x58/0x160)
[ 1384.972543] [<c0533754>] (rfcomm_process_sessions+0x58/0x160) from [<c05338c4>] (rfcomm_run+0x68/0x110)
[ 1384.972558] [<c05338c4>] (rfcomm_run+0x68/0x110) from [<c0049db4>] (kthread+0xb8/0xbc)
[ 1384.972576] [<c0049db4>] (kthread+0xb8/0xbc) from [<c000f168>] (ret_from_fork+0x14/0x2c)
[ 1384.972586] Code: e3100004 e1a07003 e5946000 1a000057 (e5969008)
[ 1384.972614] ---[ end trace 6170b7ce00144e8c ]---

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
8992da099332db896144465a01ad636f58bdebd9 05-Nov-2013 Seung-Woo Kim <sw0312.kim@samsung.com> Bluetooth: Fix to set proper bdaddr_type for RFCOMM connect

L2CAP socket validates proper bdaddr_type for connect, so this
patch fixes to set explictly bdaddr_type for RFCOMM connect.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
c507f138fc7c2025d75b65018810dc0561d0bdb9 05-Nov-2013 Seung-Woo Kim <sw0312.kim@samsung.com> Bluetooth: Fix RFCOMM bind fail for L2CAP sock

L2CAP socket bind checks its bdaddr type but RFCOMM kernel thread
does not assign proper bdaddr type for L2CAP sock. This can cause
that RFCOMM failure.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
60c7a3c9c77239d5a7430c42a2c796881716cca1 02-Nov-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issue with RFCOMM getsockopt operation

The commit 94a86df01082557e2de45865e538d7fb6c46231c seem to have
uncovered a long standing bug that did not trigger so far.

BUG: unable to handle kernel paging request at 00000009dd503502
IP: [<ffffffff815b1868>] rfcomm_sock_getsockopt+0x128/0x200
PGD 0
Oops: 0000 [#1] SMP
Modules linked in: ath5k ath mac80211 cfg80211
CPU: 2 PID: 1459 Comm: bluetoothd Not tainted 3.11.0-133163-gcebd830 #2
Hardware name: System manufacturer System Product Name/P6T DELUXE V2, BIOS
1202 12/22/2010
task: ffff8803304106a0 ti: ffff88033046a000 task.ti: ffff88033046a000
RIP: 0010:[<ffffffff815b1868>] [<ffffffff815b1868>]
rfcomm_sock_getsockopt+0x128/0x200
RSP: 0018:ffff88033046bed8 EFLAGS: 00010246
RAX: 00000009dd503502 RBX: 0000000000000003 RCX: 00007fffa2ed5548
RDX: 0000000000000003 RSI: 0000000000000012 RDI: ffff88032fd37480
RBP: ffff88033046bf28 R08: 00007fffa2ed554c R09: ffff88032f5707d8
R10: 00007fffa2ed5548 R11: 0000000000000202 R12: ffff880330bbd000
R13: 00007fffa2ed5548 R14: 0000000000000003 R15: 00007fffa2ed554c
FS: 00007fc44cfac700(0000) GS:ffff88033fc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000009dd503502 CR3: 00000003304c2000 CR4: 00000000000007e0
Stack:
ffff88033046bf28 ffffffff815b0f2f ffff88033046bf18 0002ffff81105ef6
0000000600000000 ffff88032fd37480 0000000000000012 00007fffa2ed5548
0000000000000003 00007fffa2ed554c ffff88033046bf78 ffffffff814c0380
Call Trace:
[<ffffffff815b0f2f>] ? rfcomm_sock_setsockopt+0x5f/0x190
[<ffffffff814c0380>] SyS_getsockopt+0x60/0xb0
[<ffffffff815e0852>] system_call_fastpath+0x16/0x1b
Code: 02 00 00 00 0f 47 d0 4c 89 ef e8 74 13 cd ff 83 f8 01 19 c9 f7 d1 83 e1
f2 e9 4b ff ff ff 0f 1f 44 00 00 49 8b 84 24 70 02 00 00 <4c> 8b 30 4c 89 c0 e8
2d 19 cd ff 85 c0 49 89 d7 b9 f2 ff ff ff
RIP [<ffffffff815b1868>] rfcomm_sock_getsockopt+0x128/0x200
RSP <ffff88033046bed8>
CR2: 00000009dd503502

It triggers in the following segment of the code:

0x1313 is in rfcomm_sock_getsockopt (net/bluetooth/rfcomm/sock.c:743).
738
739 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
740 {
741 struct sock *sk = sock->sk;
742 struct rfcomm_conninfo cinfo;
743 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
744 int len, err = 0;
745 u32 opt;
746
747 BT_DBG("sk %p", sk);

The l2cap_pi(sk) is wrong here since it should have been rfcomm_pi(sk),
but that socket of course does not contain the low-level connection
details requested here.

Tracking down the actual offending commit, it seems that this has been
introduced when doing some L2CAP refactoring:

commit 8c1d787be4b62d2d1b6f04953eca4bcf7c839d44
Author: Gustavo F. Padovan <padovan@profusion.mobi>
Date: Wed Apr 13 20:23:55 2011 -0300

@@ -743,6 +743,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
struct sock *sk = sock->sk;
struct sock *l2cap_sk;
struct rfcomm_conninfo cinfo;
+ struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
int len, err = 0;
u32 opt;

@@ -787,8 +788,8 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u

l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;

- cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
- memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
+ cinfo.hci_handle = conn->hcon->handle;
+ memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);

The l2cap_sk got accidentally mixed into the sk (which is RFCOMM) and
now causing a problem within getsocketopt() system call. To fix this,
just re-introduce l2cap_sk and make sure the right socket is used for
the low-level connection details.

Reported-by: Fabio Rossi <rossi.f@inwind.it>
Reported-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
Tested-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/sock.c
c1f3bb6bd317994beb3af7bbec4bf54ed0035509 08-Nov-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
87bc0728d462ae37841a550542829aa65a97e7c2 04-Nov-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
d78a32a8fcf775111ccc9ba611a08ca5c29784b6 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove sk member from struct l2cap_chan

There is no access to chan->sk in L2CAP core now. This change marks the
end of the task of splitting L2CAP between Core and Socket, thus sk is now
gone from struct l2cap_chan.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
7f5396a774997a24e2adaffd973cfa5bd2b3e665 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use bt_cb(skb)->chan to send raw data back

Instead of accessing skb->sk in L2CAP core we now compare the channel
a skb belongs to and not send it back if the channel is same. This change
removes another struct socket usage from L2CAP core.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
0e790c64f37a1a43c147720bdfa03b7c5538e24a 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add L2CAP channel to skb private data

Adding the channel to the skb private data makes possible to us know which
channel the skb we have came from.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
8ffb929098a56939ac71509302eeab5b207bf262 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove parent socket usage from l2cap_core.c

The parent socket is not used inside the L2CAP core anymore. We only lock
it to indirect access through the new_connection() callback. The hold of
the socket lock was moved to the new_connection() callback.

Inside L2CAP core the channel lock is now used in l2cap_le_conn_ready()
and l2cap_conn_ready() to protect the execution of these two functions
during the handling of new incoming connections.

This change remove the socket lock usage from L2CAP core while keeping
the code safe against race conditions.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
f93fa2732313ca31ebdc68fd2d5b67fd1d363b42 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove socket lock from l2cap_state_change()

This simplify and make safer the state change handling inside l2cap_core.c.
we got rid of __l2cap_state_change(). And l2cap_state_change() doesn't lock
the socket anymore, instead the socket is locked inside the ops callback for
state change in l2cap_sock.c.

It makes the code safer because in some we were using a unlocked version,
and now we are calls to l2cap_state_change(), when dealing with sockets, use
the locked version.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
acdcabf532908fbefbea294fcad2e3989d1dc036 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Hold socket in defer callback in L2CAP socket

In both places that we use the defer callback the socket lock is held for
a indirect sk access inside __l2cap_change_state() and chan->ops->defer(),
all the rest of the code between lock_sock() and release_sock() is
already protected by the channel lock and won't be affected by this
change.

We now use l2cap_change_state(), the locked version of the change state
function, and the defer callback does the locking itself now. This does
not affect other uses of the defer callback.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
0f2c6153746f270cf28559aa81a4da27847bd395 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Do not access chan->sk directly

In the process of removing socket usage from L2CAP we now access the L2CAP
socket from the data member of struct l2cap_chan. For the L2CAP socket
user the data member points to the L2CAP socket.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
d42970f319f8a1d7cfe8196097f62e5b3885e449 21-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove not used struct sock

It is a leftover from the recent effort of remove sk usage from L2CAP
core.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
547003b114bcb96555cf73ec7f45ab64b2dcaf67 21-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix enabling fast connectable on LE-only controllers

The current "fast connectable" feature is BR/EDR-only, so add a proper
check for BR/EDR support before proceeding with the associated HCI
commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
9a43e25fff07a94f40d4a9e1081458e30c840256 20-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update Set Discoverable to support LE

This patch updates the Set Discoverable management command to also be
applicable for LE. In particular this affects the advertising flags
where we can say "general discoverable" or "limited discoverable".

Since the device flags may not be up-to-date when the advertising data
is written this patch introduces a get_adv_discov_flags() helper
function which also looks at any pending mgmt commands (a pending
set_discoverable would be the exception when the flags are not yet
correct).

The patch also adds HCI_DISCOVERABLE flag clearing to the
mgmt_discoverable_timeout function, since the code was previously
relying on the mgmt_discoverable callback to handle this, which is only
called for the BR/EDR-only HCI_Write_Scan_Enable command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b456f87cb0c726cf97ce1e88aecfcbacf1cdf5fe 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move HCI_LIMITED_DISCOVERABLE changes to a general place

We'll soon be introducing also LE support for the Set Discoverable
management command, so move the HCI_LIMITED_DISCOVERABLE flag clearing
and setting out from the if-branch that is only used for a BR/EDR
specific HCI command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
4b580614e1435628490a1762726638546f3a5e4e 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending write_scan_enable when BR/EDR is disabled

We should only send the HCI_Write_Scan_Enable command from
mgmt_set_powered_failed() when BR/EDR support is enabled. This is
particularly important when the discoverable setting is also tied to LE.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
eb2a8d202f91b874d5650c9e0a2c42fdaf137d91 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move mgmt_pending_find to avoid forward declarations

We will soon need this function for updating the advertising data, so
move it higher up in mgmt.c to avoid a forward declaration.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
a81070ba3743400444275cc87f8f91bb5b67dd4b 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating settings when there are no HCI commands to send

It is possible that the Set Connectable management command doesn't cause
any HCI commands to send (such as when BR/EDR is disabled). We can't
just send a response to user space in this case but must also update the
necessary device flags and settings. This patch fixes the issue by using
the recently introduced set_connectable_update_settings function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
e8ba3a1f08d9386b6e4abe9b00c21e38029a76a4 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor set_connectable settings update to separate function

We will need to directly update the device flags and notify user space
of the new settings not just when we're powered off but also if it turns
out that there are no HCI commands to send (which can happen in
particular when BR/EDR is disabled). Since this is a considerable amount
of code, refactor it to a separate function so it can be reused for the
"no HCI commands to send" case.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f87ea1dabb4b0e50f0c3d7140d89f1bb697a1676 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing check for BREDR_ENABLED flag in update_class()

We shouldn't be sending the HCI_Write_Class_Of_Device command when
BR/EDR is disabled since this is a BR/EDR-only command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
10994ce6e6696d2fb5a14601302da9b680fc9cc9 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Check for flag instead of features in update_adv_data()

It's better to check for the device flag instead of device features so
that we avoid unnecessary HCI commands when the feature is supported but
disabled (i.e. the flag is unset).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7751ef1b3184ecfaebc5e5a8981407814ce0be0b 19-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Check for flag instead of features in update_scan_rsp_data()

It's better to check for the device flag instead of device features so
that we avoid unnecessary HCI commands when the feature is supported but
disabled (i.e. the flag is unset).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
348662a1429f95ed2d488c939c324ec152638742 18-Oct-2013 Joe Perches <joe@perches.com> net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes

There are a mix of function prototypes with and without extern
in the kernel sources. Standardize on not using extern for
function prototypes.

Function prototypes don't need to be written with extern.
extern is assumed by the compiler. Its use is as unnecessary as
using auto to declare automatic/local variables in a block.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
idp/hidp.h
2be48b654242bf0fe3a72e1c3fbc790154e3984a 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix minor coding style issue in hci_core.c

A few variable assignments ended up with missing a space between the
variable and equal sign.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
58f01aa93ff590ddd6a77cde41c25b6022d93769 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix UUID values in debugfs file

The uuid entry struct is used for the UUID byte stream. That is
actually the wrong value. The correct value is uuid->uuid.

Besides fixing this up, use the %pUb modifier to print the UUID
string. However since the UUID is stored in big endian with
reversed byte order, change the byte order before printing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4b4148e9acc1a51c454f133637e5dc7e298bd5bb 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for setting DUT mode

The Device Under Test (DUT) mode is useful for doing certification
testing and so expose this as debugfs option.

This mode is actually special since you can only enter it. Restoring
normal operation means that a HCI Reset is required. The current mode
value gets tracked as a new device flag and when disabling it, the
correct command to reset the controller is sent.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4e70c7e71c5f9cf11013628ab5a0ced449b1c7b2 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose debugfs settings for LE connection interval

For testing purposes expose the default LE connection interval values
via debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
06f5b7785af6beebb7b2a452687b5a102c90ca6e 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for setting SSP debug mode

Enabling and disabling SSP debug mode is useful for development. This
adds a debugfs entry that allows to configure the SSP debug mode.

On purpose this has been implemented as debugfs entry and not a public
API since it is really only useful during testing and development.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
3497ac84bd35bc5b984a3a20625021bfb0ca3f37 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove interval parameter from HCI connection

The conn->interval parameter of HCI connections is not used at all
and so just remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
cfbb2b5b91e2f89cbd3a2f90bf807192a227355d 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add LE features to debugfs if available

For LE capable controllers at the special LE features page to the
debugfs list with all the other features pages.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
12c269d7e30ab044849eb1ae0c8e4850582f3c7b 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose setting if debug keys are used or not

The system can be figured to accept and use debug keys. Expose this
value in debugfs for debugging purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
922021854bd8a0221fcb05aec2c13409cffb924e 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose debugfs entry read/write own address type

For some testing it is important to know the current own addres type,
but also be able to change it. The change is lost over powery cycles
and only intended for debugging.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
79830f66e3cbd224bcf697b032dce9828b5a3c9e 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Select the own address type during initial setup phase

The own address type is based on the fact if the controller has
a public address or not. This means that this detail can be just
configured once during setup phase.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
gmt.c
8f8625cd8067827e2450e4ddec20f5521896114a 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose current list of long term keys via debugfs

For debugging purposes expose the current list of long term keys
via debugfs. This file is read-only and limited to root access.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
d0f729b8c1d8be495d3fc5fdeca2a7093280e85e 19-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose white list size information in debugfs

Knowing the white list size information is important for
debugging. So export it via debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
e132f7f6a2df7b186563775e79c7ab3612ec8116 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove bus attribute in favor of hierarchy

The bus information are exposed in the actual hierarchy and should
not be exposed as attribute.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
02d08d15e0dae9f571c66cc7529a0138bbae1506 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose current list of link keys via debugfs

For debugging purposes expose the current list of link keys via
debugfs. This file is read-only and limited to root access.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
babdbb3c130bf8b6e58811a9cf4764eb68004d25 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move export of class of device information into hci_core.c

The class of device debugfs information should be directly exported
from hci_core.c and so move them over there.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
0d5551f5e40c30ed8a6c1fc6bc6ea6aa96438324 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store local version information only during setup phase

The local version information from the controller can not change
since they are static. So store them only once during setup
phase and not bother overwriting them every time this command
gets executed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
ceeb3bc0f1623ecb86697445fd54017e4dab1bab 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move manufacturer, hci_ver and hci_rev into hci_core.c

Move the debugfs entries for manufacturer, hci_ver and hci_rev into
hci_core.c and use the new helpers for static entries that will not
change at runtime. Once passed the setup procedure, they will stay
fixed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
f96bc0a7f4ceee53ee3ef3a2983c81f84c5d6a89 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove debug entry for connection features

The debug entry for connection features is incomplete and also does
not work with AMP controllers and physical links. So just remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
57af75a8cfec8e3c338a8542e54fe26376ea14cf 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add workaround for buggy max_page features page value

Some controllers list the max_page value from the extended features
response as 0 when SSP has not yet been enabled. To workaround this
issue, force the max_page value to 1 when SSP support has been
detected.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
dfb826a8b07f23ca31156979a7effec7b1f1daa8 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move HCI device features into hci_core.c

Move the handling of HCI device features debugfs into hci_core.c and
also extend it with handling of multiple feature pages.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
cc8dba2bc302442f96d15c027fceb7b103b20ae3 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Block ATT connection on LE when device is blocked

When the remote LE device is blocked, then do not create a L2CAP
channel for it. Without a channel, all packets for that connection
will be dropped.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
06ae3314e0f67a222944155904a792399038f8be 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hcon directly instead of conn->hcon where possible

When the HCI connection hcon is already dereferenced, then use hcon
directly instead of conn->hcon.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
mp.c
e71f41bc7f73ec7f2cb678b51ace47eb05dc6af1 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use BDADDR_BREDR type for old blacklist ioctl interface

The old blacklist ioctl interface was only able to operate on BR/EDR
addresses. So use the BDADDR_BREDR address type definition instead
of an open coded magic 0 value.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
eb622495e89879bb7d62bb27b2561a306bbe2401 18-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix ATT socket backwards compatibility with user space

Old user space versions bind the Attribute Protocol socket to
BDADDR_BREDR when they should be using BDADDR_LE_PUBLIC or
BDADDR_LE_RANDOM. The kernel recently introduced stricter checks on the
socket parameters but we need to punch this hole for old user space
versions to keep them working.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
2bfa3531f654d82db01d3121ae2de7a8696a4555 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move idle_timeout and sniff_{min,max}_interval to hci_core.c

Move the debugfs configuration directly into hci_core.c and only expose
it when the controller actually support BR/EDR sniff power saving mode.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
b25f07854791539ef1c1aff3a968cfe36cb31adf 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Include address type in blacklist debugfs data

The address type is important for the blacklist entries. So include
it at well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
bdc3e0f1d2019fbf89f150ed98860b1a7a762fe9 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move device_add handling into hci_register_dev

The device_add handling can be done directly in hci_register_dev and
device_remove within hci_unregister_dev.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
ffcecac6a7380af84d4c1d676a6c3c524d31eeda 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Create root debugfs directory during module init

Create the root Bluetooth debugfs directory during module init
and remove it on module exit.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
ci_sysfs.c
0153e2ecab657be17aaecca234b29c1154a98202 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Create HCI device debugfs directory in hci_register_dev

Create the debugfs directory for each HCI device directly in
hci_register_dev function and remove it during hci_unregister_dev.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
1120e4bfa5f9c28cb55d815ab3c6bed81dfc595c 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use IS_ERR_OR_NULL for checking bt_debugfs

Make sure to use IS_ERR_OR_NULL for checking the existing of the root
debugfs dentry bt_debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
fcomm/core.c
fcomm/sock.c
co.c
47219839b43dec0520ef1ec72122186b3aa3de97 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move uuids debugfs entry creation into hci_core.c

The uuids debugfs should only be created together with the other
entries after the setup procedure has been finished.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
70afe0b8566769567d2eac6395c1cf68ed62bed3 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move blacklist debugfs entry creation into hci_core.c

The blacklist debugfs should only be created together with the other
entries after the setup procedure has been finished.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
b9ee0a783a928631bff1f0ea355bb9dc5deeaaf8 18-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add address type to device blacklist table

The device blacklist is not taking care of the address type. Actually
store the address type in the list entries and also use them when
looking up addresses in the table.

This is actually a serious bug. When adding a LE public address to
the blacklist, then it would be blocking a device on BR/EDR. And this
is not the expected behavior.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
041000b94276da0debf911494f0825571b2f26fb 17-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose current voice setting in debugfs

For easier debugging of the current voice setting, expose the value
in debugfs if the controller is BR/EDR capable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
e7b8fc92867cf161ce8182ac4cbee2bed7f16d90 17-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose static address value for LE capable controllers

For LE capable controllers, the static address can be configured. For
debugging purposes expose the value in debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ebd1e33bb2167798197e79d277d7ead14013e489 17-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose auto_accept_delay debugfs only when SSP is supported

The auto_accept_delay debugfs entry is only valid for BR/EDR capable
controllers that also support SSP. If SSP is not available or it is
a LE-only single mode controller this value has no affect and so do
not expose it.

Since the value can be actually changed, switch the permissions
to 0644 to clearly indicate that the value is indeed writeable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
baf27f6e0e13b9b7e81fd4c758ac87f165c1a422 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Expose inquiry_cache debugfs only on BR/EDR controllers

The inquiry_cache debugfs entry is only valid for BR/EDR capable
controllers. In case of single mode LE-only controllers that
entry is not valid.

Move the creating of the debugfs entries to the end of controller
init and only create the inquiry_cache entry if BR/EDR is actually
supported.

At the same time this avoids creating any debugfs entries for
AMP controllers since none of the entries are valid there.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sysfs.c
7f59ddada192583aee81ebf0de4cdc5a94642915 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Socket address parameter for CID is in little endian

The L2CAP socket parameter for CID are actually provided in little
endian. So convert our constants into little endian before comparing
them.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
a74a84f696537f38fa994c1b95a0dca9ae386865 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert idle timer to use delayed work

There is no need to use a timer since the entire Bluetooth subsystem
runs using workqueues these days.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
7bc18d9d3d7ffbc09dabb201933a063583a39027 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert auto accept timer to use delayed work

Since the entire Bluetooth subsystem runs in workqueues these days there
is no need to use a timer for deferring work.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
bfe4655f05d7ec4a7c0c1c7e4051862f824cd8ec 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reintroduce socket restrictions for LE sockets

Right now we do not allow user space to use connection oriented channels
on LE, and the only CID that can be used is the Attribute Protocol one.
These restrictions went away together with the recent refactoring of the
L2CAP code, but this patch puts them back to their appropriate places.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
eb438b5f3065dc270484919e8b88486d0cff59d3 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating the right variable in update_scan_rsp_data()

This function should be operating on scan_rsp_data_len and scan_rsp_data
and not the advertising data variables.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
3432711f49c31c8f21f8a9beb0b3d4b2c7bc9dc2 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Ignore SMP data on non-LE links

The SMP CID is only defined for LE transports. Instead of returning an
error from smp_sig_channel() in this case (which would cause a
disconnection) just return 0 to ignore the data, which is consistent
with the behavior for other unknown CIDs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mp.c
07e307f807fecf056f0f9024ade4c0187159c46b 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Ignore A2MP data on non-BR/EDR links

The A2MP CID is only valid for BR/EDR transports. We should ignore A2MP
data on non-BR/EDR links and refuse to create an amp_mgr object.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
a521149a0df24cc250aa1173a9964dd8a728d772 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless l2cap_err_to_reason function

Now that the only reason code this function can return is
L2CAP_REJ_NOT_UNDERSTOOD we can just do the necessary assignment without
needing a separate function at all.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
33a2145e6179afcbc1d71fee25848ad92a244f6c 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused command reject mapping for EMSGSIZE

There is no command handler that would return an EMSGSIZE error, so just
remove this mapping from the l2cap_err_to_reason function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
662d652dd60edbb45acab772baedaf39a2f22ffc 16-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP "Command Reject: Invalid CID" response

When the reason code in the L2CAP command reject is "invalid CID" there
should be four additional bytes of data in the PDU, namely the source
and destination CIDs (which should be zero if one or both are not
applicable). This patch fixes all occurrences of such errors to return
the right kind of PDU.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
5947f4bc4253df3a18a540af096463530c5f8737 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Rename update_ad into update_adv_data

Since there is update_scan_rsp_data, it is also better to use the
clear name update_adv_data instead of update_ad.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
7a5f4990a4c6934a84b040337bdd7682637c2562 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store device name in scan response data

The scan response data is a better place to store the device name
since it has more space available and is also enforcing privacy.

When the controller is advertising, the connectable setting decides
if ADV_IND or ADV_NONCONN_IND is used. In case of ADV_IND, the
remote side is allowed to request the scan response data. Same as
with BR/EDR where either EIR is used or a remote name request. In
non-connectable mode, the device name is not available since it is
not allowed to request scan response data. Same as in BR/EDR where
the device is non-discoverable and no name requests are answered.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
f14d8f643733a564b299ec24464ae23a0d7eb230 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set the scan response data when needed

On controller power on and when enabling LE functionality,
make sure that also the scan response data is correctly set.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
f8e808bd6853f1ada3614f99c95beac1bc2f2140 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store scan response data in HCI device

The scan response data needs to be stored in HCI device and so
add a buffer for it and also ensure to clear it when resetting
the controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
46cad2edb13be71ae11da896411db8a42b82d555 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Rename create_ad into create_adv_data

Rename the create_ad function into create_adv_data to make it clear
that it is used to create the advertising data. This is important
since later on a function adding the scan response data will be
added.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
083368f7b8c03a0b3eaa048e84eb9fa9573745d4 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_new_ltk() return void

The return value of mgmt_new_ltk() function is not used and
so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3edaf092c271d91228c66a48b415c92925b83d0b 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_read_local_oob_data_reply_complete() return void

The return value of mgmt_read_local_oob_data_reply_complete() function
is not used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
7667da3423cdf06a818e73adaf2f675455cc8e99 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_set_local_name_complete() return void

The return value of mgmt_set_local_name_complete() function is
not used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4e1b0245f2394a6ee4a79bb183f56f8fe2c7af33 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_set_class_of_dev_complete() return void

The return value of mgmt_set_class_of_dev_complete() function is
not used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3e248560d951b4a99aaa1d1332030853e2ebc3fd 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_ssp_enable_complete() return void

The return value of mgmt_ssp_enable_complete() function is not
used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
464996aea48aa1ec3d7d60098dbb0f7623da6c92 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_auth_enable_complete() return void

The return value of mgmt_auth_enable_complete() function is not
used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
e546099c3194ef6ecf46a8a50414005c29a46bc4 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_auth_failed() return void

The return value of mgmt_auth_failed() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3eb385289a8b71db40b1a4a4d739817bd437db4f 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_pin_code_neg_reply_complete() return void

The return value of mgmt_pin_code_neg_reply_complete() function is
not used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
e669cf803cb14d63d0b7c612286e5cfdec6e34f7 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_pin_code_reply_complete() return void

The return value of mgmt_pin_code_reply_complete() function is not
used and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
ce0e4a0d7b84d4ceebc91f97de8c08da23a7bda3 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_pin_code_request() return void

The return value of mgmt_pin_code_request() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
2ce5fb510fc0ba50c8e1b6bcb991848084ea67ec 16-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add l2cap_chan_no_resume stub for A2MP

The A2MP client for L2CAP channels needs to use l2cap_chan_no_resume
empty stub function.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
74e7574066e020dca8ad8a57927470e67ea91394 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: use l2cap_chan_ready() instead of duplicate code

In this case the replacement by l2cap_chan_ready() doesn't change the code
flow, the same operations will executed plus two others that have no
effect: the use of the parent socket, that a non-oriented channel doesn't
have and the reset of conf_state, which is also fine since the connection
is ready at this point.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
dc25306b033cc27ca2a45b4bb307a437092408d1 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Move l2cap_wait_ack() to l2cap_sock.c

The wait_ack code has a heavy dependency on the socket data structures
and, as of now, it won't be worthless change it to use non-socket
structures as the only user of such feature is a socket.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
5ec1bbe549d939ff1ef88e2cc22b2c3b95d76401 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add chan->ops->set_shutdown()

We need to remove all direct access of struct sock from L2CAP core.
This change is pretty simple and just add a new L2CAP channel callback to
do the work in the L2CAP socket side.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
2cap_core.c
2cap_sock.c
8d836d71e2223b8961b21112bb4ce89ef8231682 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Access sk_sndtimeo indirectly in l2cap_core.c

As part of the work to remove struct sock from l2cap_core.c and make it
more generic we remove in this commit the direct access to sk->sk_sndtimeo
member. This objective of this change is purely remove sk usage from
l2cap_core.c

Now we have a new l2cap ops to get the current value of sk->sndtimeo. A
l2cap_chan_no_get_sndtimeo was added for users of L2CAP that doesn't need
to set a timeout.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
2cap_core.c
2cap_sock.c
f8e73017c15b007bd519d0049305bb377e8cc1f5 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add l2cap_state_change_and_error()

l2cap_state_change_and_error() introduces the ability to update a
l2cap_user with changes in channel's state and error code with just one
call. The main reason for this is to avoid race conditions between and
setting the state and then the error. Otherwise we would need to release
the lock between both operations.

This is another step of an ongoing work to make l2cap_core.c totally
independent from l2cap's struct sock.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
53f5212121fc3bcd0bccb8841c01e08ca942f333 16-Oct-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Extend state_change() call to report errors too

Instead of creating an new function pointer to report errors we are just
reusing state_change for that and there is a simple reason for this, one
place in the l2cap_core.c code needs, in a locked sk, set both the sk_state
and sk_err. If we create two different functions for this we would need to
release the lock between the two operation putting the socket in non
desired state.

The change is transparent to the l2cap_core.c code, user that only needs
to set the state won't need any modification.

This is another step of an ongoing work to make l2cap_core.c totally
independent from l2cap's struct sock.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2mp.c
2cap_core.c
2cap_sock.c
d1967ff88b3854d1bb002cccd15d28ad0d9223a9 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update class of device on discoverable timeout

When the discoverable timeout triggers and limited discoverable mode
was used, then the class of device needs to be updated to remove
the limited discoverable bit.

To keep the class of device logic in a central place, expose a new
function mgmt_discoverable_timeout that can be called from the
timeout callback. In case the class of device value needs updating,
it will add the HCI command to the transaction.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
efdcf8e3d716730d2212dfd973571a0ed00c9b10 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move eir_get_length() function into hci_event.c

The eir_get_length() function is only used from hci_event.c and so
instead of having a public function move it to the location where
it is used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
9493399108a186492bb828417a43ff37d9ae48fa 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move eir_append_data() function into mgmt.c

The eir_append_data() function is only used from mgmt.c and so
instead of having a public function move it to the location where
it is used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
dc4a5ee2a3282a1044b164979609b4bfab43900b 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_new_link_key() return void

The return value of mgmt_new_link_key() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
310a3d4854d71c0a565c9f7705749e78f6113c4c 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for entering limited discoverable mode

The limited discoverable mode should be used when a device is only
discoverable for a certain amount of time and after that it returns
back into being non-discoverable.

This adds another option to the set discoverable management command
to clearly distinguish limited discoverable from general discoverable
mode.

While the general discoverable mode can be set with a specific
timeout or as permanent setting, the limited discoverable mode
requires a timeout. The timeout is flexible and the kernel will
not enforce any specific limitations. That GAP part of this is
required by userspace to enforce according to the Bluetooth core
specification.

Devices in limited discoverable mode can still be found by the
general discovery procedure. It is mandatory that a device sets
both GIAC and LIAC when entering limited discoverable mode.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
36261547c9699c6bc746b1db9508aaeb68faa7c9 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Simplify the code for re-arming discoverable timeout

When only the discoverable timeout gets updated, just cancel the current
timeout, store the new timeout value. If the new timeout is valid, then
arm the discoverable timeout again.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
d4462a07de025dec0f5242743f4d687a39b78bd5 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move arming of discoverable timeout to complete handler

The discoverable timeout is currently armed from hci_event.c and causes
some side effects when using HCI commands instead of the management
interface. To make this clear, only arm the discoverable timeout from
the management command complete handler.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
970ba5242d86ea281a263231639e935f6386e49d 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update class of device after changing discoverable mode

When the discoverable mode gets changed, ensure that the class of
device value has the correct limited discoverable bit value set.

Since the class of device HCI command will only be send to the
controller when the value changes, it is safe to just always
trigger the update.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
4796e8af60ee7d2922386ef9fd4389d21e2c1665 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_write_scan_failed() return void

The return value of mgmt_write_scan_failed() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
a330916c4f29898b93708b6bec8f59f7a7956f41 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_connectable() return void

The return value of mgmt_connectable() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
86a7564573a7de9e01aa9a2e26faa993d8f962ac 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_discoverable() return void

The return value of mgmt_discoverable() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
6acd7db41dc2b6bc91b930edf21fbfd8654cbb68 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce flag for limited discoverable mode

Add a new flag that can be set when in limited discoverable mode. This
flag will cause the limited discoverable bit in the class of device
value to bet set.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
441ad2d04123eecb06d7c14948a0e7b07bf75aa5 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update advertising data based on management commands

Magically updating the advertising data when some random command enables
advertising in the controller is not really a good idea. It also caused
a bit of complicated code with the exported hci_udpate_ad function that
is shared from many places.

This patch consolidates the advertising data update into the management
core. It also makes sure that when powering on with LE enabled or later
on enabling LE the controller has a good default for advertising data.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
gmt.c
b1e73124104d0c4c6c9a073afea07ff0b73d5787 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hci_request for discoverable timeout handling

When the discoverable timeout triggers and it is time to turn inquiry
scan back off, use the HCI request framework to do it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
8d6083fe0ab6ffbe486b5d537922fba68e872568 15-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix minor coding style issue in set_connectable()

There is a minor coding style violation and so just fix it. No actual
logic has changed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
4b836f393bd8ed111857a6ee1865e44627266ec6 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read current IAC LAP on controller setup

Read the current IAC LAP values when initializing the controller. The
values are not used, but it is good to have them in the trace files
for debugging purposes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
b4cb9fb25e9eae749f456e9e94446650389e736b 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read number of supported IAC on controller setup

When initializing a controller make sure to read out the number of
supported IAC and store its result. This value is needed to determine
if limited discoverable for BR/EDR can be configured or not.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
899e107577a8de67b97a877ed90bbfbfefb1916e 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Check that scan window is smaller or equal than scan interval

The scan window parameter for connection establishment and passive
scanning needs to be smaller or equal than the scan interval.

Instead of waiting for a controller to reject these values later on,
just reject them right away.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
1f209383f2be94e15e179da3a4cbcfeabcc2efc2 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Check that bind() bdaddr type matches connect()

If a socket was bound to an address type other than BR/EDR (such as LE)
we should reject trying to connect it to a BR/EDR address. The same
applies for binding to BR/EDR and trying to connect to non-BR/EDR.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
80c1a2e76dbb36588facb265ab364b1302f7ef8c 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reject invalid bdaddr types for sockets

We need to verify that the bdaddr type passed to connect() and bind() is
within the set of valid values. If it is not we need to cleanly fail
with EINVAL.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_sock.c
bfaf8c9ff17a256fe435d452e8ff5a515155ee3b 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert Set Discoverable to use an asynchronous request

This patch converts Set Discoverable to use an asynchronous request
along with its own completion callback. This is necessary for splitting
raw HCI socket use cases from mgmt, as well as for enabling the hooking
up of Advertising parameters together with the HCI_DISCOVERABLE flag
(coming in later patches).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
aa8af46e90869686e1a2707d0803ea9445a643a3 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating scan mode in set_bredr()

Now that the connectable setting is also applicable for the LE side it's
possible that the HCI_CONNECTABLE flag is already set when changing the
BR/EDR setting from false to true while the controller is powered. In
this situation we need to update the BR/EDR scan mode to reflect the
setting. Additionally, since HCI_CONNECTABLE also applies to LE we must
not clear the HCI_CONNECTABLE flag when disabling bredr.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
67e5a7a3d796d88da9662ab90aa23161c6a9f753 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move set_bredr_scan() to avoid forward declaration

The set_bredr_scan() function will soon be needed by the set_bredr()
function, so move it to a new location to avoid having to add a forward
declaration.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
1987fdc77f49282efeec76d14eee2ded3ee9b5d2 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make Set Connectable also update the LE advertising type

This patch updates the Set Connectable Management command to also update
the LE advertising type to either connectable or non-connectable
advertising. An extra helper function is needed for getting the right
advertising type since we can not only rely on the HCI_CONNECTABLE flag
but must also check for a pending Set Connectable command (in which case
the flag does not yet have its final value).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c6d887aaf8f772fbe07604390975921ad3350a58 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating advertising data needlessly

We need to ensure that the advertising data is up-to-date whenever
advertising is enabled, but when disabling advertising we do not need to
worry about it (since it will eventually get fixed as soon as
advertising is enabled again). This patch fixes this in the command
complete callback for set_adv_enable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
95c66e75baf34024213a779dac08f95e6b5aa6a4 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move static advertising functions to avoid forward declarations

These functions will soon be used by set_connectable() so move them to a
location in mgmt.c that doesn't require forward declarations.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
37438c1f7f6d26e1532d6bfc588c958b7dfae668 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing error handling for Set Connectable

If the HCI commands related to the Set Connectable command fail we will
get a non-zero status in the request completion callback. In such a case
we must respond with the appropriate command status message to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d7b856f9380d95a9d663180701da904123c035b8 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move more logic into set_connectable complete callback

This patch moves the responsibility of setting/clearing the
HCI_CONNECTABLE flag to the request completion callback of the Set
Connectable command. This will allow us to cleanly add support for LE
Advertising hooks in later patches.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
9b74246f3a074b6072fa81002805ceaefb87a013 14-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Reorganize set_connectable HCI command sending

This patch moves all the decisions of which HCI commands to send (or not
to send) to the code between hci_req_init() and hci_req_run() this
allows us to further extend the request with further commands but still
keep the same logic of handling whether to return a direct mgmt response
in the case that no HCI commands were sent.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d97c899bde330cd1c76c3a162558177563a74362 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce L2CAP channel callback for resuming

Clearing the BT_SK_SUSPEND socket flag from the L2CAP core is causing
a dependency on the socket. So intead of doing that, use a channel
callback into the socket handling to resume.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
bdc257830760a784370ae4ab2d682b252b983e77 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce L2CAP channel flag for defer setup

The L2CAP core should not look into the socket flags to figure out the
setting of defer setup. So introduce a L2CAP channel flag that mirrors
the socket flag.

Since the defer setup option is only set in one place this becomes a
really easy thing to do.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
c56057557672b65c11e7f99c124670c2297743f0 14-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Adjust header for proc socket information

The exposed socket information do not contain source or destination
addresses. So adjust the header accordingly.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
dcbc729eef18b93e689d853aa8ccc41549e7fd58 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increase minor version of core module

There have been a lot of changes in the core Bluetooth handling
lately. So it is a good idea to increase the module version.

The module version is not used anywhere, but it makes debugging
a little bit simpler if versions can be distinguished.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
2edf870d198adeb43d5a2a5ddfa7e3cea4fc999b 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide msg_name callback for L2CAP connectionless channels

The L2CAP connectionless channels use SOCK_DGRAM and recvmsg() and need
to receive the remote BD_ADDR and PSM information via msg_name from
the recvmsg() system call.

So in case the L2CAP socket is for connectionless channels, provide
a msg_name callback that can update the data. Also store the remote
BD_ADDR and PSM in the skb so it can be extracted later on.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
d97636980f6ba7344c8aa6fa349b9059c60ee478 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for per socket msg_name callback

This allows to add a per socket msg_name callback that can be used
for updating the msg_name information for recvmsg() system calls.

This feature is used by another patch to support address information
on L2CAP connectionless channels.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
84b34d9867f826caecaab4444c86438935b7eb2b 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use l2cap_pi(sk) directly where possible

There are few places where it makes sense to use l2cap_pi(sk) directly
instead of assigning it to temporary structure.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
5f6cd79f477743cab98fd49feb03a39e0138b32f 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove src and dst fields from bt_sock structure

Every socket protocol now stores its own address information. So
just remove the generic src and dst fields since they are no longer
needed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
94a86df01082557e2de45865e538d7fb6c46231c 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store RFCOMM address information in its own socket structure

The address information of RFCOMM sockets should be stored in its
own socket structure. Trying to generalize them is not helpful since
different transports have different address types.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/sock.c
eea963641bf548bda164b92aa20ccda56c5cf349 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store SCO address information in its own socket structure

The address information of SCO sockets should be stored in its own
socket structure. Trying to generalize them is not helpful since
different transports have different address types.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
041987cff6fb7d2e7acd5897390ad0eef575ed39 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use SCO addresses from HCI connection directly

Instead of storing a pointer to the addresses for the HCI device
and HCI connection, use them directly. With the recent changes
to address tracking of HCI connections, this becomes simple.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
co.c
65f53e9802dbfae0e5758a91793c3f5f8bece49b 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Access BNEP session addresses through L2CAP channel

The L2CAP socket structure does not contain the address information
anymore. They need to be accessed through the L2CAP channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
nep/core.c
755b82aa2fdb62a61990f6c132df150abd9e9206 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Access HIDP session addresses through L2CAP channel

The L2CAP socket structure does not contain the address information
anymore. They need to be accessed through the L2CAP channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
idp/core.c
88f1fd27080013c8216bc6ed26e3c9a184a78588 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Access CMTP session addresses through L2CAP channel

The L2CAP socket structure does not contain the address information
anymore. They need to be accessed through the L2CAP channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mtp/core.c
24bc10cad3a76a4fc0f96a7220d4fe02379826d2 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Access RFCOMM session addresses through L2CAP channel

The L2CAP socket structure does not contain the address information
anymore. They need to be accessed through the L2CAP channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/core.c
4f1654e08464abad06487e173661cb73721d27a7 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Return the correct address type for L2CAP sockets

The L2CAP sockets can use BR/EDR public, LE public and LE random
addresses for various combinations of source and destination
devices. So make sure that getsockname(), getpeername() and
accept() return the correct address type.

For this the address type of the source and destination is stored
with the L2CAP channel information. The stored address type is
not the one specific for the HCI protocol. It is the address
type used for the L2CAP sockets and the management interface.

The underlying HCI connections store the HCI address type. If
needed, it gets converted to the socket address type.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
7eafc59e2f547fce3a31b3e2d03c14d57e9162b2 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store address information in L2CAP channel structure

With the effort of abstracting the L2CAP socket from the underlying
L2CAP channel it is important to store the source and destination
address information directly in the L2CAP channel structure.

Direct access to the HCI connection address information is not
possible since they might not be avaiable at L2CAP channel
creation time. The address information will be updated when
the underlying BR/EDR or LE connection status changes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
4637f7c0d0e95361f25f456b34cc2138fdfe95f8 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update L2CAP socket source address from HCI connection

When having LE connections, the source address is not always the
public address of the controller. So update the socket address
based on the actual used source address of the HCI connection.

This also remove the pointless source address pointer and adds
a proper lock around the socket structure.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
f1560463ebb7d883be2f5e55e71f7e8b78c0ca1a 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix coding style violations in SMP handling

The SMP source code has a few coding style violations. Fix them up
all at once. No actual code has changed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
c8462ca65f39d9402c52ef0c5f338a466bb34b43 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix input address type for SMP C1 function

The smp_c1() so far always assumed public addresses as input for its
operation. However it should provide actually the source address type
of the actual connection.

Finally the source address type is tracked in hci_conn->src_type and
so use that one as input.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
6f59b904ae57df92915d7ade750853647620db2c 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hci_conn->src address for L2CAP functions

The source address is now stored in hci_conn->src and so use that
one for L2CAP functions.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2b36a5620acb5ee0c101ec32a20793da4426fd33 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hci_conn->src address for SMP functions

The source address is now stored in hci_conn->src and so use that
one for SMP functions.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
880be4e8d0db86a635b87f75fee7daa4f6006f45 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update source address and type for incoming LE connections

The incoming LE connections do not have a proper source address and
address type set. The connection needs to be set with the same values
as used for advertising parameters.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
662e8820f38dcc458e0d4769194db5ed3469224f 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store source address of HCI connections

The source addressed was based on the public address of the HCI device,
but with LE connections this not always the case. For example single
mode LE-only controllers would use a static random address. And this
address is configured by userspace.

To not complicate the lookup of what kind of address is in use, store
the correct source address for each HCI connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
e7c4096e16f0e362c6cf902baab0de37ebfc1266 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Store the source address type of LE connections

When establishing LE connections, it is possible to use a public
address (if available) or a random address. The type of address
is only known when creating connections, so make sure it is
stored in hci_conn structure.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
79d95a19a445f5758571b3342064f2c1e40b6c5f 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove pointless bdaddr_to_le() helper function

The bdaddr_to_le() function tries to convert the internal address
type to one that matches the HCI address type for LE. It does not
handle any address types not used by LE and in the end just make
the code a lot harder to read.

So instead of just hiding behind a magic function, just convert
the internal address type where it needs to be converted. And it
turns out that these are only two cases anyway. One when creating
new LE connections and the other when loading the long term keys.
In both cases this makes it more clear on what it going on.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
gmt.c
98e0f7ea4a5b4774805c62be104f19abba6187ac 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove l2cap_conn->src and l2cap_conn->dst usage from L2CAP

The l2cap_conn->src and l2cap_conn->dst addresses are just a pointers
to hci_conn structure. Use hci_conn->hdev->bdaddr and hci_conn->dst
directly instead.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
ce39fb4e45a4315fcdf75ef25d61281e946ebb07 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove l2cap_conn->src and l2cap_conn->dst usage from SMP

The l2cap_conn->src and l2cap_conn->dst addresses are just a pointer
to hci_conn->hdev->bdaddr and hci_conn->dst structures. Use the data
provided by hci_conn directly. This is done for hci_conn->dst_type
already anyway and with this change it makes it a lot clearer were
the address information comes from.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
bdc8ead27c71b4d3f3e883b0bf3f279a18a6f590 13-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove l2cap_conn->dst usage from AMP manager

The l2cap_conn->dst address is just a pointer into the hci_conn->dst
structure. Use hci_conn->dst directly instead.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
mp.c
547d103280690b8febd2354320e164ae508d912e 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Unicast connectionless data reception is supported

The unicast connectionless data reception feature is actually support
and has been supported all along. Mark it as supported in the L2CAP
features bitmask.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
d40bffbc4e9afce9c0be6ea399b4103f72e50ec2 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: The L2CAP fixed channel connectionless data is supported

The implementation actually supports the L2CAP connectionless data
channel. So set it as supported in the fixed channels bitmask.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
3124b84309a0699c98bdc0ef1fc8cd5e058ad5fa 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow 3D profile to use security mode 4 level 0

The PSM 0x0021 is dedicated to the 3D profile and has permission to
use security mode 4 level 0 for L2CAP connectionless unicast data
transfers.

When establishing a L2CAP connectionless channel on PSM 0x0021, it
will no longer force Secure Simple Pairing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
6a974b50a1b0909803faac3c3228f7c1339d9971 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Limit security mode 4 level 0 to connection oriented channels

The exception for certain PSM channels when it comes to security
mode 4 level 0 should only be checked when actually a connection
oriented channel is established.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
43b1b8dfb4fa326d89aa5930f88b943cc410cbfa 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix PSM value for L2CAP connectionless data packets

The put_unaligned() for setting the PSM is missing the (__le16 *)
cast. Without this, the PSM information transmitted over the air
are bogus.

In addition, print the used PSM value in the debug message so this
becomes easier to debug in the future.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
4ca048e3a38e9691eb3e390c5eea3acd9b51cd17 12-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix HCI init for 1st generation BlueFRITZ! devices

The 1st generation of BlueFRITZ! devices from AVM Berlin pretend
to be HCI version 1.2 controllers, but they are not. They are simple
Bluetooth 1.1 devices.

Since this company never created any newer controllers, it is safe
to use the manufacturer ID instead of an USB quirk.

< HCI Command: Read Page Scan Activity (0x03|0x001b) plen 0
> HCI Event: Command Complete (0x0e) plen 8
Read Page Scan Activity (0x03|0x001b) ncmd 1
Status: Success (0x00)
Interval: 1280.000 msec (0x0800)
Window: 21.250 msec (0x0022)
< HCI Command: Read Page Scan Type (0x03|0x0046) plen 0
> HCI Event: Command Status (0x0f) plen 4
Read Page Scan Type (0x03|0x0046) ncmd 1
Status: Unknown HCI Command (0x01)

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7f72134e08bb15511ffcb880cdd01ca77ea54cb7 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add MGMT_OP_SET_SCAN_PARAMS to supported commands list

When adding support for MGMT_OP_SET_SCAN_PARAMS command the addition
to the supported commands list has been forgotten. This is needed
for userspace to detect if the command is supported or not.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
a82974c9f4ed07b89715d0695ff41379116fd622 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't advertise high speed support without SSP

It is not allowed to enable high speed support when Secure Simple
Pairing is not available or disabled.

However the support for high speed gets advertised on a controller
that does not even support Secure Simple Pairing. Since there is
no way to enable high speed support on such a controller, do not
even advertise its support.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
3a6afbd2171a1e92c22d1a9eb54adf1474d938f1 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix endless loop with HCI_QUIRK_RESET_ON_CLOSE

Really early versions of the Bluetooth specification were unclear
with the behavior of HCI Reset for USB devices. They assumed that
also an USB reset needs to be issued. Later Bluetooth specifications
cleared this out and it is safe to call HCI Reset without affecting
the transport.

For old devices that misbehave, the HCI_QUIRK_RESET_ON_CLOSE quirk
was introduced to postpone the HCI Reset until the device was no
longer in use.

One of these devices is the Digianswer BPA-105 Bluetooth Protocol
Analyzer. The only problem now is that with the quirk set, the
HCI Reset is also executed at the end of the setup phase. So the
controller gets configured and then it disconnects from the USB
bus, connects again, gets configured and of course disconnects
again. This game goes on forever.

For devices that need HCI_QUIRK_RESET_ON_CLOSE it is important
that the HCI Reset is not executed after the setup phase. In
specific when HCI_AUTO_OFF is set, do not call HCI Reset when
closing the device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
14b49b9a49f0d80ef9a3ce7991b373f93016f5e4 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command for setting LE scan parameters

The scan interval and window parameters are used for LE passive
background scanning and connection establishment. This allows
userspace to change the values.

These two values should be kept in sync with whatever is used for
the scan parameters service on remote devices. And it puts the
controlling daemon (for example bluetoothd) in charge of setting
the values.

Main use case would be to switch between two sets of values. One
for foreground applications and one for background applications.

At this moment, the values are only used for manual connection
establishment, but soon that should be extended to background
scanning and automatic connection establishment.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
bef64738e3fb87eabc6fbeededad0c44ea173384 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make LE scan interval and window a controller option

The scan interval and window for LE passive scanning and connection
establishment should be configurable on a per controller basis. So
introduce a setting that later on will allow modifying it.

This setting does not affect LE active scanning during device
discovery phase. As long as that phase uses interleaved discovery,
it will continuously scan.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
7bd8f09f69f8a190f9b8334a07bb0a9237612314 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add hdev parameter to hdev->send driver callback

Instead of masking hdev inside the skb->dev parameter, hand it
directly to the driver as a parameter to hdev->send. This makes
the driver interface more clear and simpler.

This patch fixes all drivers to accept and handle the new parameter
of hdev->send callback. Special care has been taken for bpa10x
and btusb drivers that require having skb->dev set to hdev for
the URB transmit complete handlers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
e1a26170692dc1e5fbe0ccd98ef86cc9fcd31a64 11-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide hdev parameter to hci_recv_frame() driver callback

To avoid casting skb->dev into hdev, just let the drivers provide
the hdev directly when calling hci_recv_frame() function.

This patch also fixes up all drivers to provide the hdev.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
5108699194dfccd8cc324ec6691b2bc810a317ab 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove return value from hci_send_frame() function

The return value of hci_send_frame() is never checked. So just make
this function void and print an error when the hdev->send driver
callback returns a negative value.

Having the error printed is actually an improvement over the
current situation where any driver error just gets ignored.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
3d386acea090e7af3346de59d9e322f92128a4b1 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove pointless check of hci_send_frame parameter

The hdev parameter of hci_send_frame must be always valid. If the hdev
is not valid, it would not even make it to this stage. The callers
will have already accessed hdev at that point many times.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
57d17d70dfa4345fbe3e0d049504aa20626ed0e1 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move skb->dev assignment for hdev->send into central place

The assignement of skb->dev is done all over the place. So it makes it
hard to eventually get rid of it. Move it all in one central place so
it gets assigned right before calling hdev->send driver callback.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
ac4b7236610cef99821f40f44a74030b85d85270 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move smp.h header file into net/bluetooth/

The smp.h header file is only used internally by the bluetooth.ko
module and is not a public API. So make it local to the core
Bluetooth module.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
2cap_core.c
2cap_sock.c
gmt.c
mp.c
mp.h
7024728ee534d739380dc4fd31f020cfc6e86c28 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move a2mp.h header file into net/bluetooth/

The a2mp.h header file is only used internally by the bluetooth.ko
module and is not a public API. So make it local to the core
Bluetooth module.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2mp.h
mp.c
ci_conn.c
ci_event.c
2cap_core.c
7ef9fbf08818fa1cb8ae89fca29f193dd78d5dd8 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move amp.h header file into net/bluetooth/

The amp.h header file is only used internally by the bluetooth.ko
module and is not a public API. So make it local to the core
Bluetooth module.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
mp.c
mp.h
ci_event.c
2cap_core.c
324d36ed26a22bc14b2dd4505f3dba3fb2676bcc 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove hdev->ioctl driver callback

Since there is no use of hdev->ioctl by any Bluetooth driver since
ever, so just lets remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
5b69bef541318857881c84958e01c7d96bfaf8d3 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: AMP contollers do not support the legacy ioctls

The legacy ioctls for device specific commands including inquiry are
not support by AMP controllers. So just reject them right away instead
of trying to send the HCI command and wait for failure from the
actual hardware.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
b145edcd1642d55a8eb7d08c954b815cb1478981 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use hci_conn_num() for checking number of LE connections

When checking for the current number of LE connections, use
hci_conn_num() function instead of a full blown lookup within
the connection hash or direct access of the counters.

In the case of re-enabling advertising, it is more useful to
check for any connection attempt or existing connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
21b5187f23206c0343214194711c8f63e7003d0c 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix too long line with set_advertising() function

The function declaration goes over 80 characters, so break it down.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cebf4cfd8608cbcc941750801217988f0a8fc848 10-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for HCI_SETUP flag when receiving mgmt commands

When the HCI_SETUP flag is set the controller has not yet been announced
over mgmt and therefore doesn't exist from that perspective. If we
nevertheless get a mgmt command for it we should respond with the
appropriate INVALID_INDEX error.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c4e5bafa661126b7b42459ad32d4c2cc589ef8fb 10-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix potential double-frees of L2CAP skbs

The l2cap_recv_frame function is expected to take ownership and
eventually free the skb passed to it. We need to ensure that the
conn->rx_skb pointer is no longer reachable when calling
l2cap_recv_frame so that no other function, such as l2cap_conn_del, may
think that it can free conn->rx_skb.

An actual situation when this can happen is when smp_sig_channel (called
from l2cap_recv_frame) fails and l2cap_conn_del gets called as a
consequence. The l2cap_conn_del function would then try to free
conn->rx_skb, but as the same skb was just passed to smp_sig_channel and
freed we get a double-free.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
9ecb3e24258f1ff4b9937602962ae12e3b57f98d 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict high speed support to SSP enabled controllers

The support for Bluetooth High Speed can only be enabled on controllers
where also Secure Simple Pairing has been enabled. Trying to enable
high speed when SSP is disabled will result into an error. Disabling
SSP will at the same time disable high speed as well.

It is required to enforce this dependency on SSP since high speed
support is only defined for authenticated, unauthenticated and
debug link keys. These link key types require SSP.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
72ef0c1a9e62c3dd3b4841c8c8a1f259bf7b5d94 10-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded val variable when setting SSP

The variable val in the set_ssp() function of the management interface
is not needed. Just use cp->val directly since its input values have
already been validated.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
620ad5219c0f0aa43731b2fd8fd9efac78c10deb 08-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor hci_connect_le

This patch does some code refactoring in hci_connect_le() by moving
the exception code into if statements and letting the main flow in
first level of function scope. It also adds extra comments to improve
the code readability.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
1d399ae5c74619c841fa13834c4f79506aaf6957 08-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use HCI request for LE connection

This patch introduces a new helper, which uses the HCI request
framework, for creating LE connectons. All the handling is now
done by this function so we can remove the hci_cs_le_create_conn()
event handler.

This patch also removes the old hci_le_create_connection() since
it is not used anymore.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
f74ca9b8094b1b067a0b4069732065f2e1595c73 08-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix changing advertising setting while LE is connected

We only (re)enable advertising when LE is disconnected. Trying to enable
advertising using mgmt_set_advertising while connected should simply
change the flag but not do anything else (until the connection gets
dropped). This patch fixes this by making an LE connection lookup to
determine whether there are any connected devices or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c1f23a2bfc89a886776dc141130ca995ea16a826 07-Oct-2013 Johannes Berg <johannes.berg@intel.com> Bluetooth: Fix variable shadow warnings

Sparse points out three places where variables are shadowed,
rename two of the variables and remove the duplicate third.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
2cap_sock.c
f38ba94147dd568b635be83b2fb571303ce3404c 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read flow control mode on AMP controller init

When initializing an AMP controller, read its current flow control
mode so that the correct value is used.

The AMP controller defaults to block based flow control and this
extra command is just to double check.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7528ca1c5a3821951695e0e55daf192097a9925a 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read location data on AMP controller init

When initializing an AMP controller, read its current known location
data so that it can be analyzed later on.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
f6996cfe2f1db60a74765449f9b53c7591bcdc87 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Read supported features and commands on AMP controllers

The commands for reading supported features and commands are both
supported by AMP controllers. Issue them during controller init
phase so their values are known.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
cd0a85c22cd39f040ef4cff07a6c249bf1023137 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: List powered down AMP controllers correctly

Within the AMP discover response, list powered down AMP controllers
as powered down. No point in trying to make them look any different.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
93c311a044442db62717ae509e09047f34dc3583 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt power down notification for BR/EDR explicit

The management interface only operates on BR/EDR controllers. The check
for the power down notification is a bit intermixed with the check if
controller auto power off is active. Since there are more than just
BR/EDR controllers supported, make this check explicit since the auto
power off check also applies to AMP controllers and it has to happen
in this exact order. Otherwise the bit will not be cleared.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
004b02589c5394a75660a00829086460cc3e4366 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Power off AMP controllers after setup phase

Even AMP controllers should be powered off after the setup phase. It
is not a good idea to keep AMP controllers powered on all the time
if they are not in use.

Power on of the AMP controller can either be done manually via
command line commands or directly via A2MP. Especially since there
is an indication in A2MP for powered down controllers that can
be activated.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2f1e063bc035dbbdb9174cc5f55f073a28780aa8 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_discovering() return void

The return value of mgmt_discovering() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
9cf12aee8bf5eb219c79089fb4556ad1d2066585 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_remote_name() return void

The return value of mgmt_remote_name() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
901801b9a420e58969e039731dd007ae104842d3 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_device_found() return void

The return value of mgmt_device_found() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
9b80ec5e8e66ada404ad65ce61a1de70fee0fbbd 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_device_disconnected() return void

The return value of mgmt_device_disconnected() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
ecd90ae7f600270d68b471f87c66d5b41ce5a974 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_device_connected() return void

The return value of mgmt_device_connected() function is not used
and so just change it to return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
445608d078bf7f7fe975792a940ffac83f495fa9 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_connect_failed() return void

The return value of mgmt_connect_failed() function is not used
so change it to just return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
7892924c7d5d74be8ad52316000a78fe96379044 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_disconnect_failed() return void

The return value of mgmt_disconnect_failed() function is not used
so change it to just return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
3eec705e42d19b3d3e367fcb88693c24175bdbc6 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_set_powered_failed() return void

The return value of mgmt_set_powered_failed() function is never used
and so make the function just return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
bf6b56db0acbe844c96fe36ab65eb7a53c6d8654 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make mgmt_index_added() and mgmt_index_removed() return void

The return value from mgmt_index_added() and mgmt_index_removed()
functions is never used. So do not pretend that returning an error
would actually be handled and just make both functions return void.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
5559435654776359679613f69f1c0a2895603a69 07-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Send new settings only when pairable changes

In case the current value of pairable is already configured, do not
send a new settings event indicating that something has changed while
in reality everything is the same.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
1514b8928e5d8273920b26276cd9617b6dbc7760 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove mgmt_valid_hdev() helper function

The helper function mgmt_valid_hdev() is more obfuscating the code
then it makes it easier to read. So intead of this helper, use the
direct check for BR/EDR device type.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
a6d811ed28f7c49e869b4076a00969c4028cda0d 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove no longer needed mgmt_new_settings() function

The mgmt_new_settings() function was only needed to handle the
error case when re-enabling advertising failed. Since that is
now handled internally inside the management core, this function
is not needed anymore. So just remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
5976e60811723220678ebdb2ea06fbb52fe900bd 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use helper function for re-enabling advertising

When the all LE connections have been disconneted, then it is up to
the host to re-enable advertising at that point. To ensure that the
correct advertising parameters are used, force the usage of the
common helper to enable advertising.

The change just moves the manual enabling of advertising from the
event handler into the management core so that the helper can
be actually shared.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
b4faf30096c3deb618392a88feaa7674cd55c257 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set LE advertising parameters before enabling it

The LE advertising parameters can only be modified when advertising
is disabled. So before enabling it, make sure the controller has all
the right parameters.

Right now all default values are used and thus this does no change
any existing behavior. One minor exception is that in case of single
mode LE-only controllers without a public address, now the random
address is used for advertising.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
bba3aa550f614b8abf6614f6696a095030ce2ff6 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use helper functions for enabling/disabling advertising

The tasks of enabling and disabling advertising are required in many
cases. So refactor the actual HCI operations into two common helpers
to make the code simpler.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
03d87419defc809261c4953e5b44f9e0c8f9029a 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Make it clear that disabling LE disables advertising

This is not a functional change, just change the code to make it easy
to understand that advertising gets disabled before LE support will
be turned off.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
c25dfc610b983f74f05b3c12d9ad4ff4af6cd858 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use random address if public address is not available

For single mode LE-only controllers, it is possible that they come
without a public address. If a public address is not available,
then use the random address for connection establishment and
scanning.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
gmt.c
e8803534a03ddfcb37bd3d6cb981c5131a5bd993 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Simplify device type check for AMP discover response

When counting the number for AMP controllers, a positive check is
used. To be consistent, use the same check when actually adding
the data for the AMP contollers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
01cd340427ab01a744a539981bcc4ef00e5ad133 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use explicit check for BR/EDR device type

The BR/EDR and LE setup procedures apply only to BR/EDR device types
and so check for that explicitly. Checking that it is not an AMP
controller is dangerous in case there will be ever a third device
type.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
a5c8f270e4dae14ea5cb88e477ed1092955f8722 06-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Reject enabling controllers without valid addresses

In case of a single mode LE-only controller it is possible that no
public address is used. These type of controllers require a random
address to be configured.

Without a configured static random address, such a controller is
not functional. So reject powering on the controller in this case
until it gets configured with a random address.

The controller setup stage is still run since it is the only way
to determinate if a public address is available or not. So it is
similar on how RFKILL gets handled during initial setup of the
controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
a646bd81945b337b1cf37dea4734847947a0d9ad 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Check for non BR/EDR controller in AMP discover response

Within the AMP discover response, all controllers that are not the
primary BR/EDR controller are valid.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
1df7b17a87b1aa4d08c461fce06226d33910bf94 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Simplify check if L2CAP connection is AMP capable

The check if a L2CAP connection is AMP capable was a little bit
complicated. This changes the code to make it simpler and more
readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
80d58d0b5b18b68addad61e228ced167f8b80dd3 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move hci_amp_capable() function into L2CAP core

The hci_amp_capable() function has only a single user inside the L2CAP
core. Instead of exporting the function, place it next to its user.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
23f0cb41a20e9850513fa4943f6a19525000cce2 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove check for number of AMP controller

The number of controllers for the AMP discover response has already
been calculated. And since the hci_dev_list lock is held, it can not
change. So there is no need for any extra checks.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
346e7099c299eae085efd9b4aeda813d69bc364b 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove pointless inline function

The inline function for BR/EDR controller AMP discover response
info is rather useless. Just include the code into the function
that builds the whole response.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
536619e86d9398a20063f7c3d15deb9dcc234097 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Rename AMP status constants and use them

The AMP controller status constants need to be actually used to avoid
crypted hardcoded numbers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
ci_core.c
6ed971ca4f6bd96e26b3166cb5a94f7f8158fe77 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use explicit AMP controller id value for BR/EDR

The special AMP controller id 0 is reserved for the BR/EDR controller
that has the main link. It is a fixed value and so use a constant for
this throughout the code to make it more visible when the handling is
for the BR/EDR channel or when it is for the AMP channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2cap_core.c
ece6912648da3fcf257a40774e3aad531c3e5fac 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Separate AMP controller type from HCI device type

There are two defined HCI device types. One is for BR/EDR controllers
and the other is for AMP controllers. The HCI device type is not the
same as the AMP controller type. It just happens that currently the
defined types match, but that is not guaranteed.

Split the usage of AMP controller type into its own domain so that
it is possible to separate between BR/EDR controllers, 802.11 AMP
controllers and any other AMP technology that might be defined in
the future.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
f822c411b26ce0353c8b97877e53a12e4f895ca1 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove useless external function to count controllers

The list of controllers can be counted ahead of time and inline
inside the AMP discover handling. There is no need to export such
a function at all.

In addition just count the AMP controller and only allocated space
for a single mandatory BR/EDR controller. No need to allocate more
space than needed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
23b9003b9ae8dac111460597ba683844e9195e4e 05-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix controller list for AMP discover response

The AMP discover response should list exactly one BR/EDR controller
and ignore all other BR/EDR controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
2210246cf52bd60e8af452f8e184d1cb53e1e4b1 05-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix re-enabling advertising after a connection

LE controllers will automatically disable advertising whenever they
accept a new connection. In order not to fall out of sync with the
advertising setting we need to re-enable advertising whenever the last
LE connection drops. A failure to re-enable advertising should cause the
setting to be disabled, so this patch also calls mgmt_new_settings()
when this happens.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
d2f5a196d7b401b79e2321b24cc0ac8636ffbc17 05-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add public mgmt function to send New Settings event

A function is needed so that the HCI event processing can ask the mgmt
code to emit a new settings event. This is necessary e.g. when the event
processing does updates to mgmt related states without any dependency of
actual mgmt commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f3d3444a4d7f76e79841c59c78105a45295cc4b0 05-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename HCI_LE_PERIPHERAL to HCI_ADVERTISING

This flag is used to indicate whether we want to have advertising
enabled or not, so give it a more suitable name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
gmt.c
46a190cbd3d8992a017664367e9227dcd357ce53 03-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Initialize hci_conn fields in hci_connect_le

This patch moves some hci_conn fields initialization from hci_le_
create_connection() to hci_connect_le(). It makes more sense to
initialize these fields within the function that creates the hci_
conn object.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
f1e5d54743b99cbbea0e0cfb2b3f8053f045b3d7 03-Oct-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename hci_conn variable in hci_connect_le()

This patch simply rename the hci_conn variable "le" to "conn"
since it is a better name.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
4f3e219d95a3c31b916dcd5e2631c4e440736f79 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Only one command per L2CAP LE signalling is supported

The Bluetooth specification makes it clear that only one command
should be present in the L2CAP LE signalling packet. So tighten
the checks here and restrict it to exactly one command.

This is different from L2CAP BR/EDR signalling where multiple
commands can be part of the same packet.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
92381f5cd72b3fb415efe2406ad9fa462a223151 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Check minimum length of SMP packets

When SMP packets are received, make sure they contain at least 1 byte
header for the opcode. If not, drop the packet and disconnect the link.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
b99707d7ee887f9df8b3f7cf75e1e9dbf3206df3 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Drop packets on ATT fixed channel on BR/EDR

The ATT fixed channel is only valid when using LE connections. On
BR/EDR it is required to go through L2CAP connection oriented
channel for ATT.

Drop ATT packets when they are received on a BR/EDR connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
ae4fd2d37433ba58e17adbf1694b7b66eeaec76c 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: L2CAP connectionless channels are only valid for BR/EDR

When receiving connectionless packets on a LE connection, just drop
the packet. There is no concept of connectionless channels for LE.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
7b9899dbcf432b188f3cc22bd1ad9e8050c496fc 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: SMP packets are only valid on LE connections

When receiving SMP packets on a BR/EDR connection, then just drop
the packet and do not try to process it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
94b6a09b67ac4f0772d298aec0973fe3261150a0 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't copy L2CAP LE signalling to raw sockets

The L2CAP raw sockets are only used for BR/EDR signalling. Packets
on LE links should not be forwarded there.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
a28776296c7e3f2d0bb34e0e746968627fe588e8 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix switch statement order for L2CAP fixed channels

The switch statement for the various L2CAP fixed channel handlers
is not really ordered.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
6203fc983457a19a1c4c491ab0e94b4c4c884fb9 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow changing device class when BR/EDR is disabled

Changing the device class when BR/EDR is disabled has no visible
effect for remote devices. However to simplify the logic allow it
as long as the controller supports BR/EDR operations.

If it is not allowed, then the overall logic becomes rather
complicated since the class of device values would need clearing
or restoring when BR/EDR setting changes.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cf99ba1359701ce82e756368513ddd0c5a7164ba 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict loading of long term keys to LE capable controllers

Loading long term keys into a BR/EDR only controller make no sense.
The kernel would never use any of these keys. So instead of allowing
userspace to waste memory, reject such operation with a not supported
error message.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
9060d5cf5200c37dd23f5502bd7c3ccadce04a5f 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict loading of link keys to BR/EDR capable controllers

Loading link keys into a LE only controller make no sense. The kernel
would never use any of these keys. So instead of allowing userspace
to waste memory, reject such operation with a not supported error
message.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
62af444319120347371ae24043da28db75b729db 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow setting static address even if LE is disabled

Setting the static address does not depend on LE beeing enabled. It
only depends on a controller with LE support.

When depending on LE enabled this command becomes really complicated
since in case LE gets disabled, it would be required to clear the
static address and also its random address representation inside
the controller. With future support for private addresses such
complex setup should be avoided.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cdba5281b2496ffbca332e006f258951233bf53d 03-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict SSP setting changes to BR/EDR enabled controllers

Only when BR/EDR is supported and enabled, allow changing of the SSP
setting. Just checking if the hardware supports SSP is not enough
since it might be the case that BR/EDR is disabled.

In the case that BR/EDR is disabled, but SSP supported by the
controller the not supported error message is now returned.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
3b1662952ea9c2c32aac11d60f824fb94b2cf546 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix memory leak with L2CAP signal channels

The wrong type of L2CAP signalling packets on the wrong type of
either BR/EDR or LE links need to be dropped. When that happens
the packet is dropped, but the memory not freed. So actually
free the memory as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
9ab8cf372977d1f89ebeb6201b6cf7a6774b9272 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Increment management interface revision

This patch increments the management interface revision due to the
various fixes, improvements and other changes that have gone in
lately.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
11802b299f3337441d649dcb035a98ec1ff67ade 02-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix advertising data flags with disabled BR/EDR

We shouldn't include the simultaneous LE & BR/EDR flags in the LE
advertising data if BR/EDR is disabled on a dual-mode controller. This
patch fixes this issue and ensures that the create_ad function generates
the correct flags when BR/EDR is disabled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
e6fe798652bfdcdde32a33c2758853e1a8f0c759 02-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix REJECTED vs NOT_SUPPORTED mgmt responses

The REJECTED management response should mainly be used when the adapter
is in a state where we cannot accept some command or a specific
parameter value. The NOT_SUPPORTED response in turn means that the
adapter really cannot support the command or parameter value.

This patch fixes this distinction and adds two helper functions to
easily get the appropriate LE or BR/EDR related status response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d13eafce2c892d57f1eb243e43dfe48b4626006d 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command for setting static address

On dual-mode BR/EDR/LE and LE only controllers it is possible
to configure a random address. There are two types or random
addresses, one is static and the other private. Since the
random private addresses require special privacy feature to
be supported, the configuration of these two are kept separate.

This command allows for setting the static random address. It is
only supported on controllers with LE support. The static random
address is suppose to be valid for the lifetime of the controller
or at least until the next power cycle. To ensure such behavior,
setting of the address is limited to when the controller is
powered off.

The special BDADDR_ANY address (00:00:00:00:00:00) can be used to
disable the static address. This is also the default value.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
a0cdf960bec0b040307229bc25c40fa33c20dff1 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict disabling of HS when controller is powered off

Disabling the high speed setting when the controller is powered on has
too many side effects that are not taken care of. And in general it
is not an useful operation anyway. So just make such a command fail
with a rejection error message.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
0663ca2a032eea12480a8f86fe08bef9d72f8faf 02-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a new mgmt_set_bredr command

This patch introduces a new mgmt command for enabling/disabling BR/EDR
functionality. This can be convenient when one wants to make a dual-mode
controller behave like a single-mode one. The command is only available
for dual-mode controllers and requires that LE is enabled before using
it. The BR/EDR setting can be enabled at any point, however disabling it
requires the controller to be powered off (otherwise a "rejected"
response will be sent).

Disabling the BR/EDR setting will automatically disable all other BR/EDR
related settings.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
56f8790102f48a4959a729ecdccff332591014e1 02-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce a new HCI_BREDR_ENABLED flag

To allow treating dual-mode (BR/EDR/LE) controllers as single-mode ones
(LE-only) we want to introduce a new HCI_BREDR_ENABLED flag to track
whether BR/EDR is enabled or not (previously we simply looked at the
feature bit with lmp_bredr_enabled).

This patch add the new flag and updates the relevant places to test
against it instead of using lmp_bredr_enabled. The flag is by default
enabled when registering an adapter and only cleared if necessary once
the local features have been read during the HCI init procedure.

We cannot completely block BR/EDR usage in case user space uses raw HCI
sockets but the patch tries to block this in places where possible, such
as the various BR/EDR specific ioctls.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
gmt.c
e1d08f406792219ace03aa02e53a6946abc15ec8 01-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix workqueue synchronization in hci_dev_open

When hci_sock.c calls hci_dev_open it needs to ensure that there isn't
pending work in progress, such as that which is scheduled for the
initial setup procedure or the one for automatically powering off after
the setup procedure. This adds the necessary calls to ensure that any
previously scheduled work is completed before attempting to call
hci_dev_do_open.

This patch fixes a race with old user space versions where we might
receive a HCIDEVUP ioctl before the setup procedure has been completed.
When that happens the setup procedures callback may fail early and leave
the device in an inconsistent state, causing e.g. the setup callback to
be (incorrectly) called more than once.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
cbed0ca137ef442c545602a09030bbb35d8db013 01-Oct-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor hci_dev_open to a separate hci_dev_do_open function

The requirements of an external call to hci_dev_open from hci_sock.c are
different to that from within hci_core.c. In the former case we want to
flush any pending work in hdev->req_workqueue whereas in the latter we
don't (since there we are already calling from within the workqueue
itself). This patch does the necessary refactoring to a separate
hci_dev_do_open function (analogous to hci_dev_do_close) but does not
yet introduce the synchronizations relating to the workqueue usage.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
922ca1dfc2127a5dc363e8c1e6c8a33c5a0a14c6 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable -D__CHECK_ENDIAN__ for sparse by default

The Bluetooth protocol and hardware is pretty much all little endian
and so when running sparse via "make C=2" for example, enable the
endian checks by default.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
akefile
10a8b86f575235258bdf195e4503f2c2ddfd2e26 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Require CAP_NET_ADMIN for HCI User Channel operation

The HCI User Channel operation is an admin operation that puts the
device into promiscuous mode for single use. It is more suitable
to require CAP_NET_ADMIN than CAP_NET_RAW.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
ee39269369eaada5daae7fabb69bc03429e23bc7 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Send new settings event when changing high speed option

When enabling or disabling high speed setting it is required to send
a new settings event to inform other management interface users about
the changed settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
848566b381e72b07e41beffde677955ae1498153 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Provide high speed configuration option

Hiding the Bluetooth high speed support behind a module parameter is
not really useful. This can be enabled and disabled at runtime via
the management interface. This also has the advantage that this can
now be changed per controller and not just global.

This patch removes the module parameter and exposes the high speed
setting of the management interface to all controllers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2cap_core.c
2cap_sock.c
gmt.c
60f2a3ed7beb2e9b8f2c63de0895f587e0c1ca76 02-Oct-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use only 2 bits for controller type information

The controller type is limited to BR/EDR/LE and AMP controllers. This
can be easily encoded with just 2 bits and still leave enough room
for future controller types.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
1025c04cecd19882e28f16c4004034b475c372c5 27-Sep-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Merge git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Conflicts:
net/bluetooth/hci_core.c
4375f1037d52602413142e290608d0d84671ad36 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add new mgmt_set_advertising command

This patch adds a new mgmt command for enabling and disabling
LE advertising. The command depends on the LE setting being enabled
first and will return a "rejected" response otherwise. The patch also
adds safeguards so that there will ever only be one set_le or
set_advertising command pending per adapter.

The response handling and new_settings event sending is done in an
asynchronous request callback, meaning raw HCI access from user space to
enable advertising (e.g. hciconfig leadv) will not trigger the
new_settings event. This is intentional since trying to support mixed
raw HCI and mgmt access would mean adding extra state tracking or new
helper functions, essentially negating the benefit of using the
asynchronous request framework. The HCI_LE_ENABLED and HCI_LE_PERIPHERAL
flags however are updated correctly even with raw HCI access so this
will not completely break subsequent access over mgmt.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
eeca6f891305a80378da978f803821c2a0b648b6 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add new mgmt setting for LE advertising

This patch adds a new mgmt setting for LE advertising and hooks up the
necessary places in the mgmt code to operate on the HCI_LE_PERIPHERAL
flag (which corresponds to this setting). This patch does not yet add
any new command for enabling the setting - that is left for a subsequent
patch.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
416a4ae56b7a37407ca1155805c05b638f845778 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use async request for LE enable/disable

This patch updates the code to use an asynchronous request for handling
the enabling and disabling of LE support. This refactoring is necessary
as a preparation for adding advertising support, since when LE is
disabled we should also disable advertising, and the cleanest way to do
this is to perform the two respective HCI commands in the same
asynchronous request.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
bd99abdd5b876406c34b872956b3237e18613566 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move mgmt response convenience functions to a better location

The settings_rsp and cmd_status_rsp functions can be useful for all mgmt
command handlers when asynchronous request callbacks are used. They will
e.g. be used by subsequent patches to change set_le to use an async
request as well as a new set_advertising command. Therefore, move them
higher up in the mgmt.c file to avoid unnecessary forward declarations
or mixing this trivial change with other patches.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
87b95ba64efcfcf70a9f9933297994aada64cd74 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix busy return for mgmt_set_powered in some cases

We should return a "busy" error always when there is another
mgmt_set_powered operation in progress. Previously when powering on
while the auto off timer was still set the code could have let two or
more pending power on commands to be queued. This patch fixes the issue
by moving the check for duplicate commands to an earlier point in the
set_powered handler.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
970871bc9cb2f5f783cb7cca31ff223c44662327 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Clean up socket locking in l2cap_sock_recvmsg

This patch cleans up the locking login in l2cap_sock_recvmsg by pairing
up each lock_sock call with a release_sock call. The function already
has a "done" label that handles releasing the socket and returning from
the function so the fix is rather simple.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
0fba96f97bba73469dd952319fddc4a3cc99dd97 25-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add clarifying comment to bt_sock_wait_state()

The bt_sock_wait_state requires the sk lock to be held (through
lock_sock) so document it clearly in the code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
941247f910953d6b0649c81f6cb446110438afae 22-Sep-2013 Peter Senna Tschudin <peter.senna@gmail.com> Bluetooth: Fix assignment of 0/1 to bool variables

Convert 0 to false and 1 to true when assigning values to bool
variables. Inspired by commit 3db1cd5c05f35fb43eb134df6f321de4e63141f2.

The simplified semantic patch that find this problem is as
follows (http://coccinelle.lip6.fr/):

@@
bool b;
@@
(
-b = 0
+b = false
|
-b = 1
+b = true
)

Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
29cd718beba999bda4bdbbf59b5a4d25c07e1547 27-Aug-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: don't release the port in rfcomm_dev_state_change()

When the dlc is closed, rfcomm_dev_state_change() tries to release the
port in the case it cannot get a reference to the tty. However this is
racy and not even needed.

Infact as Peter Hurley points out:

1. Only consider dlcs that are 'stolen' from a connected socket, ie.
reused. Allocated dlcs cannot have been closed prior to port
activate and so for these dlcs a tty reference will always be avail
in rfcomm_dev_state_change() -- except for the conditions covered by
#2b below.
2. If a tty was at some point previously created for this rfcomm, then
either
(a) the tty reference is still avail, so rfcomm_dev_state_change()
will perform a hangup. So nothing to do, or,
(b) the tty reference is no longer avail, and the tty_port will be
destroyed by the last tty_port_put() in rfcomm_tty_cleanup.
Again, no action required.
3. Prior to obtaining the dlc lock in rfcomm_dev_add(),
rfcomm_dev_state_change() will not 'see' a rfcomm_dev so nothing to
do here.
4. After releasing the dlc lock in rfcomm_dev_add(),
rfcomm_dev_state_change() will 'see' an incomplete rfcomm_dev if a
tty reference could not be obtained. Again, the best thing to do here
is nothing. Any future attempted open() will block on
rfcomm_dev_carrier_raised(). The unconnected device will exist until
released by ioctl(RFCOMMRELEASEDEV).

The patch removes the aforementioned code and uses the
tty_port_tty_hangup() helper to hangup the tty.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
d62e6d67a776fe6a0a725e2835e4f9e16e8db512 13-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add event mask page 2 setting support

For those controller that support the HCI_Set_Event_Mask_Page_2 command
we should include it in the init sequence. This patch implements sending
of the command and enables the events in it based on supported features
(currently only CSB is checked).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5d4e7e8db0544ec53025383bac49a3328affdad3 13-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add synchronization train parameters reading support

This patch adds support for reading the synchronization train parameters
for controllers that support the feature. Since the feature is
detectable through the local features page 2, which is retreived only in
stage 3 of the HCI init sequence, there is no other option than to add a
fourth stage to the init sequence.

For now the patch doesn't yet add storing of the parameters, but it is
nevertheless convenient to have around to see what kind of parameters
various controllers use by default (analyzable e.g. with the btmon user
space tool).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
e793dcf082c847bd2b742c781252c20cbec37986 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix waiting for clearing of BT_SK_SUSPEND flag

In the case of blocking sockets we should not proceed with sendmsg() if
the socket has the BT_SK_SUSPEND flag set. So far the code was only
ensuring that POLLOUT doesn't get set for non-blocking sockets using
poll() but there was no code in place to ensure that blocking sockets do
the right thing when writing to them.

This patch adds a new bt_sock_wait_ready helper function to sleep in the
sendmsg call if the BT_SK_SUSPEND flag is set, and wake up as soon as it
is unset. It also updates the L2CAP and RFCOMM sendmsg callbacks to take
advantage of this new helper function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
2cap_sock.c
fcomm/sock.c
69c4e4e8b4ca8440e5cbb66219a179e73f7b9e9a 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix responding to invalid L2CAP signaling commands

When we have an LE link we should not respond to any data on the BR/EDR
L2CAP signaling channel (0x0001) and vice-versa when we have a BR/EDR
link we should not respond to LE L2CAP (CID 0x0005) signaling commands.
This patch fixes this issue by checking for a valid link type and
ignores data if it is wrong.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
9245e7375816c4d94d6327c8761b3c7431a5bc2f 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending responses to identified L2CAP response packets

When L2CAP packets return a non-zero error and the value is passed
onwards by l2cap_bredr_sig_cmd this will trigger a command reject packet
to be sent. However, the core specification (page 1416 in core 4.0) says
the following: "Command Reject packets should not be sent in response to
an identified Response packet.".

This patch ensures that a command reject packet is not sent for any
identified response packet by ignoring the error return value from the
response handler functions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
7c2005d6f9128aec77833019f5c134e4c63af9c5 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP command reject reason

There are several possible reason codes that can be sent in the command
reject L2CAP packet. Before this patch the code has used a hard-coded
single response code ("command not understood"). This patch adds a
helper function to map the return value of an L2CAP handler function to
the correct command reject reason.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
c4ea249f5f164957ec8402ba9f3b827d740b299c 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP Disconnect response for unknown CID

If we receive an L2CAP Disconnect Request for an unknown CID we should
not just silently drop it but reply with a proper Command Reject
response. This patch fixes this by ensuring that the disconnect handler
returns a proper error instead of 0 and will cause the function caller
to send the right response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
21870b523e847432312a1b62239ad139369e9f9f 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix L2CAP error return used for failed channel lookups

The EFAULT error should only be used for memory address related errors
and ENOENT might be needed for other purposes than invalid CID errors.
This patch fixes the l2cap_config_req, l2cap_connect_create_rsp and
l2cap_create_channel_req handlers to use the unique EBADSLT error to
indicate failed lookups on a given CID.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
dc280801da1006cd9c702cfaae7ae677fdbc5b53 16-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix double error response for l2cap_create_chan_req

When an L2CAP request handler returns non-zero the calling code will
send a command reject response. The l2cap_create_chan_req function will
in some cases send its own response but then still return a -EFAULT
error which would cause two responses to be sent. This patch fixes this
by making the function return 0 after sending its own response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
bf5430360ebe4b2d0c51d91f782e649107b502eb 13-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix rfkill functionality during the HCI setup stage

We need to let the setup stage complete cleanly even when the HCI device
is rfkilled. Otherwise the HCI device will stay in an undefined state
and never get notified to user space through mgmt (even when it gets
unblocked through rfkill).

This patch makes sure that hci_dev_open() can be called in the HCI_SETUP
stage, that blocking the device doesn't abort the setup stage, and that
the device gets proper powered down as soon as the setup stage completes
in case it was blocked meanwhile.

The bug that this patch fixed can be very easily reproduced using e.g.
the rfkill command line too. By running "rfkill block all" before
inserting a Bluetooth dongle the resulting HCI device goes into a state
where it is never announced over mgmt, not even when "rfkill unblock all"
is run.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5e130367d43ff22836bbae380d197d600fe8ddbb 13-Sep-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce a new HCI_RFKILLED flag

This makes it more convenient to check for rfkill (no need to check for
dev->rfkill before calling rfkill_blocked()) and also avoids potential
races if the RFKILL state needs to be checked from within the rfkill
callback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
330b6c1521d76d8b88513fbafe18709ad86dafc4 05-Aug-2013 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Fix ACL alive for long in case of non pariable devices

For certain devices (ex: HID mouse), support for authentication,
pairing and bonding is optional. For such devices, the ACL alive
for too long after the L2CAP disconnection.

To avoid the ACL alive for too long after L2CAP disconnection, reset the
ACL disconnect timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.

While merging the commit id:a9ea3ed9b71cc3271dd59e76f65748adcaa76422
this issue might have introduced.

Hcidump info:
sh-4.1# /opt/hcidump -Xt
2013-08-05 16:49:00.894129 < ACL data: handle 12 flags 0x00 dlen 12
L2CAP(s): Disconn req: dcid 0x004a scid 0x0041
2013-08-05 16:49:00.894195 < HCI Command: Exit Sniff Mode (0x02|0x0004)
plen 2
handle 12
2013-08-05 16:49:00.894269 < ACL data: handle 12 flags 0x00 dlen 12
L2CAP(s): Disconn req: dcid 0x0049 scid 0x0040
2013-08-05 16:49:00.895645 > HCI Event: Command Status (0x0f) plen 4
Exit Sniff Mode (0x02|0x0004) status 0x00 ncmd 1
2013-08-05 16:49:00.934391 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x00 interval 0
Mode: Active
2013-08-05 16:49:00.936592 > HCI Event: Number of Completed Packets
(0x13) plen 5
handle 12 packets 2
2013-08-05 16:49:00.951577 > ACL data: handle 12 flags 0x02 dlen 12
L2CAP(s): Disconn rsp: dcid 0x004a scid 0x0041
2013-08-05 16:49:00.952820 > ACL data: handle 12 flags 0x02 dlen 12
L2CAP(s): Disconn rsp: dcid 0x0049 scid 0x0040
2013-08-05 16:49:00.969165 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x02 interval 50
Mode: Sniff

2013-08-05 16:49:48.175533 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x00 interval 0
Mode: Active
2013-08-05 16:49:48.219045 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x02 interval 108
Mode: Sniff

2013-08-05 16:51:00.968209 < HCI Command: Disconnect (0x01|0x0006) plen 3
handle 12 reason 0x13
Reason: Remote User Terminated Connection
2013-08-05 16:51:00.969056 > HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) status 0x00 ncmd 1
2013-08-05 16:51:01.013495 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x00 interval 0
Mode: Active
2013-08-05 16:51:01.073777 > HCI Event: Disconn Complete (0x05) plen 4
status 0x00 handle 12 reason 0x16
Reason: Connection Terminated by Local Host

============================ After fix ================================

2013-08-05 16:57:35.986648 < ACL data: handle 11 flags 0x00 dlen 12
L2CAP(s): Disconn req: dcid 0x004c scid 0x0041
2013-08-05 16:57:35.986713 < HCI Command: Exit Sniff Mode (0x02|0x0004)
plen 2
handle 11
2013-08-05 16:57:35.986785 < ACL data: handle 11 flags 0x00 dlen 12
L2CAP(s): Disconn req: dcid 0x004b scid 0x0040
2013-08-05 16:57:35.988110 > HCI Event: Command Status (0x0f) plen 4
Exit Sniff Mode (0x02|0x0004) status 0x00 ncmd 1
2013-08-05 16:57:36.030714 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 11 mode 0x00 interval 0
Mode: Active
2013-08-05 16:57:36.032950 > HCI Event: Number of Completed Packets
(0x13) plen 5
handle 11 packets 2
2013-08-05 16:57:36.047926 > ACL data: handle 11 flags 0x02 dlen 12
L2CAP(s): Disconn rsp: dcid 0x004c scid 0x0041
2013-08-05 16:57:36.049200 > ACL data: handle 11 flags 0x02 dlen 12
L2CAP(s): Disconn rsp: dcid 0x004b scid 0x0040
2013-08-05 16:57:36.065509 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 11 mode 0x02 interval 50
Mode: Sniff

2013-08-05 16:57:40.052006 < HCI Command: Disconnect (0x01|0x0006) plen 3
handle 11 reason 0x13
Reason: Remote User Terminated Connection
2013-08-05 16:57:40.052869 > HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) status 0x00 ncmd 1
2013-08-05 16:57:40.104731 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 11 mode 0x00 interval 0
Mode: Active
2013-08-05 16:57:40.146935 > HCI Event: Disconn Complete (0x05) plen 4
status 0x00 handle 11 reason 0x16
Reason: Connection Terminated by Local Host

Signed-off-by: Sang-Ki Park <sangki79.park@samsung.com>
Signed-off-by: Chan-yeol Park <chanyeol.park@samsung.com>
Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
89cbb4da0abee2f39d75f67f9fd57f7410c8b65c 31-Jul-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix encryption key size for peripheral role

This patch fixes the connection encryption key size information when
the host is playing the peripheral role. We should set conn->enc_key_
size in hci_le_ltk_request_evt, otherwise it is left uninitialized.

Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
f8776218e8546397be64ad2bc0ebf4748522d6e3 31-Jul-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix security level for peripheral role

While playing the peripheral role, the host gets a LE Long Term Key
Request Event from the controller when a connection is established
with a bonded device. The host then informs the LTK which should be
used for the connection. Once the link is encrypted, the host gets
an Encryption Change Event.

Therefore we should set conn->pending_sec_level instead of conn->
sec_level in hci_le_ltk_request_evt. This way, conn->sec_level is
properly updated in hci_encrypt_change_evt.

Moreover, since we have a LTK associated to the device, we have at
least BT_SECURITY_MEDIUM security level.

Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
52de599e04e8767b0d9b7874451cb5db91a4a70b 04-Sep-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Only schedule raw queue when user channel is active

When the user channel is set and an user application has full control
over the device, do not bother trying to schedule any queues except
the raw queue.

This is an optimization since with user channel, only the raw queue
is in use.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
a675d7f1a0a0c0d7bde56ae89609dee56f2033e1 04-Sep-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use GFP_KERNEL when cloning SKB in a workqueue

There is no need to use GFP_ATOMIC with skb_clone() when the code is
executed in a workqueue.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
af750e942ea138553ee5693210c2f918448f58dc 04-Sep-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Disable upper layer connections when user channel is active

When the device has the user channel flag set, it means it is driven by
an user application. In that case do not allow any connections from
L2CAP or SCO sockets.

This is the same situation as when the device has the raw flag set and
it will then return EHOSTUNREACH.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
23500189d7e03a071f0746f43f2cce875a62c91c 27-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce new HCI socket channel for user operation

This patch introcuces a new HCI socket channel that allows user
applications to take control over a specific HCI device. The application
gains exclusive access to this device and forces the kernel to stay away
and not manage it. In case of the management interface it will actually
hide the device.

Such operation is useful for security testing tools that need to operate
underneath the Bluetooth stack and need full control over a device. The
advantage here is that the kernel still provides the service of hardware
abstraction and HCI level access. The use of Bluetooth drivers for
hardware access also means that sniffing tools like btmon or hcidump
are still working and the whole set of transaction can be traced with
existing tools.

With the new channel it is possible to send HCI commands, ACL and SCO
data packets and receive HCI events, ACL and SCO packets from the
device. The format follows the well established H:4 protocol.

The new HCI user channel can only be established when a device has been
through its setup routine and is currently powered down. This is
enforced to not cause any problems with current operations. In addition
only one user channel per HCI device is allowed. It is exclusive access
for one user application. Access to this channel is limited to process
with CAP_NET_RAW capability.

Using this new facility does not require any external library or special
ioctl or socket filters. Just create the socket and bind it. After that
the file descriptor is ready to speak H:4 protocol.

struct sockaddr_hci addr;
int fd;

fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);

memset(&addr, 0, sizeof(addr));
addr.hci_family = AF_BLUETOOTH;
addr.hci_dev = 0;
addr.hci_channel = HCI_CHANNEL_USER;

bind(fd, (struct sockaddr *) &addr, sizeof(addr));

The example shows on how to create a user channel for hci0 device. Error
handling has been left out of the example. However with the limitations
mentioned above it is advised to handle errors. Binding of the user
cahnnel socket can fail for various reasons. Specifically if the device
is currently activated by BlueZ or if the access permissions are not
present.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
0736cfa8e5bb7ee1d7b7d28aabe634fd3f85cb92 27-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Introduce user channel flag for HCI devices

This patch introduces a new user channel flag that allows to give full
control of a HCI device to a user application. The kernel will stay away
from the device and does not allow any further modifications of the
device states.

The existing raw flag is not used since it has a bit of unclear meaning
due to its legacy. Using a new flag makes the code clearer.

A device with the user channel flag set can still be enumerate using the
legacy API, but it does not longer enumerate using the new management
interface used by BlueZ 5 and beyond. This is intentional to not confuse
users of modern systems.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_sock.c
gmt.c
c1c4f9567040c5677828142f52b55422886bd62c 26-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict ioctls to HCI raw channel sockets

The various legacy ioctls used with HCI sockets are limited to raw
channel only. They are not used on the other channels and also have
no meaning there. So return an error if tried to use them.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
c2371e80b3d0d11df10579a39cdad3310c944325 26-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix error handling for HCI socket options

The HCI sockets for monitor and control do not support any HCI specific
socket options and if tried, an error will be returned. However the
error used is EINVAL and that is not really descriptive. To make it
clear that these sockets are not handling HCI socket options, return
EBADFD instead.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
808a049e2618bb535274aa41bf954232abc44bf5 27-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Report error for HCI reset ioctl when device is down

Even if this is legacy API, there is no reason to not report a proper
error when trying to reset a HCI device that is down.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
9d4b68b23947e7bdf3f2707e76bd61572c523f6c 26-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix handling of getsockname() for HCI sockets

The hci_dev check is not protected and so move it into the socket lock. In
addition return the HCI channel identifier instead of always 0 channel.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
06f43cbc4d61922d5a14c28909f02ae9c7fc5283 26-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix handling of getpeername() for HCI sockets

The HCI sockets do not have a peer associated with it and so make sure
that getpeername() returns EOPNOTSUPP since this operation is actually
not supported on HCI sockets.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
f81fe64f3d3bc76c1a8d3edb80b54219a60ff291 26-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Refactor raw socket filter into more readable code

The handling of the raw socket filter is rather obscure code and it gets
in the way of future extensions. Instead of inline filtering in the raw
socket packet routine, refactor it into its own function.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
22e04f6b4b04a8afe9af9239224591d06ba3b24d 06-Sep-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID updates from Jiri Kosina:
"Highlights:

- conversion of HID subsystem to use devm-based resource management,
from Benjamin Tissoires

- i2c-hid support for DT bindings, from Benjamin Tissoires

- much improved support for Win8-multitouch devices, from Benjamin
Tissoires

- cleanup of core code using common hidinput_input_event(), from
David Herrmann

- fix for bug in implement() access to the bit stream (causing oops)
that has been present in the code for ages, but devices that are
able to trigger it have started to appear only now, from Jiri
Kosina

- fixes for CVE-2013-2899, CVE-2013-2898, CVE-2013-2896,
CVE-2013-2892, CVE-2013-2888 (all triggerable only by specially
crafted malicious HW devices plugged into the system), from Kees
Cook

- hidraw oops fix, from Manoj Chourasia

- various smaller fixes here and there, support for a bunch of new
devices by various contributors"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (53 commits)
HID: MAINTAINERS: add roccat drivers
HID: hid-sensor-hub: change kmalloc + memcpy by kmemdup
HID: hid-sensor-hub: move to devm_kzalloc
HID: hid-sensor-hub: fix indentation accross the code
HID: move HID_REPORT_TYPES closer to the report-definitions
HID: check for NULL field when setting values
HID: picolcd_core: validate output report details
HID: sensor-hub: validate feature report details
HID: ntrig: validate feature report details
HID: pantherlord: validate output report details
HID: hid-wiimote: print small buffers via %*phC
HID: uhid: improve uhid example client
HID: Correct the USB IDs for the new Macbook Air 6
HID: wiimote: add support for Guitar-Hero guitars
HID: wiimote: add support for Guitar-Hero drums
Input: introduce BTN/ABS bits for drums and guitars
HID: battery: don't do DMA from stack
HID: roccat: add support for KonePureOptical v2
HID: picolcd: Prevent NULL pointer dereference on _remove()
HID: usbhid: quirk for N-Trig DuoSense Touch Screen
...
cc998ff8811530be521f6b316f37ab7676a07938 05-Sep-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking changes from David Miller:
"Noteworthy changes this time around:

1) Multicast rejoin support for team driver, from Jiri Pirko.

2) Centralize and simplify TCP RTT measurement handling in order to
reduce the impact of bad RTO seeding from SYN/ACKs. Also, when
both timestamps and local RTT measurements are available prefer
the later because there are broken middleware devices which
scramble the timestamp.

From Yuchung Cheng.

3) Add TCP_NOTSENT_LOWAT socket option to limit the amount of kernel
memory consumed to queue up unsend user data. From Eric Dumazet.

4) Add a "physical port ID" abstraction for network devices, from
Jiri Pirko.

5) Add a "suppress" operation to influence fib_rules lookups, from
Stefan Tomanek.

6) Add a networking development FAQ, from Paul Gortmaker.

7) Extend the information provided by tcp_probe and add ipv6 support,
from Daniel Borkmann.

8) Use RCU locking more extensively in openvswitch data paths, from
Pravin B Shelar.

9) Add SCTP support to openvswitch, from Joe Stringer.

10) Add EF10 chip support to SFC driver, from Ben Hutchings.

11) Add new SYNPROXY netfilter target, from Patrick McHardy.

12) Compute a rate approximation for sending in TCP sockets, and use
this to more intelligently coalesce TSO frames. Furthermore, add
a new packet scheduler which takes advantage of this estimate when
available. From Eric Dumazet.

13) Allow AF_PACKET fanouts with random selection, from Daniel
Borkmann.

14) Add ipv6 support to vxlan driver, from Cong Wang"

Resolved conflicts as per discussion.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1218 commits)
openvswitch: Fix alignment of struct sw_flow_key.
netfilter: Fix build errors with xt_socket.c
tcp: Add missing braces to do_tcp_setsockopt
caif: Add missing braces to multiline if in cfctrl_linkup_request
bnx2x: Add missing braces in bnx2x:bnx2x_link_initialize
vxlan: Fix kernel panic on device delete.
net: mvneta: implement ->ndo_do_ioctl() to support PHY ioctls
net: mvneta: properly disable HW PHY polling and ensure adjust_link() works
icplus: Use netif_running to determine device state
ethernet/arc/arc_emac: Fix huge delays in large file copies
tuntap: orphan frags before trying to set tx timestamp
tuntap: purge socket error queue on detach
qlcnic: use standard NAPI weights
ipv6:introduce function to find route for redirect
bnx2x: VF RSS support - VF side
bnx2x: VF RSS support - PF side
vxlan: Notify drivers for listening UDP port changes
net: usbnet: update addr_assign_type if appropriate
driver/net: enic: update enic maintainers and driver
driver/net: enic: Exposing symbols for Cisco's low latency driver
...
27703bb4a66df49ff16b44b864d307d2eb71774c 05-Sep-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge tag 'PTR_RET-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

Pull PTR_RET() removal patches from Rusty Russell:
"PTR_RET() is a weird name, and led to some confusing usage. We ended
up with PTR_ERR_OR_ZERO(), and replacing or fixing all the usages.

This has been sitting in linux-next for a whole cycle"

[ There are still some PTR_RET users scattered about, with some of them
possibly being new, but most of them existing in Rusty's tree too. We
have that

#define PTR_RET(p) PTR_ERR_OR_ZERO(p)

thing in <linux/err.h>, so they continue to work for now - Linus ]

* tag 'PTR_RET-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
GFS2: Replace PTR_RET with PTR_ERR_OR_ZERO
Btrfs: volume: Replace PTR_RET with PTR_ERR_OR_ZERO
drm/cma: Replace PTR_RET with PTR_ERR_OR_ZERO
sh_veu: Replace PTR_RET with PTR_ERR_OR_ZERO
dma-buf: Replace PTR_RET with PTR_ERR_OR_ZERO
drivers/rtc: Replace PTR_RET with PTR_ERR_OR_ZERO
mm/oom_kill: remove weird use of ERR_PTR()/PTR_ERR().
staging/zcache: don't use PTR_RET().
remoteproc: don't use PTR_RET().
pinctrl: don't use PTR_RET().
acpi: Replace weird use of PTR_RET.
s390: Replace weird use of PTR_RET.
PTR_RET is now PTR_ERR_OR_ZERO(): Replace most.
PTR_RET is now PTR_ERR_OR_ZERO
efd15f5f4ff63f6ac5d80850686e3d2cc8c4481b 04-Sep-2013 Jiri Kosina <jkosina@suse.cz> Merge branch 'master' into for-3.12/upstream

Sync with Linus' tree to be able to apply fixup patch on top
of 9d9a04ee75 ("HID: apple: Add support for the 2013 Macbook Air")

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
69b307a48a5e10d5fd53dbbfae1c700da356bd5d 22-Aug-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
2dea632f9acad076370fe871d4ccc93868621403 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Add SCO connection fallback

When initiating a transparent eSCO connection, make use of T2 settings
at first try. T2 is the recommended settings from HFP 1.6 WideBand
Speech. Upon connection failure, try T1 settings.

When CVSD is requested and eSCO is supported, try to establish eSCO
connection using S3 settings. If it fails, fallback in sequence to S2,
S1, D1, D0 settings.

To know which setting should be used, conn->attempt is used. It
indicates the currently ongoing SCO connection attempt and can be used
as the index for the fallback settings table.

These setting and the fallback order are described in Bluetooth HFP 1.6
specification p. 101.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_event.c
1a4c958cf9b1e159bc63d63b9e362904dd2c4ac3 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Handle specific error for SCO connection fallback

Synchronous Connection Complete event can return error "Connection
Rejected due to Limited resources (0x10)".
Handling this error is required for SCO connection fallback. This error
happens when the server tried to accept the connection but failed to
negotiate settings.
This error code has been verified experimentally by sending a T2 request
to a T1 only SCO listener.

Client dump follows :

< HCI Command (0x01|0x0028) plen 17 [hci0] 3.696064
Handle: 12
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 13
Setting: 0x0003
Retransmission effort: Optimize for link quality (0x02)
Packet type: 0x0380
> HCI Event (0x0f) plen 4 [hci0] 3.697034
Setup Synchronous Connection (0x01|0x0028) ncmd 1
Status: Success (0x00)
> HCI Event (0x2c) plen 17 [hci0] 3.736059
Status: Connection Rejected due to Limited Resources (0x0d)
Handle: 0
Address: xx:xx:xx:xx:xx:AB (OUI 70-F3-95)
Link type: eSCO (0x02)
Transmission interval: 0x0c
Retransmission window: 0x06
RX packet length: 60
TX packet length: 60
Air mode: Transparent (0x03)

Server dump follows :

> HCI Event (0x04) plen 10 [hci0] 4.741513
Address: xx:xx:xx:xx:xx:D9 (OUI 20-68-9D)
Class: 0x620100
Major class: Computer (desktop, notebook, PDA, organizers)
Minor class: Uncategorized, code for device not assigned
Networking (LAN, Ad hoc)
Audio (Speaker, Microphone, Headset)
Telephony (Cordless telephony, Modem, Headset)
Link type: eSCO (0x02)
< HCI Command (0x01|0x0029) plen 21 [hci0] 4.743269
Address: xx:xx:xx:xx:xx:D9 (OUI 20-68-9D)
Transmit bandwidth: 8000
Receive bandwidth: 8000
Max latency: 13
Setting: 0x0003
Retransmission effort: Optimize for link quality (0x02)
Packet type: 0x03c1
> HCI Event (0x0f) plen 4 [hci0] 4.745517
Accept Synchronous Connection (0x01|0x0029) ncmd 1
Status: Success (0x00)
> HCI Event (0x2c) plen 17 [hci0] 4.749508
Status: Connection Rejected due to Limited Resources (0x0d)
Handle: 0
Address: xx:xx:xx:xx:xx:D9 (OUI 20-68-9D)
Link type: eSCO (0x02)
Transmission interval: 0x0c
Retransmission window: 0x06
RX packet length: 60
TX packet length: 60
Air mode: Transparent (0x03)

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
79dc0087c33f06a8c35d8c9e37ea6307b790bc4c 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Prevent transparent SCO on older devices

Older Bluetooth devices may not support Setup Synchronous Connection or
SCO transparent data. This is indicated by the corresponding LMP feature
bits. It is not possible to know if the adapter support these features
before setting BT_VOICE option since the socket is not bound to an
adapter. An adapter can also be added after the socket is created. The
socket can be bound to an address before adapter is plugged in.

Thus, on a such adapters, if user request BT_VOICE_TRANSPARENT, outgoing
connections fail on connect() and returns -EOPNOTSUPP. Incoming
connections do not fail. However, they should only be allowed depending
on what was specified in Write_Voice_Settings command.

EOPNOTSUPP is choosen because connect() system call is failing after
selecting route but before any connection attempt.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
10c62ddc6f032c3a096401ca3ce7e5b2d5780859 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Parameters for outgoing SCO connections

In order to establish a transparent SCO connection, the correct settings
must be specified in the Setup Synchronous Connection request. For that,
a setting field is added to ACL connection data to set up the desired
parameters. The patch also removes usage of hdev->voice_setting in CVSD
connection and makes use of T2 parameters for transparent data.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
co.c
2f69a82acf6f971a9e184dd32b24c79a14388a6c 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Use voice setting in deferred SCO connection request

When an incoming eSCO connection is requested, check the selected voice
setting and reply appropriately. Voice setting should have been
negotiated previously. For example, in case of HFP, the codec is
negotiated using AT commands on the RFCOMM channel. This patch only
changes replies for socket with deferred setup enabled.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
ad10b1a48754b1381582d96f070a39832e41382d 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Add Bluetooth socket voice option

This patch extends the current Bluetooth socket options with BT_VOICE.
This is intended to choose voice data type at runtime. It only applies
to SCO sockets. Incoming connections shall be setup during deferred
setup. Outgoing connections shall be setup before connect(). The desired
setting is stored in the SCO socket info. This patch declares needed
members, modifies getsockopt() and setsockopt().

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
33f2404823f000f9b5fc570b0a08b1008e241578 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Remove unused mask parameter in sco_conn_defer_accept

From Bluetooth Core v4.0 specification, 7.1.8 Accept Connection Request
Command "When accepting synchronous connection request, the Role
parameter is not used and will be ignored by the BR/EDR Controller."

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
e660ed6c70370dae0887e2b5224d8b6c1e138120 19-Aug-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Use hci_connect_sco directly

hci_connect is a super function for connecting hci protocols. But the
voice_setting parameter (introduced in subsequent patches) is only
needed by SCO and security requirements are not needed for SCO channels.
Thus, it makes sense to have a separate function for SCO.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
co.c
ffe6b68cc5999a3f91a15b6667e69e14186e337d 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Purge the dlc->tx_queue to avoid circular dependency

In rfcomm_tty_cleanup we purge the dlc->tx_queue which may contain
socket buffers referencing the tty_port and thus preventing the tty_port
destruction.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
ece3150dea382c7c961fe2604332ed3474960d25 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Fix the reference counting of tty_port

The tty_port can be released in two cases: when we get a HUP in the
functions rfcomm_tty_hangup() and rfcomm_dev_state_change(). Or when the
user releases the device in rfcomm_release_dev().

In these cases we set the flag RFCOMM_TTY_RELEASED so that no other
function can get a reference to the tty_port.
The use of !test_and_set_bit(RFCOMM_TTY_RELEASED) ensures that the
'initial' tty_port reference is only dropped once.

The rfcomm_dev_del function is removed becase it isn't used anymore.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
cad348a17e170451ea8688b532a6ca3e98c63b60 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Implement .activate, .shutdown and .carrier_raised methods

Implement .activate, .shutdown and .carrier_raised methods of tty_port
to manage the dlc, moving the code from rfcomm_tty_install() and
rfcomm_tty_cleanup() functions.

At the same time the tty .open()/.close() and .hangup() methods are
changed to use the tty_port helpers that properly call the
aforementioned tty_port methods.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
54b926a1434e817ca84cb090f36b56763e192470 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Move the tty initialization and cleanup out of open/close

Move the tty_struct initialization from rfcomm_tty_open() to
rfcomm_tty_install() and do the same for the cleanup moving the code from
rfcomm_tty_close() to rfcomm_tty_cleanup().

Add also extra error handling in rfcomm_tty_install() because, unlike
.open()/.close(), .cleanup() is not called if .install() fails.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
ebe937f74b8a72cf3ceeae5c2194a160bb092901 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Remove the device from the list in the destructor

The current code removes the device from the device list in several
places. Do it only in the destructor instead and in the error path of
rfcomm_add_dev() if the device couldn't be initialized.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
396dc223dd36edd218650d042a07c5e61f022c5b 29-Jul-2013 Gianluca Anzolin <gianluca@sottospazio.it> Bluetooth: Take proper tty_struct references

In net/bluetooth/rfcomm/tty.c the struct tty_struct is used without
taking references. This may lead to a use-after-free of the rfcomm tty.

Fix this by taking references properly, using the tty_port_* helpers
when possible.

The raw assignments of dev->port.tty in rfcomm_tty_open/close are
addressed in the later commit 'rfcomm: Implement .activate, .shutdown
and .carrier_raised methods'.

Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/tty.c
c7882cbd1151011ca8e6fb13530cd09eae1c39ee 13-Aug-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set different event mask for LE-only controllers

In case of a Low Energy only controller it makes no sense to configure
the full BR/EDR event mask. It will just enable events that can not be
send anyway and there is no guarantee that such a controller will accept
this value.

Use event mask 0x90 0xe8 0x04 0x02 0x00 0x80 0x00 0x20 for LE-only
controllers which enables the following events:

Disconnection Complete
Encryption Change
Read Remote Version Information Complete
Command Complete
Command Status
Hardware Error
Number of Completed Packets
Data Buffer Overflow
Encryption Key Refresh Complete
LE Meta

This is according to Core Specification, Part E, Section 3.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
9d225d2208a6f17da5987ff4e7710b9e805cb5d6 08-Aug-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix getting SCO socket options in deferred state

When a socket is in deferred state there does actually exist an
underlying connection even though the connection state is not yet
BT_CONNECTED. In the deferred state it should therefore be allowed to
get socket options that usually depend on a connection, such as
SCO_OPTIONS and SCO_CONNINFO.

This patch fixes the behavior of some user space code that behaves as
follows without it:

$ sudo tools/btiotest -i 00:1B:DC:xx:xx:xx -d -s
accept=2 reject=-1 discon=-1 defer=1 sec=0 update_sec=0 prio=0 voice=0x0000
Listening for SCO connections
bt_io_get(OPT_DEST): getsockopt(SCO_OPTIONS): Transport endpoint is not connected (107)
Accepting connection
Successfully connected to 60:D8:19:xx:xx:xx. handle=43, class=000000

The conditions that the patch updates the if-statements to is taken from
similar code in l2cap_sock.c which correctly handles the deferred state.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
704278ccb5c9fcbe09d1be3657950c17fad18ba8 31-Jul-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Conflicts:
net/bluetooth/hci_core.c
53e21fbc288218a423959f878c86471a0e323a9a 27-Jul-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix calling request callback more than once

In certain circumstances, such as an HCI driver using __hci_cmd_sync_ev
with HCI_EV_CMD_COMPLETE as the expected completion event there is the
chance that hci_event_packet will call hci_req_cmd_complete twice (once
for the explicitly looked after event and another time in the actual
handler of cmd_complete).

In the case of __hci_cmd_sync_ev this introduces a race where the first
call wakes up the blocking __hci_cmd_sync_ev and lets it complete.
However, by the time that a second __hci_cmd_sync_ev call is already in
progress the second hci_req_cmd_complete call (from the previous
operation) will wake up the blocking function prematurely and cause it
to fail, as witnessed by the following log:

[ 639.232195] hci_rx_work: hci0 Event packet
[ 639.232201] hci_req_cmd_complete: opcode 0xfc8e status 0x00
[ 639.232205] hci_sent_cmd_data: hci0 opcode 0xfc8e
[ 639.232210] hci_req_sync_complete: hci0 result 0x00
[ 639.232220] hci_cmd_complete_evt: hci0 opcode 0xfc8e
[ 639.232225] hci_req_cmd_complete: opcode 0xfc8e status 0x00
[ 639.232228] __hci_cmd_sync_ev: hci0 end: err 0
[ 639.232234] __hci_cmd_sync_ev: hci0
[ 639.232238] hci_req_add_ev: hci0 opcode 0xfc8e plen 250
[ 639.232242] hci_prepare_cmd: skb len 253
[ 639.232246] hci_req_run: length 1
[ 639.232250] hci_sent_cmd_data: hci0 opcode 0xfc8e
[ 639.232255] hci_req_sync_complete: hci0 result 0x00
[ 639.232266] hci_cmd_work: hci0 cmd_cnt 1 cmd queued 1
[ 639.232271] __hci_cmd_sync_ev: hci0 end: err 0
[ 639.232276] Bluetooth: hci0 sending Intel patch command (0xfc8e) failed (-61)

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
3f8e2d75c14660abc8b69206f30190ab93304379 24-Jul-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix HCI init for BlueFRITZ! devices

None of the BlueFRITZ! devices with manufacurer ID 31 (AVM Berlin)
support HCI_Read_Local_Supported_Commands. It is safe to use the
manufacturer ID (instead of e.g. a USB ID specific quirk) because the
company never created any newer controllers.

< HCI Command: Read Local Supported Comm.. (0x04|0x0002) plen 0 [hci0] 0.210014
> HCI Event: Command Status (0x0f) plen 4 [hci0] 0.217361
Read Local Supported Commands (0x04|0x0002) ncmd 1
Status: Unknown HCI Command (0x01)

Reported-by: Jörg Esser <jackfritt@boh.de>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Jörg Esser <jackfritt@boh.de>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
fcee337704d76446e0d4714cc5eff53e896f7c6f 11-Jul-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix race between hci_register_dev() and hci_dev_open()

If hci_dev_open() is called after hci_register_dev() added the device to
the hci_dev_list but before the workqueue are created we could run into a
NULL pointer dereference (see below).

This bug is very unlikely to happen, systems using bluetoothd to
manage their bluetooth devices will never see this happen.

BUG: unable to handle kernel NULL pointer dereference
0100
IP: [<ffffffff81077502>] __queue_work+0x32/0x3d0
(...)
Call Trace:
[<ffffffff81077be5>] queue_work_on+0x45/0x50
[<ffffffffa016e8ff>] hci_req_run+0xbf/0xf0 [bluetooth]
[<ffffffffa01709b0>] ? hci_init2_req+0x720/0x720 [bluetooth]
[<ffffffffa016ea06>] __hci_req_sync+0xd6/0x1c0 [bluetooth]
[<ffffffff8108ee10>] ? try_to_wake_up+0x2b0/0x2b0
[<ffffffff8150e3f0>] ? usb_autopm_put_interface+0x30/0x40
[<ffffffffa016fad5>] hci_dev_open+0x275/0x2e0 [bluetooth]
[<ffffffffa0182752>] hci_sock_ioctl+0x1f2/0x3f0 [bluetooth]
[<ffffffff815c6050>] sock_do_ioctl+0x30/0x70
[<ffffffff815c75f9>] sock_ioctl+0x79/0x2f0
[<ffffffff811a8046>] do_vfs_ioctl+0x96/0x560
[<ffffffff811a85a1>] SyS_ioctl+0x91/0xb0
[<ffffffff816d989d>] system_call_fastpath+0x1a/0x1f

Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
da9910ac4a816b4340944c78d94c02a35527db46 21-Jun-2013 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Fix invalid length check in l2cap_information_rsp()

The length check is invalid since the length varies with type of
info response.

This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888

Because of this, l2cap info rsp is not handled and command reject is sent.

> ACL data: handle 11 flags 0x02 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x00b8
Enhanced Retransmission mode
Streaming mode
FCS Option
Fixed Channels
< ACL data: handle 11 flags 0x00 dlen 10
L2CAP(s): Command rej: reason 0
Command not understood

Cc: stable@vger.kernel.org
Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
159d865f2078ffa4441abb0155f725368371f836 11-Jul-2013 Benjamin Tissoires <benjamin.tissoires@redhat.com> Bluetooth: hidp: remove wrong send_report at init

The USB hid implementation does retrieve the reports during the start.
However, this implementation does not call the HID command GET_REPORT
(which would fetch the current status of each report), but use the
DATA command, which is an Output Report (so transmitting data from the
host to the device).
The Wiimote controller is already guarded against this problem in the
protocol, but it is not conformant to the specification to set all the
reports to 0 on start.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
2583d706a13d0dc7fa591d5bb036454d0ddbf5b0 11-Jul-2013 Benjamin Tissoires <benjamin.tissoires@redhat.com> Bluetooth: hidp: implement hidinput_input_event callback

We can re-enable hidinput_input_event to allow the leds of bluetooth
keyboards to be set.
Now the callbacks uses hid core to retrieve the right HID report to
send, so this version is safer.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
1c244f79c0d6abf8634faedb9b042122481c3572 07-Dec-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add missing braces to an "else if"

Trivial change in the coding style.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
a767631ad1c2e785f4a8fcad26bcf50eb5786373 28-Jun-2013 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Use defines instead of integer literals

Replace the occurrences of integer literals in hci_event.c with the
newly introduced macros in hci.h.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
acabae96df2dff253f831e94c33ef9f0f15600d0 28-Jun-2013 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Use defines in in hci_get_auth_req()

Make the code in hci_get_auth_req() more readable by using the
defined macros instead of inlining magic numbers.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Signed-off-by: Timo Mueller <timo.mueller@bmw-carit.de>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
637b4caeedde9b926de6e66d68d0951b0f0c83ef 01-Jul-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix simple whitespace vs tab style issue

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
bc197eedef1ae082ec662c64c3f4aa302821fb7a 22-Jul-2013 Jiri Kosina <jkosina@suse.cz> HID: fix unused rsize usage

27ce4050 ("HID: fix data access in implement()") by mistake removed
a setting of buffer size in hidp. Fix that by putting it back.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
27ce405039bfe6d3f4143415c638f56a3df77dca 10-Jul-2013 Jiri Kosina <jkosina@suse.cz> HID: fix data access in implement()

implement() is setting bytes in LE data stream. In case the data is not
aligned to 64bits, it reads past the allocated buffer. It doesn't really
change any value there (it's properly bitmasked), but in case that this
read past the boundary hits a page boundary, pagefault happens when
accessing 64bits of 'x' in implement(), and kernel oopses.

This happens much more often when numbered reports are in use, as the
initial 8bit skip in the buffer makes the whole process work on values
which are not aligned to 64bits.

This problem dates back to attempts in 2005 and 2006 to make implement()
and extract() as generic as possible, and even back then the problem
was realized by Adam Kroperlin, but falsely assumed to be impossible
to cause any harm:

http://www.mail-archive.com/linux-usb-devel@lists.sourceforge.net/msg47690.html

I have made several attempts at fixing it "on the spot" directly in
implement(), but the results were horrible; the special casing for processing
last 64bit chunk and switching to different math makes it unreadable mess.

I therefore took a path to allocate a few bytes more which will never make
it into final report, but are there as a cushion for all the 64bit math
operations happening in implement() and extract().

All callers of hid_output_report() are converted at the same time to allocate
the buffer by newly introduced hid_alloc_report_buf() helper.

Bruno noticed that the whole raw_size test can be dropped as well, as
hid_alloc_report_buf() makes sure that the buffer is always of a proper
size.

Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
8c6ffba0eddc8c110dbf444f51354ce42069abfc 15-Jul-2013 Rusty Russell <rusty@rustcorp.com.au> PTR_RET is now PTR_ERR_OR_ZERO(): Replace most.

Sweep of the simple cases.

Cc: netdev@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: Julia Lawall <julia.lawall@lip6.fr>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
ci_sysfs.c
496322bc91e35007ed754184dcd447a02b6dd685 10-Jul-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
"This is a re-do of the net-next pull request for the current merge
window. The only difference from the one I made the other day is that
this has Eliezer's interface renames and the timeout handling changes
made based upon your feedback, as well as a few bug fixes that have
trickeled in.

Highlights:

1) Low latency device polling, eliminating the cost of interrupt
handling and context switches. Allows direct polling of a network
device from socket operations, such as recvmsg() and poll().

Currently ixgbe, mlx4, and bnx2x support this feature.

Full high level description, performance numbers, and design in
commit 0a4db187a999 ("Merge branch 'll_poll'")

From Eliezer Tamir.

2) With the routing cache removed, ip_check_mc_rcu() gets exercised
more than ever before in the case where we have lots of multicast
addresses. Use a hash table instead of a simple linked list, from
Eric Dumazet.

3) Add driver for Atheros CQA98xx 802.11ac wireless devices, from
Bartosz Markowski, Janusz Dziedzic, Kalle Valo, Marek Kwaczynski,
Marek Puzyniak, Michal Kazior, and Sujith Manoharan.

4) Support reporting the TUN device persist flag to userspace, from
Pavel Emelyanov.

5) Allow controlling network device VF link state using netlink, from
Rony Efraim.

6) Support GRE tunneling in openvswitch, from Pravin B Shelar.

7) Adjust SOCK_MIN_RCVBUF and SOCK_MIN_SNDBUF for modern times, from
Daniel Borkmann and Eric Dumazet.

8) Allow controlling of TCP quickack behavior on a per-route basis,
from Cong Wang.

9) Several bug fixes and improvements to vxlan from Stephen
Hemminger, Pravin B Shelar, and Mike Rapoport. In particular,
support receiving on multiple UDP ports.

10) Major cleanups, particular in the area of debugging and cookie
lifetime handline, to the SCTP protocol code. From Daniel
Borkmann.

11) Allow packets to cross network namespaces when traversing tunnel
devices. From Nicolas Dichtel.

12) Allow monitoring netlink traffic via AF_PACKET sockets, in a
manner akin to how we monitor real network traffic via ptype_all.
From Daniel Borkmann.

13) Several bug fixes and improvements for the new alx device driver,
from Johannes Berg.

14) Fix scalability issues in the netem packet scheduler's time queue,
by using an rbtree. From Eric Dumazet.

15) Several bug fixes in TCP loss recovery handling, from Yuchung
Cheng.

16) Add support for GSO segmentation of MPLS packets, from Simon
Horman.

17) Make network notifiers have a real data type for the opaque
pointer that's passed into them. Use this to properly handle
network device flag changes in arp_netdev_event(). From Jiri
Pirko and Timo Teräs.

18) Convert several drivers over to module_pci_driver(), from Peter
Huewe.

19) tcp_fixup_rcvbuf() can loop 500 times over loopback, just use a
O(1) calculation instead. From Eric Dumazet.

20) Support setting of explicit tunnel peer addresses in ipv6, just
like ipv4. From Nicolas Dichtel.

21) Protect x86 BPF JIT against spraying attacks, from Eric Dumazet.

22) Prevent a single high rate flow from overruning an individual cpu
during RX packet processing via selective flow shedding. From
Willem de Bruijn.

23) Don't use spinlocks in TCP md5 signing fast paths, from Eric
Dumazet.

24) Don't just drop GSO packets which are above the TBF scheduler's
burst limit, chop them up so they are in-bounds instead. Also
from Eric Dumazet.

25) VLAN offloads are missed when configured on top of a bridge, fix
from Vlad Yasevich.

26) Support IPV6 in ping sockets. From Lorenzo Colitti.

27) Receive flow steering targets should be updated at poll() time
too, from David Majnemer.

28) Fix several corner case regressions in PMTU/redirect handling due
to the routing cache removal, from Timo Teräs.

29) We have to be mindful of ipv4 mapped ipv6 sockets in
upd_v6_push_pending_frames(). From Hannes Frederic Sowa.

30) Fix L2TP sequence number handling bugs, from James Chapman."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1214 commits)
drivers/net: caif: fix wrong rtnl_is_locked() usage
drivers/net: enic: release rtnl_lock on error-path
vhost-net: fix use-after-free in vhost_net_flush
net: mv643xx_eth: do not use port number as platform device id
net: sctp: confirm route during forward progress
virtio_net: fix race in RX VQ processing
virtio: support unlocked queue poll
net/cadence/macb: fix bug/typo in extracting gem_irq_read_clear bit
Documentation: Fix references to defunct linux-net@vger.kernel.org
net/fs: change busy poll time accounting
net: rename low latency sockets functions to busy poll
bridge: fix some kernel warning in multicast timer
sfc: Fix memory leak when discarding scattered packets
sit: fix tunnel update via netlink
dt:net:stmmac: Add dt specific phy reset callback support.
dt:net:stmmac: Add support to dwmac version 3.610 and 3.710
dt:net:stmmac: Allocate platform data only if its NULL.
net:stmmac: fix memleak in the open method
ipv6: rt6_check_neigh should successfully verify neigh if no NUD information are available
net: ipv6: fix wrong ping_v6_sendmsg return value
...
3366dd9fa887ebbda4872e9554f853eaeda764be 04-Jul-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID updates from Jiri Kosina:
- HID battery handling cleanup by David Herrmann
- ELO 4000/4500 driver, which has been finally ported to be proper HID
driver by Jiri Slaby
- ps3remote driver functionality is now provided by generic sony
driver, by Jiri Kosina
- PS2/3 Buzz controllers support, by Colin Leitner
- rework of wiimote driver including full extensions hotpluggin
support, sub-device modularization and speaker support by David
Herrmann

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (55 commits)
HID: wacom: Intuos4 battery charging changes
HID: i2c-hid: support sending HID output reports using the output register
HID: kye: Add report fixup for Genius Gila Gaming mouse
HID: wiimote: support Nintendo Wii U Pro Controller
Input: make gamepad API keycodes more clear
input: document gamepad API and add extra keycodes
HID: explain out-of-range check better
HID: fix false positive out of range values
HID: wiimote: fix coccinelle warnings
HID: roccat: check cdev_add return value
HID: fold ps3remote driver into generic Sony driver
HID: hyperv: convert alloc+memcpy to memdup
HID: core: fix reporting of raw events
HID: wiimote: discard invalid EXT data reports
HID: wiimote: fix classic controller parsing
HID: wiimote: init EXT/MP during device detection
HID: wiimote: fix DRM debug-attr to correctly parse input
HID: wiimote: add MP quirks
HID: wiimote: remove old static extension support
HID: wiimote: add "bboard_calib" attribute
...
db58316892a5e9034efe718d4c1630788db7528f 04-Jul-2013 Jiri Kosina <jkosina@suse.cz> Merge branches 'for-3.11/battery', 'for-3.11/elo', 'for-3.11/holtek' and 'for-3.11/i2c-hid-fixed' into for-linus
d8537548c924db3c44afde7646b6e220c7beb79d 04-Jul-2013 Kees Cook <keescook@chromium.org> drivers: avoid format strings in names passed to alloc_workqueue()

For the workqueue creation interfaces that do not expect format strings,
make sure they cannot accidently be parsed that way. Additionally, clean
up calls made with a single parameter that would be handled as a format
string. Many callers are passing potentially dynamic string content, so
use "%s" in those cases to avoid any potential accidents.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ci_core.c
729d8d182bbf296b32cb2e7f970801eb6ce33c6a 26-Jun-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
b8f4e068004859eefac7b1ced59ddb67ca6d2d80 13-Jun-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Improve comments on the HCI_Delete_Store_Link_Key issue

Some Bluetooth controllers doesn't support this command so we first
need to check for its support before sending it. This patch adds a
lengthful commentary about this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
3f6fa3d489e127ca5a5b298eabac3ff5dbe0e112 21-Jun-2013 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Fix invalid length check in l2cap_information_rsp()

The length check is invalid since the length varies with type of
info response.

This was introduced by the commit cb3b3152b2f5939d67005cff841a1ca748b19888

Because of this, l2cap info rsp is not handled and command reject is sent.

> ACL data: handle 11 flags 0x02 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x00b8
Enhanced Retransmission mode
Streaming mode
FCS Option
Fixed Channels
< ACL data: handle 11 flags 0x00 dlen 10
L2CAP(s): Command rej: reason 0
Command not understood

Cc: stable@vger.kernel.org
Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Chan-Yeol Park <chanyeol.park@samsung.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
673e1dd7ed7701cac8c5c247d152fd3d2da2a4f1 13-May-2013 Chen Gang <gang.chen@asianux.com> Bluetooth: hidp: using strlcpy instead of strncpy, also beautify code.

For NULL terminated string, need always let it ended by zero.

Since have already called memcpy() to initialize 'ci', so need not
redundant initialization.

Better use ''if(session->hid) {} else if(session->input) {}"" instead
of ''if(session->hid) {}; if(session->input) {};''

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
0a804654af62dfea4899c66561d74d72273b2921 14-May-2013 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded flag

Remove HCI_LINK_KEYS flag since using HCI_MGMT is enough for test that
user space expects the kernel managing link keys.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
034cbea0931433cf88a1f79a385402604f08bd67 14-May-2013 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use HCI_MGMT instead of HCI_LINK_KEYS flag

Use HCI_MGMT flag instead of HCI_LINK_KEYS flag. There is a problem with
HCI_LINK_KEYS flag since it is set only when link keys are loaded. Otherwise
kernel assumes that old interface is used.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
12602d0cc005354a519b3eba443d7912ab71313a 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Mgmt Device Found Event

We only want to send Mgmt Device Found Events if we are running the
Device Discovery procedure (started by the MGMT Start Discovery
Command). Inquiry or LE scanning triggered by HCI raw interface (e.g.
hcitool) or kernel internals should not send Mgmt Device Found Events.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
8892d8beb37cb4ea531a5076946d5cc809b04c25 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove empty event handler

This patch removes the hci_cc_le_set_scan_param event handler. This
handler became empty because failures of this event are now handled
by start_discovery_complete function in mgmt.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
b0434345f2a7330be5277b63606cff26a7965982 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove inquiry helpers

This patch removes hci_do_inquiry and hci_cancel_inquiry helpers. We
now use the HCI request framework in device discovery functionality
and these helpers are no longer needed.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
917eedc56c65ba96a3bab4c346d948e73dd872f1 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove LE scan helpers

This patch removes the LE scan helpers hci_le_scan and hci_cancel_
le_scan and all code related to it. We now use the HCI request
framework in device discovery functionality and these helpers are
no longer needed.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
3fd319b830247a3fe5f489e622ab404b618e0906 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor hci_cc_le_set_scan_enable

This patch does a trivial refactoring in hci_cc_le_set_scan_enable.
Since start and stop discovery command failures are now handled in
mgmt layer, the status check became empty. So, we can move it to
outside the switch statement.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
1183fdcad42495073045a2d9755e0a6ac2fa874e 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Make mgmt_stop_discovery_failed static

mgmt_stop_discovery_failed is now only used in mgmt.c so we can
make it a local function. This patch also moves the mgmt_stop_
discovery_failed definition up in mgmt.c to avoid forward
declaration.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
82f4785ca7b8d04ca6d0aaa37f1185c779744bc4 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove stop discovery handling from hci_event.c

Since all mgmt stop discovery command complete events are now handled
in stop_discovery_complete callback in mgmt.c, we can remove this
handling from hci_event.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
0e05bba6f6f8c2dca7a13fe0566742277e92df07 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Update stop_discovery to use HCI request

This patch modifies the stop_discovery function so it uses the HCI
request framework.

The HCI request is built according to the current discovery state
(inquiry, LE scanning or name resolving) and a complete callback is
register to handle the command complete event for the stop discovery
command. This way, we move all stop_discovery mgmt handling code
spread in hci_event.c to a single place in mgmt.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4c87eaab01df271c81f6a68e3c28dbd44d348004 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use HCI request in interleaved discovery

In order to have a better HCI error handling in interleaved discovery
functionality, we should use the HCI request framework.

This patch updates le_scan_disable_work function so it uses the
HCI request framework instead of the hci_send_cmd helper. A complete
callback is registered (le_scan_disable_work_complete function) so we
are able to trigger the inquiry procedure (if we are running the
interleaved discovery) or to stop the discovery procedure (if we are
running LE-only discovery).

This patch also removes the extra logic in hci_cc_le_set_scan_enable
to trigger the inquiry procedure and the mgmt_interleaved_discovery
function since they become useless.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
gmt.c
0d8cc935e01c0fd1312a10881f4c0f1c4b4d05ab 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Move discovery macros to hci_core.h

Some of discovery macros will be used in hci_core so we need to
define them in common place such as hci_core.h. Thus, this patch
moves discovery macros to hci_core.h and also adds the DISCOV_
prefix to them.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
41dc2bd6d13bfccc34d05586be2eb65876a5990a 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Make mgmt_start_discovery_failed static

mgmt_start_discovery_failed is now only used in mgmt.c so we can
make it a local function. This patch also moves the mgmt_start_
discovery_failed definition up in mgmt.c to avoid forward
declaration.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
fef5234a791507a2fe1ccfc85f080523fe762320 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove start discovery handling from hci_event.c

Since all mgmt start discovery command complete events are now handled
in start_discovery_complete callback in mgmt.c, we can remove this
handling from hci_event.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
7c3077207c705d0aa200ce22d49a0376d194dfca 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Update start_discovery to use HCI request

This patch modifies the start_discovery function so it uses the HCI
request framework.

We build the HCI request according to the discovery type (add inquiry
or LE scan HCI commands) and run the HCI request. We also register
the start_discovery_complete callback which handles mgmt command
complete events for this command. This way, we move all start_
discovery mgmt handling code spread in hci_event.c to a single place
in mgmt.c.

This patch also merges the LE-only and interleaved discovery type
cases since these cases are pretty much the same now.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
1f9b9a5dc5bb8ee360db9d32b2090aac497ae82a 30-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Make inquiry_cache_flush non-static

In order to use HCI request framework in start_discovery, we'll need
to call inquiry_cache_flush in mgmt.c. Therefore, this patch adds the
hci_ prefix to inquiry_cache_flush and makes it non-static.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
44f3b0fbaa9bfa7a88577ee8c446d0a78cb1d73a 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix multiple LE socket handling

The LE ATT server socket needs to be superseded by any ATT client
sockets. Previously this was done by looking at the hcon->out variable
(indicating whether the connection is outgoing or incoming) which is a
too crude way of determining whether the server socket needs to be
picked or not (an outgoing connection doesn't necessarily mean that an
ATT client socket has triggered it).

This patch extends the ATT server socket lookup function
(l2cap_le_conn_ready) to be used for all LE connections (regardless of
the hcon->out value) and adds an internal check into the function for
the existence of any ATT client sockets (in which case the server socket
should be skipped). For this to work reliably all lookups must be done
while the l2cap_conn->chan_lock is held, meaning also that the call to
l2cap_chan_add needs to be changed to its lockless __l2cap_chan_add
counterpart.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
0cc59a72c723979cf8973aff4df874a5f7a697c7 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless hci_conn disc_timeout setting

There's no need to reset disc_timeout in l2cap_le_conn_ready since
HCI_DISCONN_TIMEOUT is the default when the hci_conn is created and
there should be no way for it to get changed between creation and
l2cap_le_conn_ready being called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
5ee9891dd8a63df1bf2ccd437872ad30a5850449 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify hci_conn_hold/drop logic for L2CAP

The L2CAP code has been incrementing the hci_conn reference for each
l2cap_chan instance in the l2cap_conn list. Likewise, the reference is
dropped each time an l2cap_chan is removed from the list. The reference
counting policy with respect to removal has been clear and explicit in
the l2cap_chan_del function, however for addition the function
calling 2cap_chan_add has always had to do a separate hci_conn_hold
call.

What made the counting even more hard to follow is that the
hci_connect() procedure increments the reference and the L2CAP layer
making this call took advantage of it to use it as its own reference.

This patch aims to clarify things by having the call to hci_conn_hold
inside __l2cap_chan_add, thereby removing the need to do it in the
functions calling __l2cap_chan_add. The reference count for hci_connect
is still kept as it's necessary for users such as mgmt_pair_device,
however for the L2CAP layer it means that an extra call to hci_conn_drop
must be performed once l2cap_chan_add has been done.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
af1c01349ecc2b8ab2c329e4dbd46e9018469bd1 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary L2CAP channel state check

In l2cap_att_channel() we're only interested in the BT_CONNECTED state
so this state can directly be passed to l2cap_global_chan_by_scid().
This way there's no need to do any additional state check later.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
60bac184c9c7df2299aca4dc45c4b5b486f49a89 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless sk variable in l2cap_le_conn_ready

The sk variable is of quite little use since it's only used to simplify
access in the two bt_sk() calls.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
97f57c0b14ad2ef0628fc6db48cd6c08e0e52c50 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix duplicate call to l2cap_chan_ready()

In l2cap_le_conn_ready() after doing l2cap_chann_add() the LE channel is
part of the list which is subsequently iterated in l2cap_conn_ready() in
this loop each channel will get l2cap_chan_ready() called which would
result in trying to set the channel two times into BT_CONNECTED state.
Instead it makes sense to just add the channel but not call chan_ready
in l2cap_le_conn_ready, which is what this patch does.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d8729922b474eab65ca738028a2e69fb12e2eaa6 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add clarifying comment to l2cap_conn_ready()

There is an extra call to smp_conn_security() for outgoing LE
connections from l2cap_conn_ready() but the reason for this call is far
from clear. After a bit of commit history research and using git blame I
found out that this extra call is for socket-less pairing processes
added by commit 160dc6ac1. This patch adds a clarifying comment to the
code for this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
9f22398ce4baf816535415e65949d03f55a7973a 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hardcoding ATT CID in __l2cap_chan_add()

Since in the future more than the ATT CID may be permissible we should
not be hardcoding it for all LE connections in __l2cap_chan_add().
Instead, the source ATT CID should only be set if the destination is
also ATT, and in other cases we should just use the existing dynamic CID
allocation function.

Assigning scid based on dcid means that whenever __l2cap_chan_add() is
called that chan->dcid is properly initialized. l2cap_le_conn_ready()
wasn't initializing is properly so this is also taken care of in this
patch.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
141d57065afd11977c4d346f64b25350445bf689 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix EBUSY condition test in l2cap_chan_connect

The current test in l2cap_chan_connect is intended to protect against
multiple conflicting connect attempts. However, it assumes that there
will ever only be a single CID that is connected to, which is not true.
We do need to check for conflicts with connect attempts to the same
destination CID but this check is not in anyway specific to LE but can
be applied to BR/EDR as well.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
f224ca5fc207a9957164e6f42ec6766da0f55d54 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix LE vs BR/EDR selection when connecting

The choice between LE and BR/EDR should be made on the destination
address type instead of the destination CID. This is particularly
important when in the future more than one CID will be allowed for LE.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
073d1cf35fe45d89f5a553c21eea18b504dd6937 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename L2CAP_CID_LE_DATA to L2CAP_CID_ATT

In future Core Specification versions the ATT CID will be just one of
many possible CIDs that can be used for data transfer. Therefore, it
makes sense to rename the define for the ATT CID to something less
ambigous.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
c5623556fc61804713b1569b4f748e36956bc6e8 29-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Handle LE L2CAP signalling in its own function

The LE L2CAP signalling channel follows its own rules and will continue
to evolve independently from the BR/EDR signalling channel. Therefore,
it makes sense to have a clear split from BR/EDR by having a dedicated
function for handling LE signalling commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
59f45d576a0715026d1919ab8a12047616204656 13-Jun-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix conditions for HCI_Delete_Stored_Link_Key

Even though the HCI_Delete_Stored_Link_Key command is mandatory for 1.1
and later controllers some controllers do not seem to support it
properly as was witnessed by one Broadcom based controller:

< HCI Command: Delete Stored Link Key (0x03|0x0012) plen 7
bdaddr 00:00:00:00:00:00 all 1
> HCI Event: Command Complete (0x0e) plen 4
Delete Stored Link Key (0x03|0x0012) ncmd 1
status 0x11 deleted 0
Error: Unsupported Feature or Parameter Value

Luckily this same controller also doesn't list the command in its
supported commands bit mask (counting from 0 bit 7 of octet 6):

< HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0
> HCI Event: Command Complete (0x0e) plen 68
Read Local Supported Commands (0x04|0x0002) ncmd 1
status 0x00
Commands: ffffffffffff1ffffffffffff30fffff3f

Therefore, it makes sense to move sending of HCI_Delete_Stored_Link_Key
to after receiving the supported commands response and to only send it
if its respective bit in the mask is set. The downside of this is that
we no longer send the HCI_Delete_Stored_Link_Key command for Bluetooth
1.1 controllers since HCI_Read_Local_Supported_Command was introduced in
version 1.2, but this is an acceptable penalty as the command in
question shouldn't affect critical behavior.

Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
ci_core.c
300b962e5244a1ea010df7e88595faa0085b461d 02-Jun-2013 Anderson Lizardo <anderson.lizardo@openbossa.org> Bluetooth: Fix crash in l2cap_build_cmd() with small MTU

If a too small MTU value is set with ioctl(HCISETACLMTU) or by a bogus
controller, memory corruption happens due to a memcpy() call with
negative length.

Fix this crash on either incoming or outgoing connections with a MTU
smaller than L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE:

[ 46.885433] BUG: unable to handle kernel paging request at f56ad000
[ 46.888037] IP: [<c03d94cd>] memcpy+0x1d/0x40
[ 46.888037] *pdpt = 0000000000ac3001 *pde = 00000000373f8067 *pte = 80000000356ad060
[ 46.888037] Oops: 0002 [#1] SMP DEBUG_PAGEALLOC
[ 46.888037] Modules linked in: hci_vhci bluetooth virtio_balloon i2c_piix4 uhci_hcd usbcore usb_common
[ 46.888037] CPU: 0 PID: 1044 Comm: kworker/u3:0 Not tainted 3.10.0-rc1+ #12
[ 46.888037] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
[ 46.888037] Workqueue: hci0 hci_rx_work [bluetooth]
[ 46.888037] task: f59b15b0 ti: f55c4000 task.ti: f55c4000
[ 46.888037] EIP: 0060:[<c03d94cd>] EFLAGS: 00010212 CPU: 0
[ 46.888037] EIP is at memcpy+0x1d/0x40
[ 46.888037] EAX: f56ac1c0 EBX: fffffff8 ECX: 3ffffc6e EDX: f55c5cf2
[ 46.888037] ESI: f55c6b32 EDI: f56ad000 EBP: f55c5c68 ESP: f55c5c5c
[ 46.888037] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 46.888037] CR0: 8005003b CR2: f56ad000 CR3: 3557d000 CR4: 000006f0
[ 46.888037] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 46.888037] DR6: ffff0ff0 DR7: 00000400
[ 46.888037] Stack:
[ 46.888037] fffffff8 00000010 00000003 f55c5cac f8c6a54c ffffffff f8c69eb2 00000000
[ 46.888037] f4783cdc f57f0070 f759c590 1001c580 00000003 0200000a 00000000 f5a88560
[ 46.888037] f5ba2600 f5a88560 00000041 00000000 f55c5d90 f8c6f4c7 00000008 f55c5cf2
[ 46.888037] Call Trace:
[ 46.888037] [<f8c6a54c>] l2cap_send_cmd+0x1cc/0x230 [bluetooth]
[ 46.888037] [<f8c69eb2>] ? l2cap_global_chan_by_psm+0x152/0x1a0 [bluetooth]
[ 46.888037] [<f8c6f4c7>] l2cap_connect+0x3f7/0x540 [bluetooth]
[ 46.888037] [<c019b37b>] ? trace_hardirqs_off+0xb/0x10
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064ad20>] ? mutex_lock_nested+0x280/0x360
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<c064ad08>] ? mutex_lock_nested+0x268/0x360
[ 46.888037] [<c01a125b>] ? trace_hardirqs_on+0xb/0x10
[ 46.888037] [<f8c72f8d>] l2cap_recv_frame+0xb2d/0x1d30 [bluetooth]
[ 46.888037] [<c01a0ff8>] ? mark_held_locks+0x68/0x110
[ 46.888037] [<c064b9d9>] ? __mutex_unlock_slowpath+0xa9/0x150
[ 46.888037] [<c01a118c>] ? trace_hardirqs_on_caller+0xec/0x1b0
[ 46.888037] [<f8c754f1>] l2cap_recv_acldata+0x2a1/0x320 [bluetooth]
[ 46.888037] [<f8c491d8>] hci_rx_work+0x518/0x810 [bluetooth]
[ 46.888037] [<f8c48df2>] ? hci_rx_work+0x132/0x810 [bluetooth]
[ 46.888037] [<c0158979>] process_one_work+0x1a9/0x600
[ 46.888037] [<c01588fb>] ? process_one_work+0x12b/0x600
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c015922e>] ? worker_thread+0x19e/0x320
[ 46.888037] [<c0159187>] worker_thread+0xf7/0x320
[ 46.888037] [<c0159090>] ? rescuer_thread+0x290/0x290
[ 46.888037] [<c01602f8>] kthread+0xa8/0xb0
[ 46.888037] [<c0656777>] ret_from_kernel_thread+0x1b/0x28
[ 46.888037] [<c0160250>] ? flush_kthread_worker+0x120/0x120
[ 46.888037] Code: c3 90 8d 74 26 00 e8 63 fc ff ff eb e8 90 55 89 e5 83 ec 0c 89 5d f4 89 75 f8 89 7d fc 3e 8d 74 26 00 89 cb 89 c7 c1 e9 02 89 d6 <f3> a5 89 d9 83 e1 03 74 02 f3 a4 8b 5d f4 8b 75 f8 8b 7d fc 89
[ 46.888037] EIP: [<c03d94cd>] memcpy+0x1d/0x40 SS:ESP 0068:f55c5c5c
[ 46.888037] CR2: 00000000f56ad000
[ 46.888037] ---[ end trace 0217c1f4d78714a9 ]---

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2cap_core.c
96570ffcca0b872dc8626e97569d2697f374d868 29-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt handling of power on failures

If hci_dev_open fails we need to ensure that the corresponding
mgmt_set_powered command gets an appropriate response. This patch fixes
the missing response by adding a new mgmt_set_powered_failed function
that's used to indicate a power on failure to mgmt. Since a situation
with the device being rfkilled may require special handling in user
space the patch uses a new dedicated mgmt status code for this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
ci_core.c
gmt.c
cb3b3152b2f5939d67005cff841a1ca748b19888 28-May-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing length checks for L2CAP signalling PDUs

There has been code in place to check that the L2CAP length header
matches the amount of data received, but many PDU handlers have not been
checking that the data received actually matches that expected by the
specific PDU. This patch adds passing the length header to the specific
handler functions and ensures that those functions fail cleanly in the
case of an incorrect amount of data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2cap_core.c
757aee0f7177b7c7528aa0c120fc131aca8bf641 24-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checks for LE support on LE-only controllers

LE-only controllers do not support extended features so any kind of host
feature bit checks do not make sense for them. This patch fixes code
used for both single-mode (LE-only) and dual-mode (BR/EDR/LE) to use the
HCI_LE_ENABLED flag instead of the "Host LE supported" feature bit for
LE support tests.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
gmt.c
mp.c
4e713cdffba8d486e58eefe2125041eb5df9aa3a 23-May-2013 David Herrmann <dh.herrmann@gmail.com> HID: Bluetooth: hidp: register HID devices async

While l2cap_user callbacks are running, the whole hci_dev is locked. Even
if we would add more fine-grained locking to HCI core, it would still be
called from the non-reentrant rx work-queue and thus block the event
processing.

However, if we want to perform synchronous I/O during HID device
registration (eg., to perform device-detection), we need the HCI core
to be able to dispatch incoming data.

Therefore, we now move device-registration to a separate worker. The HCI
core can continue running and we add devices asynchronously in another
kernel thread. Device removal is synchronized and waits for the worker
to exit before calling the usual device removal functions.

If l2cap_user->remove is called before the thread registered the devices,
we set "terminate" to true and the thread will skip it. If
l2cap_user->remove is called after it, we notice this as the device
is no longer in HIDP_SESSION_PREPARING state and simply unregister the
device as we did before.
There is no new deadlock as we now call hidp_session_add_dev() with
one lock less held (the HCI lock) and it cannot itself call back into
HCI as it was called with the HCI-lock held before.

One might wonder whether this can block during device unregistration.
But we set "terminate" to true and wake the HIDP thread up _before_
unregistering the HID/input devices. Therefore, all pending HID I/O
operations are canceled. All further I/O attempts will fail with ENODEV
or EIO. So all latency we can get are few context-switches, but no
timeouts or blocking I/O waits!

This change also prepares for a long standing HID bug. All HID devices
that register power_supply devices need to be able to handle callbacks
during registration (a power_supply oddity that cannot easily be fixed).
So with this patch available, we can allow HID I/O during registration
by calling the recently introduced hid_device_io_start/stop helpers,
which currently are a no-op for bluetooth due to this locking.

Note that we cannot do the same for input devices. input-core doesn't
allow us to call input_event() asynchronously to input_register_device(),
which HID-core kindly allows (for good reasons).
Fixing input-core to allow this isn't as easy as it sounds and is,
beside simplifying HIDP, not really an improvement. Hence, we still
register input devices synchronously as we did before. Only HID devices
are registered asynchronously.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Tested-by: Daniel Nicoletti <dantti12@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
20b4fb485227404329e41ad15588afad3df23050 02-May-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull VFS updates from Al Viro,

Misc cleanups all over the place, mainly wrt /proc interfaces (switch
create_proc_entry to proc_create(), get rid of the deprecated
create_proc_read_entry() in favor of using proc_create_data() and
seq_file etc).

7kloc removed.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (204 commits)
don't bother with deferred freeing of fdtables
proc: Move non-public stuff from linux/proc_fs.h to fs/proc/internal.h
proc: Make the PROC_I() and PDE() macros internal to procfs
proc: Supply a function to remove a proc entry by PDE
take cgroup_open() and cpuset_open() to fs/proc/base.c
ppc: Clean up scanlog
ppc: Clean up rtas_flash driver somewhat
hostap: proc: Use remove_proc_subtree()
drm: proc: Use remove_proc_subtree()
drm: proc: Use minor->index to label things, not PDE->name
drm: Constify drm_proc_list[]
zoran: Don't print proc_dir_entry data in debug
reiserfs: Don't access the proc_dir_entry in r_open(), r_start() r_show()
proc: Supply an accessor for getting the data from a PDE's parent
airo: Use remove_proc_subtree()
rtl8192u: Don't need to save device proc dir PDE
rtl8187se: Use a dir under /proc/net/r8180/
proc: Add proc_mkdir_data()
proc: Move some bits from linux/proc_fs.h to linux/{of.h,signal.h,tty.h}
proc: Move PDE_NET() to fs/proc/proc_net.c
...
17a2911f3395d66694fcbd2e8970015904d9b034 29-Apr-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
6ed0e321a0aef14a894e26658108bf7e895c36a6 24-Apr-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
72f78356a4a688d7286ac18c1b57d5507f68eefe 23-Apr-2013 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded parameter from L2CAP ATT channel handling

The CID is fixed to L2CAP ATT channel and so there is no need to hand it
down to the handling function. Just use a constant instead.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
77a63e0a550a731d2bd330679696d8fe66bf94a9 20-Apr-2013 Fengguang Wu <fengguang.wu@intel.com> Bluetooth: hci_get_cmd_complete() can be static

There are new sparse warnings show up in

tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head: a0b644b0385fa58ca578f6dce4473e8a8e6f6c38
commit: 75e84b7c522c6e07964cd1f5bf28535768a1e9fa Bluetooth: Add __hci_cmd_sync() helper function
date: 13 days ago

>> net/bluetooth/hci_core.c:82:16: sparse: symbol 'hci_get_cmd_complete' was not declared. Should it be static?

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
c73eee9172bf061202c75ad4d16506a7efd04d1c 19-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending write_le_host_supporte for LE-only controllers

The Bluetooth Core Specification (4.0) defines the Write LE Host
Supported HCI command as only available for controllers supporting
BR/EDR. This is further reflected in the Read Local Extended Features
HCI command also not being available for LE-only controllers. In other
words, host-side LE support is implicit for single-mode LE controllers
and doesn't have explicit HCI-level enablement.

This patch ensures that the LE setting is always exposed as enabled
through mgmt and returns a "rejected" response if user space tries to
toggle the setting. The patch also ensures that Write LE Host Supported
is never sent for LE-only controllers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
gmt.c
07dc93dd14957dc1faba08f0aadd27b082e35ba2 19-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix HCI command send functions to use const specifier

All HCI command send functions that take a pointer to the command
parameters do not need to modify the content in any way (they merely
copy the data to an skb). Therefore, the parameter type should be
declared const. This also allows passing already const parameters to
these APIs which previously would have generated a compiler warning.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
76a388beaf92cc75b829d4a0b7d69afaaeaa4b0a 05-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename LE_SCANNING_* macros

This patch renames LE_SCANNING_ENABLED and LE_SCANNING_DISABLED
macros to LE_SCAN_ENABLE and LE_SCAN_DISABLE in order to keep
the same prefix others LE scan macros have.

It also fixes le_scan_enable_req function so it uses the LE_SCAN_
ENABLE macro instead of a magic number.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
525e296a28561659d85a63befb694f36e6ec3429 05-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add macros for filter duplicates values

This patch adds macros for filter_duplicates parameter values from
HCI LE Set Scan Enable command. It also fixes le_scan_enable_req
function so it uses the LE_SCAN_FILTER_DUP_ENABLE macro instead of
a magic number.

The LE_SCAN_FILTER_DUP_DISABLE was also defined since it will be
required to properly support the GAP Observer Role.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5df480b56e427d83830576862463226c8fcc95d7 05-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add LE scan type macros

This patch adds macros for active and passive LE scan type values.
The LE_SCAN_PASSIVE was also defined since it will be used in future
by LE connection routine and GAP Observer Role support.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
b6c7515a288485fc638f95d484d8f1dbe1b7f541 05-Apr-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Change LE scanning timeout macros

Define LE scanning timeout macros in jiffies just like we do for
others timeout macros.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
gmt.c
d2c5d77fff6ac0f43fc36f4fde020f726f773c1d 17-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add reading of all local feature pages

With the introduction of CSA4 there is now also a features page number 2
available. This patch increments the maximum supported page number to 2
and adds code for reading all available pages (as long as we have
support for them - indicated by HCI_MAX_PAGES).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
cad718ed2f6fd204b2c5cac6b611fc3fcde7b183 17-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track feature pages in a single table

The local and remote features are organized by page number. Page 0
are the LMP features, page 1 the host features, and any pages beyond 1
features that future core specification versions may define. So far
we've only had the first two pages and two separate variables has been
convenient enough, however with the introduction of Core Specification
Addendum 4 there are features defined on page 2.

Instead of requiring the addition of a new variable each time a new page
number is defined, this patch refactors the code to use a single table
for the features. The patch needs to update both the hci_dev and
hci_conn structures since there are macros that depend on the features
being represented in the same way in both of them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
ci_sysfs.c
fa5513be2b709c8ce6ff0b11d0715760a9a70ffd 16-Apr-2013 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Move and rename hci_conn_accept

Since this function is only used by sco, move it from hci_event.c to
sco.c and rename to sco_conn_defer_accept. Make it static.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
co.c
bbb0eada826636f658ce49290d2896aead5515f7 16-Apr-2013 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Fix incorrect SSP mode bit for non SSP devices

Some faulty non SSP devices send extended inquiry response
during device discovery which is a violation of 2.1 specification.
So for these devices we set SSP bit during acl connection
initiation thinking that it is an SSP device. But for these
devices, in remote host features event SSP supported bit
will be off. But we are not clearing the SSP bit in that case
and eventually SSP bit in conn flag will be incorrectly set for
these devices.

The software which has caused this issue is MecApp
http://www.mecel.se/products/bluetooth/downloads/MecApp_download

This patch does a workaround by clearing the SSP bit if it is
not supported in remote host features event

hcidump log
----------

< HCI Command: Inquiry (0x01|0x0001) plen 5
lap 0x9e8b33 len 4 num 0
> HCI Event: Command Status (0x0f) plen 4
Inquiry (0x01|0x0001) status 0x00 ncmd 1
> HCI Event: Extended Inquiry Result (0x2f) plen 255
bdaddr 00:1B:DC:05:B5:25 mode 1 clkoffset 0x3263 class 0x3c0000 rssi -77
Unknown type 0x42 with 8 bytes data
Unknown type 0x1e with 2 bytes data
> HCI Event: Inquiry Complete (0x01) plen 1
status 0x00

< HCI Command: Create Connection (0x01|0x0005) plen 13
bdaddr 00:1B:DC:05:B5:25 ptype 0xcc18 rswitch 0x01 clkoffset 0x0000
Packet type: DM1 DM3 DM5 DH1 DH3 DH5
> HCI Event: Command Status (0x0f) plen 4
Create Connection (0x01|0x0005) status 0x00 ncmd 1
> HCI Event: Connect Complete (0x03) plen 11
status 0x00 handle 12 bdaddr 00:1B:DC:05:B5:25 type ACL encrypt 0x00
< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
handle 12
> HCI Event: Command Status (0x0f) plen 4
Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1
> HCI Event: Read Remote Supported Features (0x0b) plen 11
status 0x00 handle 12
Features: 0xff 0xff 0x8f 0x7e 0xd8 0x1f 0x5b 0x87
< HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
handle 12 page 1
> HCI Event: Command Status (0x0f) plen 4
Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
> HCI Event: Page Scan Repetition Mode Change (0x20) plen 7
bdaddr 00:1B:DC:05:B5:25 mode 1
> HCI Event: Max Slots Change (0x1b) plen 3
handle 12 slots 5
> HCI Event: Read Remote Extended Features (0x23) plen 13
status 0x00 handle 12 page 1 max 0
Features: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
< HCI Command: Remote Name Request (0x01|0x0019) plen 10
bdaddr 00:1B:DC:05:B5:25 mode 2 clkoffset 0x0000
> HCI Event: Command Status (0x0f) plen 4
Remote Name Request (0x01|0x0019) status 0x00 ncmd 1
> HCI Event: Remote Name Req Complete (0x07) plen 255
status 0x00 bdaddr 00:1B:DC:05:B5:25 name 'Bluetooth PTS Radio v4'
< HCI Command: Authentication Requested (0x01|0x0011) plen 2
handle 12
> HCI Event: Command Status (0x0f) plen 4
Authentication Requested (0x01|0x0011) status 0x00 ncmd 1
> HCI Event: Link Key Request (0x17) plen 6
bdaddr 00:1B:DC:05:B5:25
< HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6
bdaddr 00:1B:DC:05:B5:25
> HCI Event: Command Complete (0x0e) plen 10
Link Key Request Negative Reply (0x01|0x000c) ncmd 1
status 0x00 bdaddr 00:1B:DC:05:B5:25
> HCI Event: PIN Code Request (0x16) plen 6
bdaddr 00:1B:DC:05:B5:25

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
e73dcfbf061b524fe9aaef56cf3c2e234a45ec19 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: fix sending output reports on intr channel

According to the specifications, data output reports must be sent on the
interrupt channel. See also usbhid implementation.
Sending these reports on the control channel breaks newer Wii Remotes.

Note that this will make output reports asynchronous. However, that's how
hid_output_raw_report() is supposed to work with HID_OUTPUT_REPORT as
report type. There are no responses to output reports.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
af87b3d0151e39f23e795d327e25019be687d8c0 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: don't send boot-protocol messages as HID-reports

If a device is registered as HID device, it is always in Report-Mode.
Therefore, we must not send Boot-Protocol messages on
hidinput_input_event() callbacks. This confuses devices and may cause
disconnects on protocol errors.

We disable the hidinput_input_event() callback for now. We can implement
it properly later, but lets first fix the current code by disabling it.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
41edc0c034160408feaa78c9a50cc5e91a5928c7 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: merge 'send' functions into hidp_send_message()

We handle skb buffers all over the place, even though we have
hidp_send_*_message() helpers. This creates a more generic
hidp_send_message() helper and uses it instead of dealing with transmit
queues directly everywhere.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
7350e6cf360d32206cbe4e3d34fb48ab863bdb14 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: merge hidp_process_{ctrl,intr}_transmit()

Both hidp_process_ctrl_transmit() and hidp_process_intr_transmit() are
exactly the same apart from the transmit-queue and socket pointers.
Therefore, pass them as argument and merge both functions into one so we
avoid 25 lines of code-duplication.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
2df012001d36e56cd92dab0255cf4bce3f5b16bc 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: handle kernel_sendmsg() errors correctly

We shouldn't push back the skbs if kernel_sendmsg() fails. Instead, we
terminate the connection and drop the skb. Only on EAGAIN we push it back
and return.
l2cap doesn't return EAGAIN, yet, but this guarantees we're safe if it
will at some time in the future.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
5205185d461d5902325e457ca80bd421127b7308 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: remove old session-management

We have the full new session-management now available so lets switch over
and remove all the old code. Few semantics changed, so we need to adjust
the sock.c callers a bit. But this mostly simplifies the logic.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
idp/hidp.h
idp/sock.c
b4f34d8d9d26b2428fa7cf7c8f97690a297978e6 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: add new session-management helpers

This is a rewrite of the HIDP session management. It implements HIDP as an
l2cap_user sub-module so we get proper notification when the underlying
connection goes away.

The helpers are not yet used but only added in this commit. The old
session management is still used and will be removed in a following patch.

The old session-management was flawed. Hotplugging is horribly broken and
we have no way of getting notified when the underlying connection goes
down. The whole idea of removing the HID/input sub-devices from within the
session itself is broken and suffers from major dead-locks. We never can
guarantee that the session can unregister itself as long as we use
synchronous shutdowns. This can only work with asynchronous shutdowns.
However, in this case we _must_ be able to unregister the session from the
outside as otherwise the l2cap_conn object might be unlinked before we
are.

The new session-management is based on l2cap_user. There is only one
way how to add a session and how to delete a session: "probe" and "remove"
callbacks from l2cap_user.
This guarantees that the session can be registered and unregistered at
_any_ time without any synchronous shutdown.
On the other hand, much work has been put into proper session-refcounting.
We can unregister/unlink the session only if we can guarantee that it will
stay alive. But for asynchronous shutdowns we never know when the last
user goes away so we must use proper ref-counting.

The old ->conn field has been renamed to ->hconn so we can reuse ->conn in
the new session management. No other existing HIDP code is modified.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
idp/hidp.h
2c8e1411e93391c5a78f55b09697a997474a4707 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: l2cap: add l2cap_user sub-modules

Several sub-modules like HIDP, rfcomm, ... need to track l2cap
connections. The l2cap_conn->hcon->dev object is used as parent for sysfs
devices so the sub-modules need to be notified when the hci_conn object is
removed from sysfs.

As submodules normally use the l2cap layer, the l2cap_user objects are
registered there instead of on the underlying hci_conn object. This avoids
any direct dependency on the HCI layer and lets the l2cap core handle any
specifics.

This patch introduces l2cap_user objects which contain a "probe" and
"remove" callback. You can register them on any l2cap_conn object and if
it is active, the "probe" callback will get called. Otherwise, an error is
returned.

The l2cap_conn object will call your "remove" callback directly before it
is removed from user-space. This allows you to remove your submodules
_before_ the parent l2cap_conn and hci_conn object is removed.

At any time you can asynchronously unregister your l2cap_user object if
your submodule vanishes before the l2cap_conn object does.

There is no way around l2cap_user. If we want wire-protocols in the
kernel, we always want the hci_conn object as parent in the sysfs tree. We
cannot use a channel here since we might need multiple channels for a
single protocol.
But the problem is, we _must_ get notified when an l2cap_conn object is
removed. We cannot use reference-counting for object-removal! This is not
how it works. If a hardware is removed, we should immediately remove the
object from sysfs. Any other behavior would be inconsistent with the rest
of the system. Also note that device_del() might sleep, but it doesn't
wait for user-space or block very long. It only _unlinks_ the object from
sysfs and the whole device-tree. Everything else is handled by ref-counts!
This is exactly what the other sub-modules must do: unlink their devices
when the "remove" l2cap_user callback is called. They should not do any
cleanup or synchronous shutdowns.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
9c903e373c11f62d62bce1209f662ca92589a075 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: l2cap: introduce l2cap_conn ref-counting

If we want to use l2cap_conn outside of l2cap_core.c, we need refcounting
for these objects. Otherwise, we cannot synchronize l2cap locks with
outside locks and end up with deadlocks.

Hence, introduce ref-counting for l2cap_conn objects. This doesn't affect
l2cap internals at all, as they use a direct synchronization.
We also keep a reference to the parent hci_conn for locking purposes as
l2cap_conn depends on this. This doesn't affect the connection itself but
only the lifetime of the (dead) object.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
3764eaa922c78037ad9bed06be5c8b8a5c83b37d 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: move hidp_schedule() to core.c

There is no reason to keep this helper in the header file. No other file
depends on it so move it into hidp/core.c where it belongs.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
idp/hidp.h
e3492dc3760ceb981a0bb9992c249ba151b6f61d 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: test "terminate" before sleeping

The "terminate" flag is guaranteed to be set before the session terminates
and the handlers are woken up. Hence, we need to add it to the
sleep-condition.

Note that testing the flags is not enough as nothing prevents us from
setting the flags again after the session-handler terminated.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
dcc07647f17836ecf9f4c54e44624b048ab8c297 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: remove unused session->state field

This field is always BT_CONNECTED. Remove it and set it to BT_CONNECTED in
hidp_copy_session() unconditionally.

Also note that this field is totally bogus. Userspace can query an
hidp-session for its state. However, whenever user-space queries us, this
field should be BT_CONNECTED. If it wasn't BT_CONNECTED, then we would be
currently cleaning up the session and the session itself would exit in the
next few milliseconds. Hence, there is no reason to let user-space know
that the session will exit now if they cannot make _any_ use of that.

Thus, remove the field and let user-space think that a session is always
BT_CONNECTED as long as they can query it.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
idp/hidp.h
8d12356f33f819ec0d064e233f7ca8e59eaa38ef 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: introduce hci_conn ref-counting

We currently do not allow using hci_conn from outside of HCI-core.
However, several other users could make great use of it. This includes
HIDP, rfcomm and all other sub-protocols that rely on an active
connection.

Hence, we now introduce hci_conn ref-counting. We currently never call
get_device(). put_device() is exclusively used in hci_conn_del_sysfs().
Hence, we currently never have a greater device-refcnt than 1.
Therefore, it is safe to move the put_device() call from
hci_conn_del_sysfs() to hci_conn_del() (it's the only caller). In fact,
this even fixes a "use-after-free" bug as we access hci_conn after calling
hci_conn_del_sysfs() in hci_conn_del().

From now on we can add references to hci_conn objects in other layers
(like l2cap_sock, HIDP, rfcomm, ...) and grab a reference via
hci_conn_get(). This does _not_ guarantee, that the connection is still
alive. But, this isn't what we want. We can simply lock the hci_conn
device and use "device_is_registered(hci_conn->dev)" to test that.
However, this is hardly necessary as outside users should never rely on
the HCI connection to be alive, anyway. Instead, they should solely rely
on the device-object to be available.
But if sub-devices want the hci_conn object as sysfs parent, they need to
be notified when the connection drops. This will be introduced in later
patches with l2cap_users.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_sysfs.c
fc225c3f5d1b6aa6f99c5c300af4605e4923ce79 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: remove unneeded hci_conn_hold/put_device()

hci_conn_hold/put_device() is used to control when hci_conn->dev is no
longer needed and can be deleted from the system. Lets first look how they
are currently used throughout the code (excluding HIDP!).

All code that uses hci_conn_hold_device() looks like this:
...
hci_conn_hold_device();
hci_conn_add_sysfs();
...
On the other side, hci_conn_put_device() is exclusively used in
hci_conn_del().

So, considering that hci_conn_del() must not be called twice (which would
fail horribly), we know that hci_conn_put_device() is only called _once_
(which is in hci_conn_del()).
On the other hand, hci_conn_add_sysfs() must not be called twice, either
(it would call device_add twice, which breaks the device, see
drivers/base/core.c). So we know that hci_conn_hold_device() is also
called only once (it's only called directly before hci_conn_add_sysfs()).

So hold and put are known to be called only once. That means we can safely
remove them and directly call hci_conn_del_sysfs() in hci_conn_del().

But there is one issue left: HIDP also uses hci_conn_hold/put_device().
However, this case can be ignored and simply removed as it is totally
broken. The issue is, the only thing HIDP delays with
hci_conn_hold_device() is the removal of the hci_conn->dev from sysfs.
But, the hci_conn device has no mechanism to get notified when its own
parent (hci_dev) gets removed from sysfs. hci_dev_hold/put() does _not_
control when it is removed but only when the device object is created
and destroyed.
And hci_dev calls hci_conn_flush_*() when it removes itself from sysfs,
which itself causes hci_conn_del() to be called, but it does _not_ cause
hci_conn_del_sysfs() to be called, which is wrong.

Hence, we fix it to call hci_conn_del_sysfs() in hci_conn_del(). This
guarantees that a hci_conn object is removed from sysfs _before_ its
parent hci_dev is removed.

The changes to HIDP look scary, wrong and broken. However, if you look at
the HIDP session management, you will notice they're already broken in the
exact _same_ way (ever tried "unplugging" HIDP devices? Breaks _all_ the
time).
So this patch only makes HIDP look _scary_ and _obviously broken_. It does
not break HIDP itself, it already is!

See later patches in this series which fix HIDP to use proper
session-management.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_event.c
idp/core.c
93796fa6f21411dab2ce7ba4fd7fd4d4ed4aca2e 11-Apr-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Reject SCO when hci connection timeouts

This patch sends Reject Synchronous Connection Request Command when
hci_conn_timeout is triggered, and the SCO connection is in BT_CONNECT2
state. It prevents inconsistency if the remote host doesn't implement
properly the timeout for the connection request, and it removes the
connection reference left when the socket is closed for incoming SCO
connections.

[ 2650.129080] sco_sock_release: sock ffff8801ca417400, sk ffff88020c408800
[ 2650.129092] sco_sock_clear_timer: sock ffff88020c408800 state 6
[ 2650.129101] __sco_sock_close: sk ffff88020c408800 state 6 socket
ffff8801ca417400
[ 2650.129108] sco_chan_del: sk ffff88020c408800, conn ffff8801c650ea20,
err 104
[ 2650.129114] hci_conn_put: hcon ffff88020c40a800 orig refcnt 1
[ 2650.129128] sco_sock_kill: sk ffff88020c408800 state 9
[ 2650.129135] sco_sock_destruct: sk ffff88020c408800
[ 2650.138468] hci_conn_timeout: hcon ffff88020c40a800 state BT_CONNECT2

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
baf4325197c13474b08a18f23706cb7096c89bc6 11-Apr-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Remove unneeded parameter

This patch removes the status parameter of the l2cap_conn_add function.
The parameter 'status' is always 0.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
92f185c89f2e8f99cfc302994948e962828ccb23 11-Apr-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Minor coding style fix

This patch removes unneeded initialization and empty line.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
c10cc5a9d46ba09111d4c2769207da4a80506885 11-Apr-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Use GFP_KERNEL in sco_conn_add

This patch changes the memory allocation flags in the sco_conn_add
function, replacing the type to GFP_KERNEL. This function is executed
in process context and it is not called inside an atomic section.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
ea323c119823b48b0a66e48fb980c252e1605b3f 11-Apr-2013 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Fix SCO connection reference

This patch fixes decrementing SCO connection reference right after
stablishing the SCO connection with defer setup enabled. The dump below
shows a disconnection command with handle 0, the connection is still in
BT_CONNECT2 state and there isn't a handle associated with it.

< HCI Command: Accept Synchronous Connection (0x01|0x0029) plen 21
bdaddr 78:47:1D:B3:72:6C
> HCI Event: Command Status (0x0f) plen 4
Accept Synchronous Connection (0x01|0x0029) status 0x00 ncmd 1
< HCI Command: Disconnect (0x01|0x0006) plen 3
handle 0 reason 0x13
Reason: Remote User Terminated Connection
> HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) status 0x00 ncmd 1
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x00 handle 46 bdaddr 78:47:1D:B3:72:6C
type eSCO
Air mode: CVSD
< SCO data: handle 46 flags 0x00 dlen 48

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
76a68ba0ae097be72dfa8f918b3139130da769a4 06-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: rename hci_conn_put to hci_conn_drop

We use _get() and _put() for device ref-counting in the kernel. However,
hci_conn_put() is _not_ used for ref-counting, hence, rename it to
hci_conn_drop() so we can later fix ref-counting and introduce
hci_conn_put().

hci_conn_hold() and hci_conn_put() are currently used to manage how long a
connection should be held alive. When the last user drops the connection,
we spawn a delayed work that performs the disconnect. Obviously, this has
nothing to do with ref-counting for the _object_ but rather for the
keep-alive of the connection.

But we really _need_ proper ref-counting for the _object_ to allow
connection-users like rfcomm-tty, HIDP or others.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_event.c
2cap_core.c
gmt.c
co.c
mp.c
d3641409a05dcb8e28116bb2ad638f5a42805d9d 10-Apr-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
drivers/net/wireless/rt2x00/rt2x00pci.c
net/mac80211/sta_info.c
net/wireless/core.h
4d006263d3d61413e63784a454b6e3310bd8e6ee 05-Apr-2013 Al Viro <viro@zeniv.linux.org.uk> bluetooth: fix race in bt_procfs_init()

use proc_create_data() rather than set ->data after the file has
been created

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
f_bluetooth.c
b03166152f6da91cec8b66837b309dd3923ea536 05-Apr-2013 Al Viro <viro@zeniv.linux.org.uk> bluetooth: kill unused 'module' argument of bt_procfs_init()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
f_bluetooth.c
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap_sock.c
fcomm/sock.c
co.c
14805359c790977199e0d74fe689c2c17e6a0954 05-Apr-2013 Al Viro <viro@zeniv.linux.org.uk> bluetooth: don't bother with ->owner for procfs fops

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
f_bluetooth.c
d9dda78bad879595d8c4220a067fc029d6484a16 01-Apr-2013 Al Viro <viro@zeniv.linux.org.uk> procfs: new helper - PDE_DATA(inode)

The only part of proc_dir_entry the code outside of fs/proc
really cares about is PDE(inode)->data. Provide a helper
for that; static inline for now, eventually will be moved
to fs/proc, along with the knowledge of struct proc_dir_entry
layout.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
f_bluetooth.c
mtp/capi.c
d978a6361ad13f1f9694fcb7b5852d253a544d92 08-Apr-2013 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
drivers/nfc/microread/mei.c
net/netfilter/nfnetlink_queue_core.c

Pull in 'net' to get Eric Biederman's AF_UNIX fix, upon which
some cleanups are going to go on-top.

Signed-off-by: David S. Miller <davem@davemloft.net>
c8c499175f7d295ef867335bceb9a76a2c3cdc38 07-Apr-2013 Mathias Krause <minipli@googlemail.com> Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg()

If the socket is in state BT_CONNECT2 and BT_SK_DEFER_SETUP is set in
the flags, sco_sock_recvmsg() returns early with 0 without updating the
possibly set msg_namelen member. This, in turn, leads to a 128 byte
kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_recvmsg().

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
co.c
e11e0455c0d7d3d62276a0c55d9dfbc16779d691 07-Apr-2013 Mathias Krause <minipli@googlemail.com> Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg()

If RFCOMM_DEFER_SETUP is set in the flags, rfcomm_sock_recvmsg() returns
early with 0 without updating the possibly set msg_namelen member. This,
in turn, leads to a 128 byte kernel stack leak in net/socket.c.

Fix this by updating msg_namelen in this case. For all other cases it
will be handled in bt_sock_stream_recvmsg().

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
4683f42fde3977bdb4e8a09622788cc8b5313778 07-Apr-2013 Mathias Krause <minipli@googlemail.com> Bluetooth: fix possible info leak in bt_sock_recvmsg()

In case the socket is already shutting down, bt_sock_recvmsg() returns
with 0 without updating msg_namelen leading to net/socket.c leaking the
local, uninitialized sockaddr_storage variable to userland -- 128 bytes
of kernel stack memory.

Fix this by moving the msg_namelen assignment in front of the shutdown
test.

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
b3916db32c4a3124eee9f3742a2f4723731d7602 05-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: verify l2cap sockets

We need to verify that the given sockets actually are l2cap sockets. If
they aren't, we are not supposed to access bt_sk(sock) and we shouldn't
start the session if the offsets turn out to be valid local BT addresses.

That is, if someone passes a TCP socket to HIDCONNADD, then we access some
random offset in the TCP socket (which isn't even guaranteed to be valid).

Fix this by checking that the socket is an l2cap socket.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
2cap_sock.c
c849edbdc2fc3a9ba37ae6810d7a1e2c92b302d7 05-Apr-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: hidp: remove redundant error message

We print this error twice in the first error-path so remove it. One error
message is enough.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/sock.c
5afff03815e26abf34702ec10422535224cdfe38 12-Nov-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove driver init queue from core

The driver init queue is no longer needed. This can be all handled
inside the drivers now. So remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
f41c70c4d5e3f6c2a7f9e5dfc10af452591a2484 12-Nov-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add driver setup stage for early init

Some drivers require a special stage for their early init. This is
always specific to the driver or transport. So call back into driver to
allow bringing up the device.

The advantage with this stage is that the Bluetooth core is actually
handling the HCI layer now. This means that command and event processing
is available.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7b1abbbed0f2a1bc19bb8c0d48a284466043092a 03-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add __hci_cmd_sync_ev function

This patch adds a __hci_cmd_sync_ev function, analogous to
__hci_cmd_sync except that it also takes an event parameter to indicate
that the command completes with a special event instead of command
complete. Internally this new function takes advantage of the
hci_req_add_ev function introduced in the previous patch.

The primary expected user of this new function are the setup routines of
HCI drivers which may want to send custom commands and return only when
they have completed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
02350a725f5bc44490c30a10e7e04a12a5ecd406 03-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for custom event terminated commands

This patch adds support for having commands within HCI requests that do
not result in a command complete but some other event. This is at least
needed for some vendor specific commands to be issued in the
hdev->setup() procecure, but might also be useful for other commands.

The way that the support is implemented is by extending the skb control
buffer to have a field to indicate that the command is expected to
terminate with a special event. After sending the command each received
event can then be compared against this field through hdev->sent_cmd.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
75e84b7c522c6e07964cd1f5bf28535768a1e9fa 02-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add __hci_cmd_sync() helper function

This patch adds a helper function for sending a single HCI command
waiting for its completion and then returning back the parameters in the
resulting command complete event (if there was one).

The implementation is very similar to that of hci_req_sync() except that
instead of invocing a callback for sending HCI commands the function
constructs and sends one itself and after being woken up picks the last
received event from hdev->recv_evt (if it matches the right criteria)
and returns it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
b6ddb638235d90ed67af9af40e63880fd66a1939 02-Apr-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Track received events in hdev

This patch adds tracking of received HCI events to the hci_dev struct.
This is necessary so that a subsequent patch can implement a function
for sending a single command synchronously and returning the resulting
command complete parameters in the function return value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
d4299ce6b33c0afd22cf6a170cfaf89c63d1114d 28-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unneeded hci_req_cmd_status function

This patch removes the hci_req_cmd_status function since it is not
used anymore. The HCI request framework now considers the HCI command
has complete once the Command Status or Command Complete Event is
received.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
3e13fa1e1fab479940728272b6425d343e0c0f84 28-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix hci_inquiry ioctl usage

Since the HCI request framework was properly fixed, the hci_req_sync
call, in hci_inquiry, will return as soon as the HCI command completes
(not the Inquiry procedure). However, in inquiry ioctl implementation,
we want to sleep the user process until the inquiry procedure finishes.

This patch changes hci_inquiry so, in case the HCI Inquiry command
was executed successfully, it waits the HCI_INQUIRY flag to be cleared.
This way, the user process will sleep until the inquiry procedure
finishes.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
33720450bb811a0cec1f0147bf8a1801113fa94d 28-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix HCI request framework

Some HCI commands don't send a Command Complete Event once the HCI
command has completed so they require some special handling from the
HCI request framework. These HCI commands, however, send a Command
Status Event to indicate that the command has been received, and
that the controller is currently performing the task for the command.

So, in order to properly handle those HCI commands, the HCI request
framework should consider the HCI command has completed once the
Command Status Event is received.

This way, we fix some issues regarding the Inquiry command support,
as well as add support for all those HCI commands which would require
some special handling from the HCI request framework.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
8facd5fb73c6e960555e5913743dfbb6c3d984a5 02-Apr-2013 Jacob Keller <jacob.e.keller@intel.com> net: fix smatch warnings inside datagram_poll

Commit 7d4c04fc170087119727119074e72445f2bb192b ("net: add option to enable
error queue packets waking select") has an issue due to operator precedence
causing the bit-wise OR to bind to the sock_flags call instead of the result of
the terniary conditional. This fixes the *_poll functions to work properly. The
old code results in "mask |= POLLPRI" instead of what was intended, which is to
only include POLLPRI when the socket option is enabled.

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
7d4c04fc170087119727119074e72445f2bb192b 28-Mar-2013 Keller, Jacob E <jacob.e.keller@intel.com> net: add option to enable error queue packets waking select

Currently, when a socket receives something on the error queue it only wakes up
the socket on select if it is in the "read" list, that is the socket has
something to read. It is useful also to wake the socket if it is in the error
list, which would enable software to wait on error queue packets without waking
up for regular data on the socket. The main use case is for receiving
timestamped transmit packets which return the timestamp to the socket via the
error queue. This enables an application to select on the socket for the error
queue only instead of for the regular traffic.

-v2-
* Added the SO_SELECT_ERR_QUEUE socket option to every architechture specific file
* Modified every socket poll function that checks error queue

Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Cc: Jeffrey Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Matthew Vick <matthew.vick@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
9a574cd67a447059f9c14bbef47873315d7f7b35 29-Mar-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

Conflicts:
net/mac80211/sta_info.c
net/wireless/core.h
e5c5d22e8dcf7c2d430336cbf8e180bd38e8daf1 28-Mar-2013 Simon Horman <horms@verge.net.au> net: add ETH_P_802_3_MIN

Add a new constant ETH_P_802_3_MIN, the minimum ethernet type for
an 802.3 frame. Frames with a lower value in the ethernet type field
are Ethernet II.

Also update all the users of this value that David Miller and
I could find to use the new constant.

Also correct a bug in util.c. The comparison with ETH_P_802_3_MIN
should be >= not >.

As suggested by Jesse Gross.

Compile tested only.

Cc: David Miller <davem@davemloft.net>
Cc: Jesse Gross <jesse@nicira.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: John W. Linville <linville@tuxdriver.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Bart De Schuymer <bart.de.schuymer@pandora.be>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: netfilter-devel@vger.kernel.org
Cc: bridge@lists.linux-foundation.org
Cc: linux-wireless@vger.kernel.org
Cc: linux1394-devel@lists.sourceforge.net
Cc: linux-media@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: dev@openvswitch.org
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
0227c7b56959cd8f5edd20b6a47db86fa553e91a 20-Mar-2013 Wei Yongjun <yongjun_wei@trendmicro.com.cn> Bluetooth: fix error return code in rfcomm_add_listener()

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
8fa48cbdfb0b7c2e39a8f2a46f987afe9b9c0579 18-Mar-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
feb94d3d13af7b724b353d82237ca6f503c98d62 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix PIN/Confirm/Passkey response parameters

The only valid mgmt response to these pairing related commands is a
mgmt_cmd_complete and the returned parameters should contain the address
and address type of the remote device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
1707c60e5d0d4c82c0601d92f10e24e04d2cc599 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify address parameters of user_pairing_resp()

Instead of passing the bdaddr and bdaddr_type as separate parameters to
user_pairing_resp it's simpler to just pass the original mgmt_addr_info
struct which contains both values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4c01f8b845238710ff4b6c7fa8148ca52613f199 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix fast connectable state when enabling page scan

When powering on or enabling page scan we need to ensure that the page
scan parameters are as they should be. This is because some controllers
do not properly reset these values upon HCI_Reset. Since the
write_scan_parameters function is now called from several new places it
also checks for the >= 1.2 HCI version requirement before sending the
commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
bd98b9966f915411a32ecee3fa434cb051167d8a 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating page scan parameters when not necessary

Now that the current page scan parameters are stored in struct hci_dev
we should check against those values before sending new HCI commands to
change them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4a3ee763ba797e0489b7e9fd8810ae087c2a7504 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update page scan parameters after successful write commands

The page scan parameters (interval, window and type) stored in struct
hci_dev should not only be updated after successful reads but also after
successful writes. This patch adds the necessary handlers for the write
command complete events and updates the stored values through them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
f332ec6699980e0563408c7bcf1a8a31b825fee1 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add reading of page scan parameters

These parameters are related to the "fast connectable" mode that can be
changed through the mgmt interface. Not all controllers properly reset
these values with HCI_Reset so they need to be read in order to be able
to verify whether the values are correct or not before enabling page
scan.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
e36a37691e53b54edb78209757fab0dd76c4614f 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Disable fast connectable when disabling connectable

When the connectable setting is disabled the fast connectable setting
must also be disabled. This is so that we're consistent with the
pre-requisites for enabling fast connectable, one of which is that the
connectable setting is enabled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
406d78045d6c3f5912aefe69b9b02e96479d51c8 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor fast connectable HCI commands

This patch refactors the fast connectable HCI commands into their own
HCI function. This is necessary so that the same function can be reused
fo the fast connectable change required by disabling the connectable
setting.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
1a4d3c4b3750885733641216756de4e4d9b2443a 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add proper flag for fast connectable mode

In order to be able to represent fast connectable mode in the mgmt
settings we need to have a HCI dev flag for it. This patch adds the flag
and makes sure its value is changed whenever a mgmt_set_fast_connectable
command completes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
05cbf29f84f2cf17554b58a3ab4a0ac46d52eca6 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix error response for simultaneous fast connectable commands

If there's another pending mgmt_set_fast_connectable command we should
return a "busy" error response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
1a47aee85f8a0803b879abb2e331d6354eb975ac 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Limit fast connectable support to >= 1.2 controllers

The HCI commands that are necessary for fast connectable mode are only
available from HCI specification version 1.2 onwards. This should be
reflected in the supported settings as well as error response for the
set_fast_connectable command when dealing with a < 1.2 capable
controller.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
33e38b3e13e313baedd7c56c38ad249f230171d2 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix fast connectable response sending

The mgmt_set_fast_connectable response should be sent only when all
related HCI commands have completed. This patch fixes the issue by using
an async request and sending the response to user space throught the
complete callback of the request. The patch also fixes in the same go
the return parameters of the command which should be the current
settings.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
2b76f4539c6a41c3dd2e73f9ca7e03bcff6c8774 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use an async request for mgmt_set_connectable

This patch changes the mgmt_set_connectable handler to use an async
request for sending the required HCI command. This is necessary
preparation for handling the fast connectable change that needs to be
associated with disabling the connectable setting.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
b3f2ca9446f63acf5ab8552a37c4cc90af64b816 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting local name to the existing value

If user space attempts to set the local name to the same value that's
already set we should simply return a direct command complete for this
mgmt command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3f985050fa5e2f6715b215452198f005df2d5746 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix local name setting for LE-only controllers

This patch fixes the mgmt_set_local_name command to send the appropriate
HCI commands based on BR/EDR support and LE support. Local name and EIR
data should only be sent for BR/EDR capable controllers whereas an
update to the AD should only happen for LE capable controllers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
04b4edcbc9049e100681c0149b572de439be42ab 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Handle AD updating through an async request

For proper control of the AD update and the related HCI commands it's
best to run the AD update through an async request instead of a
standalone HCI command. This patch changes the hci_update_ad() function
to take a request pointer and updates its users appropriately. E.g. the
function is no longer called after the init sequence but during stage 3
of the init sequence.

The TX power is read during the init sequence, so we don't need an
explicit update whenever it is read and the AD update based on the local
name should be done through the local name mgmt handler. The only other
user is the update based on enabling advertising. This part is still
kept as there is no mgmt API to enable it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
13928971396fb5ad022ec65f694cea367ca48504 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix waiting for EIR update when setting local name

We shouldn't respond to the mgmt_set_local_name command until all
related HCI commands have completed. This patch fixes the issue by
running the local name HCI command and the EIR update in the same
asynchronous request, and returning the mgmt command complete through
the complete callback of the request.

The downside of this is that we must set hdev->dev_name before the local
name HCI command has completed since otherwise the generated EIR
command doesn't contain the new name. This means that we can no-longer
reliably detect when the name has really changed and when not. Luckily
this only affects scenarios where the mgmt interface is *not* used (e.g.
hciconfig) so redundant mgmt_ev_local_name_changed events in these cases
are an acceptable drawback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
35b973c9dd6d518491b251ac777d767d7820aa37 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing flags on power off before notifying mgmt

When powering off the device the hdev->flags and hdev->dev_flags need to
be cleared before calling mgmt_powered(). If this is not done the
resulting events sent to user space may contain incorrect values.

Note that the HCI_AUTO_OFF flag accessed right after this is part of the
persistent flags, so it's unchanged by the hdev->dev_flags reset.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
f9f85279fd3a3284023231c7f0796f98c417e7cd 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Clear non-persistent flags when closing HCI device

When hci_dev_do_close() is called we should make sure to clear all
non-persistent flags in hci->dev_flags.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
2cc6fb0049bc02ca7a020ba7b4f88b4c35976058 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a define for the HCI persistent flags mask

We'll need to use this mask also when powering off the HCI device
so it's better to have this in a single and visible place.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
2908fe31cf6b8d3a975efb567347f85e724f4e81 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless HCI_PENDING_CLASS flag

Now that class related operations are tracked through asynchronous HCI
requests this flag is no longer needed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
92da609750e75d5f46e809fd42e0cace61f6f4d5 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix UUID/class mgmt command response synchronization

We should only return a mgmt command complete once all HCI commands to a
mgmt_set_dev_class or mgmt_add/remove_uuid command have completed. This
patch fixes the issue by having a proper async request complete callback
for these actions and responding to user space in the callback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
0cab9c80ffc5006bf0f6922d805a7540e4949877 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix busy condition testing for EIR and class updates

The add/remove_uuid and set_dev_class mgmt commands can trigger both EIR
and class HCI commands, so testing just for a pending class command is
enough. The simplest way to monitor conflicts that should trigger "busy"
error returns is to check for any pending mgmt command that can trigger
these HCI commands. This patch adds a helper function for this
(pending_eir_or_class) and uses it instead of the old HCI_PENDING_CLASS
flag to test for busy conditions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
229ab39caf8c1321527e408725c1350f7c9aaa84 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Wait for HCI command completion with mgmt_set_powered

We should only notify user space that the adapter has been powered on
after all HCI commands related to the action have completed. This patch
fixes the issue by instating an async request complete callback for
these HCI commands and only notifies user space in the callback.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
890ea8988f7d17453515122041adb0e1acdb6025 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update mgmt powered HCI commands to use async requests

This patch updates sending of HCI commands related to mgmt_set_powered
(e.g. class, name and EIR data) to be sent using asynchronous requests.
This is necessary since it's the only (well, at least the cleanest) way
to keep the power on procedure synchronized and let user space know it
has completed only when all HCI commands are completed (this actual fix
is coming in a subsequent patch).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
70da624376b8ba8d0db83eb817a7bc140778a26f 15-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move power on HCI command updates to their own function

These commands will in a subsequent patch be performed in their own
asynchronous request, so it's more readable (not just from a resulting
code perspective but also the way the patches look like) to have them
performed in their own function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
5ae327f0efc12d35ea8c98007310c35c143c1e21 17-Mar-2013 Alexandru Gheorghiu <gheorghiuandru@gmail.com> Bluetooth: Replaced kzalloc and memcpy with kmemdup

Replaced calls to kzalloc followed by memcpy with a single call to kmemdup.

Signed-off-by: Alexandru Gheorghiu <gheorghiuandru@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
12033caf2380dbd28a497519eece9e92ccdca1c7 16-Mar-2013 Alexandru Gheorghiu <gheorghiuandru@gmail.com> Bluetooth: Use PTR_RET function

Used PTR_RET function instead of IS_ERR and PTR_ERR.
Patch found using coccinelle.

Signed-off-by: Alexandru Gheorghiu <gheorghiuandru@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sysfs.c
eb20ff9c91ddcb2d55c1849a87d3db85af5e88a9 13-Mar-2013 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix not closing SCO sockets in the BT_CONNECT2 state

With deferred setup for SCO, it is possible that userspace closes the
socket when it is in the BT_CONNECT2 state, after the Connect Request is
received but before the Accept Synchonous Connection is sent.

If this happens the following crash was observed, when the connection is
terminated:

[ +0.000003] hci_sync_conn_complete_evt: hci0 status 0x10
[ +0.000005] sco_connect_cfm: hcon ffff88003d1bd800 bdaddr 40:98:4e:32:d7:39 status 16
[ +0.000003] sco_conn_del: hcon ffff88003d1bd800 conn ffff88003cc8e300, err 110
[ +0.000015] BUG: unable to handle kernel NULL pointer dereference at 0000000000000199
[ +0.000906] IP: [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[ +0.000000] PGD 3d21f067 PUD 3d291067 PMD 0
[ +0.000000] Oops: 0002 [#1] SMP
[ +0.000000] Modules linked in: rfcomm bnep btusb bluetooth
[ +0.000000] CPU 0
[ +0.000000] Pid: 1481, comm: kworker/u:2H Not tainted 3.9.0-rc1-25019-gad82cdd #1 Bochs Bochs
[ +0.000000] RIP: 0010:[<ffffffff810620dd>] [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[ +0.000000] RSP: 0018:ffff88003c3c19d8 EFLAGS: 00010002
[ +0.000000] RAX: 0000000000000001 RBX: 0000000000000246 RCX: 0000000000000000
[ +0.000000] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003d1be868
[ +0.000000] RBP: ffff88003c3c1a98 R08: 0000000000000002 R09: 0000000000000000
[ +0.000000] R10: ffff88003d1be868 R11: ffff88003e20b000 R12: 0000000000000002
[ +0.000000] R13: ffff88003aaa8000 R14: 000000000000006e R15: ffff88003d1be850
[ +0.000000] FS: 0000000000000000(0000) GS:ffff88003e200000(0000) knlGS:0000000000000000
[ +0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ +0.000000] CR2: 0000000000000199 CR3: 000000003c1cb000 CR4: 00000000000006b0
[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ +0.000000] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ +0.000000] Process kworker/u:2H (pid: 1481, threadinfo ffff88003c3c0000, task ffff88003aaa8000)
[ +0.000000] Stack:
[ +0.000000] ffffffff81b16342 0000000000000000 0000000000000000 ffff88003d1be868
[ +0.000000] ffffffff00000000 00018c0c7863e367 000000003c3c1a28 ffffffff8101efbd
[ +0.000000] 0000000000000000 ffff88003e3d2400 ffff88003c3c1a38 ffffffff81007c7a
[ +0.000000] Call Trace:
[ +0.000000] [<ffffffff8101efbd>] ? kvm_clock_read+0x34/0x3b
[ +0.000000] [<ffffffff81007c7a>] ? paravirt_sched_clock+0x9/0xd
[ +0.000000] [<ffffffff81007fd4>] ? sched_clock+0x9/0xb
[ +0.000000] [<ffffffff8104fd7a>] ? sched_clock_local+0x12/0x75
[ +0.000000] [<ffffffff810632d1>] lock_acquire+0x93/0xb1
[ +0.000000] [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth]
[ +0.000000] [<ffffffff8105f3d8>] ? lock_release_holdtime.part.22+0x4e/0x55
[ +0.000000] [<ffffffff814f6038>] _raw_spin_lock+0x40/0x74
[ +0.000000] [<ffffffffa0022339>] ? spin_lock+0x9/0xb [bluetooth]
[ +0.000000] [<ffffffff814f6936>] ? _raw_spin_unlock+0x23/0x36
[ +0.000000] [<ffffffffa0022339>] spin_lock+0x9/0xb [bluetooth]
[ +0.000000] [<ffffffffa00230cc>] sco_conn_del+0x76/0xbb [bluetooth]
[ +0.000000] [<ffffffffa002391d>] sco_connect_cfm+0x2da/0x2e9 [bluetooth]
[ +0.000000] [<ffffffffa000862a>] hci_proto_connect_cfm+0x38/0x65 [bluetooth]
[ +0.000000] [<ffffffffa0008d30>] hci_sync_conn_complete_evt.isra.79+0x11a/0x13e [bluetooth]
[ +0.000000] [<ffffffffa000cd96>] hci_event_packet+0x153b/0x239d [bluetooth]
[ +0.000000] [<ffffffff814f68ff>] ? _raw_spin_unlock_irqrestore+0x48/0x5c
[ +0.000000] [<ffffffffa00025f6>] hci_rx_work+0xf3/0x2e3 [bluetooth]
[ +0.000000] [<ffffffff8103efed>] process_one_work+0x1dc/0x30b
[ +0.000000] [<ffffffff8103ef83>] ? process_one_work+0x172/0x30b
[ +0.000000] [<ffffffff8103e07f>] ? spin_lock_irq+0x9/0xb
[ +0.000000] [<ffffffff8103fc8d>] worker_thread+0x123/0x1d2
[ +0.000000] [<ffffffff8103fb6a>] ? manage_workers+0x240/0x240
[ +0.000000] [<ffffffff81044211>] kthread+0x9d/0xa5
[ +0.000000] [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60
[ +0.000000] [<ffffffff814f75bc>] ret_from_fork+0x7c/0xb0
[ +0.000000] [<ffffffff81044174>] ? __kthread_parkme+0x60/0x60
[ +0.000000] Code: d7 44 89 8d 50 ff ff ff 4c 89 95 58 ff ff ff e8 44 fc ff ff 44 8b 8d 50 ff ff ff 48 85 c0 4c 8b 95 58 ff ff ff 0f 84 7a 04 00 00 <f0> ff 80 98 01 00 00 83 3d 25 41 a7 00 00 45 8b b5 e8 05 00 00
[ +0.000000] RIP [<ffffffff810620dd>] __lock_acquire+0xed/0xe82
[ +0.000000] RSP <ffff88003c3c19d8>
[ +0.000000] CR2: 0000000000000199
[ +0.000000] ---[ end trace e73cd3b52352dd34 ]---

Cc: stable@vger.kernel.org [3.8]
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Tested-by: Frederic Dalleau <frederic.dalleau@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
ad82cdd196cc3e31c412a091e8dd59bef0331eaa 09-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix endianness handling of cmd_status/complete opcodes

The opcode in cmd_complete and cmd_status events is 16 bits, so we
should only be comparing it after having converted it to the host
endianness. There's already an opcode variable in both functions which
is in host endiannes so the right fix is to just start using it instead
of ev->opcode.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
34739c1effcbdc6d210324e86514fa2d2d47b12b 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check req->err in hci_req_add

If req->err is set, there is no point in queueing the HCI command
in HCI request command queue since it won't be sent anyway.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
e348fe6bbab85c513816d2536ffabac4be016442 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Make hci_req_add returning void

Since no one checks the returning value of hci_req_add and HCI
request errors are now handled in hci_req_run, we can make hci_
req_add returning void.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5d73e0342fd9bf500583868906325d42c4d2bf6f 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: HCI request error handling

When we are building a HCI request with more than one HCI command
and one of the hci_req_add calls fail, we should have some cleanup
routine so the HCI commands already queued on HCI request can be
deleted. Otherwise, we will face some memory leaks issues.

This patch implements the HCI request error handling which is the
following: If a hci_req_add fails, we save the error code in hci_
request. Once hci_req_run is called, we verify the error field. If
it is different from zero, we delete all HCI commands already queued
and return the error code.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
920c8300c66566afbf92311152c6e462a310203e 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check hci_req_run returning value in __hci_req_sync

Since hci_req_run will be returning more than one error code, we
should check its returning value in __hci_req_sync.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
382b0c39b3f5b239e3fc07712027fcd4d503bd26 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Return ENODATA in hci_req_run

In case the HCI request queue is empty, hci_req_run should return
ENODATA instead of EINVAL. This way, hci_req_run returns a more
meaningful error value.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
bc4445c72cb5d1ed5af80c73e60214ab5ebd8e55 08-Mar-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix __hci_req_sync

If hci_req_run returns error, we erroneously leave the current
process in TASK_INTERRUPTABLE state. If we leave the process in
TASK_INTERRUPTABLE and it is preempted, this process will never
be scheduled again.

This patch fixes this issue by moving the preparation for scheduling
(add to waitqueue and set process state) to just after the hci_req_run
call.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
d865b0070485dfbb0611c5dc07fff21c440858a5 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove empty HCI event handlers

With the removal of hci_req_complete() several HCI event handlers have
essentially become empty and can be removed. The only potential benefit
of these could have been logging, but the hci_event, hci_cmd_complete
and hci_cmd_status already provide a log for events which they do not
have an explicit handler for.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
cecbb967b2f5c52e090978ff6afe7deddbfbeda5 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused hdev->init_last_cmd

This variable is no longer needed (due to async HCI request support and
the conversion of hci_req_sync to use it), so it can be safely removed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
42c6b129cd8c2aa5012a78ec39672e7052cc677a 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use async requests internally in hci_req_sync

This patch converts the hci_req_sync() procedure to internaly use the
asynchronous HCI requests.

The hci_req_sync mechanism relies on hci_req_complete() calls from
hci_event.c into hci_core.c whenever a HCI command completes. This is
very similar to what asynchronous requests do and makes the conversion
fairly straight forward by converting hci_req_complete into a request
complete callback. By this change hci_req_complete (renamed to
hci_req_sync_complete) becomes private to hci_core.c and all calls to it
can be removed from hci_event.c.

The commands in each hci_req_sync procedure are collected into their own
request by passing the hci_request pointer to the request callback
(instead of the hci_dev pointer). The one slight exception is the HCI
init request which has the special handling of HCI driver specific
initialization commands. These commands are run in their own request
prior to the "main" init request.

One other extra change that this patch must contain is the handling of
spontaneous HCI reset complete events that some controllers exhibit.
These were previously handled in the hci_req_complete function but the
right place for them now becomes the hci_req_cmd_complete function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
9238f36a5a5097018b90baa42c473d2f916a46f5 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add request cmd_complete and cmd_status functions

This patch introduces functions to process the HCI request state when
receiving HCI Command Status or Command Complete events. Some HCI
commands, like Inquiry do not result in a Command complete event so
special handling is needed for them. Inquiry is a particularly important
one since it is the only forseeable "non-cmd_complete" command that will
make good use of the request functionality, and its completion is either
indicated by an Inquiry Complete event of a successful Command Complete
for HCI_Inquiry_Cancel.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
11714b3d7acee54eecf85d41c938923a02fdd054 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix stand-alone HCI command handling

To have a consistent content for hdev->cmd_q all entries need to follow
the semantics of asynchronous HCI requests. This means that even single
commands need to be dressed as requests by having a request start
indicator. This patch adds these indicators to the two places needing
it (hci_send_cmd and hci_sock_sendmsg).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_sock.c
71c76a170e979d60e01bd093c9b79e3adeb710cc 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Introduce new hci_req_add function

This function is analogous to hci_send_cmd() but instead of directly
queuing the command to hdev->cmd_q it adds it to the local queue of the
asynchronous HCI request being build (inside struct hci_request).

This is the main function used for building asynchronous requests and
there should be one or more calls to it between calls to hci_req_init
and hci_req_run.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
1ca3a9d06e87e09d2f852397f1fbf7c442c921b5 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor HCI command skb creation

This patch moves out the skb creation from hci_send_cmd() into its own
prepare_cmd() function. This is essential so the same prepare_cmd()
function can be easily reused for skb creation for asynchronous HCI
requests.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
3119ae9599e5cdc1b9838563905c500b582ab6a5 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add initial skeleton for asynchronous HCI requests

This patch adds the initial definitions and functions for asynchronous
HCI requests. Asynchronous requests are essentially a group of HCI
commands together with an optional completion callback. The request is
tracked through the already existing command queue by having the
necessary context information as part of the control buffer of each skb.

The only information needed in the skb control buffer is a flag for
indicating that the skb is the start of a request as well as the
optional complete callback that should be used when the request is
complete (this will be found in the last skb of the request).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
2177bab507d2715ae3b745f47056eacd38b79fa7 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Split HCI init sequence into three stages

Having conditional command sending during a request has always been
problematic and caused hacks like the hdev->init_last_cmd variable. This
patch removes these conditionals and instead splits the init sequence
into three stages, each with its own __hci_req_sync() call.

This also paves the way to the upcoming asynchronous request support
swhich will also benefit by having a simpler implementation if it
doesn't need to cater for requests that change on the fly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
53cce22dc795e73fb48205e3f584f63f4c71c90c 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix __hci_req_sync() handling of empty requests

If a request callback doesn't send any commands __hci_req_sync() should
fail imediately instead of waiting for the inevitable timeout to occur.
This is particularly important once we start creating requests with
conditional command sending which can potentially result in no commands
being sent at all.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
01178cd420e0134ef3fb4da161ba6390c66913bf 05-Mar-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename hci_request to hci_req_sync

We'll be introducing an async version of hci_request. To make things
clear it makes sense to rename the existing API to have a _sync suffix.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
24fd642ccb24c8b5732d7d7b5e98277507860b2a 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Remove redundant RFCOMM BT_CLOSED settings

rfcomm_session_close() sets the RFCOMM session state to BT_CLOSED.
However, in multiple places immediately before the function is
called, the RFCOMM session is set to BT_CLOSED. Therefore,
remove these unnecessary state settings.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
8e888f2783384ec097bc0c88d9949776f3584ed3 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Remove redundant call to rfcomm_send_disc

In rfcomm_session_del() remove the redundant call to
rfcomm_send_disc() because it is not possible for the
session to be in BT_CONNECTED state during deletion
of the session.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
08c30aca9e698faddebd34f81e1196295f9dc063 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Remove RFCOMM session refcnt

Previous commits have improved the handling of the RFCOMM session
timer and the RFCOMM session pointers such that freed RFCOMM
session structures should no longer be erroneously accessed. The
RFCOMM session refcnt now has no purpose and will be deleted by
this commit.

Note that the RFCOMM session is now deleted as soon as the
RFCOMM control channel link is no longer required. This makes the
lifetime of the RFCOMM session deterministic and absolute.
Previously with the refcnt, there was uncertainty about when
the session structure would be deleted because the relative
refcnt prevented the session structure from being deleted at will.

It was noted that the refcnt could malfunction under very heavy
real-time processor loading in embedded SMP environments. This
could cause premature RFCOMM session deletion or double session
deletion that could result in kernel crashes. Removal of the
refcnt prevents this issue.

There are 4 connection / disconnection RFCOMM session scenarios:
host initiated control link ---> host disconnected control link
host initiated ctrl link ---> remote device disconnected ctrl link
remote device initiated ctrl link ---> host disconnected ctrl link
remote device initiated ctrl link ---> remote device disc'ed ctrl link

The control channel connection procedures are independent of the
disconnection procedures. Strangely, the RFCOMM session refcnt was
applying special treatment so erroneously combining connection and
disconnection events. This commit fixes this issue by removing
some session code that used the "initiator" member of the session
structure that was intended for use with the data channels.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Return RFCOMM session ptrs to avoid freed session

Unfortunately, the design retains local copies of the s RFCOMM
session pointer in various code blocks and this invites the erroneous
access to a freed RFCOMM session structure.

Therefore, return the RFCOMM session pointer back up the call stack
to avoid accessing a freed RFCOMM session structure. When the RFCOMM
session is deleted, NULL is passed up the call stack.

If active DLCs exist when the rfcomm session is terminating,
avoid a memory leak of rfcomm_dlc structures by ensuring that
rfcomm_session_close() is used instead of rfcomm_session_del().

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
c06f7d532aa6f78b2847e3b651c0da27fc3296c0 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Check rfcomm session and DLC exists on socket close

A race condition exists between near simultaneous asynchronous
DLC data channel disconnection requests from the host and remote device.
This causes the socket layer to request a socket shutdown at the same
time the rfcomm core is processing the disconnect request from the remote
device.

The socket layer retains a copy of a struct rfcomm_dlc d pointer.
The d pointer refers to a copy of a struct rfcomm_session.
When the socket layer thread performs a socket shutdown, the thread
may wait on a rfcomm lock in rfcomm_dlc_close(). This means that
whilst the thread waits, the rfcomm_session and/or rfcomm_dlc structures
pointed to by d maybe freed due to rfcomm core handling. Consequently,
when the rfcomm lock becomes available and the thread runs, a
malfunction could occur as a freed rfcomm_session structure and/or a
freed rfcomm_dlc structure will be erroneously accessed.

Therefore, after the rfcomm lock is acquired, check that the struct
rfcomm_session is still valid by searching the rfcomm session list.
If the session is valid then validate the d pointer by searching the
rfcomm session list of active DLCs for the rfcomm_dlc structure
pointed by d.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
fea7b02fbf73adb2e746f00ed279a782de7e74e4 28-Feb-2013 Dean Jenkins <Dean_Jenkins@mentor.com> Bluetooth: Avoid rfcomm_session_timeout using freed session

Use del_timer_sync() instead of del_timer() as this ensures
that rfcomm_session_timeout() is not running on a different
CPU when rfcomm_session_put() is called. This avoids a race
condition on SMP systems because potentially
rfcomm_session_timeout() could reuse the freed RFCOMM session
structure caused by the execution of rfcomm_session_put().

Note that this modification makes the reason for the RFCOMM
session refcnt mechanism redundant.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
be9f97f04565a6c438b7521ad679870d25645475 24-Feb-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: change bt_sock_unregister() to return void

There is no reason a caller ever wants to check the return type of this
call. _Iff_ a user successfully called bt_sock_register(), they're allowed
to call bt_sock_unregister().
All other calls in the kernel (device_del, device_unregister, kfree(), ..)
that are logically equivalent return void. Lets not make callers think
they have to check the return type of this call and instead simply return
void.

We guarantee that after bt_sock_unregister() is called, the socket type
_is_ unregistered. If that is not what the caller wants, they're using the
wrong function, anyway.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
5e9d7f868f04106139a58212b860dcdc268ad3af 24-Feb-2013 David Herrmann <dh.herrmann@gmail.com> Bluetooth: discard bt_sock_unregister() errors

After we successfully registered a socket via bt_sock_register() there is
no reason to ever check the return code of bt_sock_unregister(). If
bt_sock_unregister() fails, it means the socket _is_ already unregistered
so we have what we want, don't we?

Also, to get bt_sock_unregister() to fail, another part of the kernel has
to unregister _our_ socket. This is sooo _wrong_ that it will break way
earlier than when we unregister our socket.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap_sock.c
fcomm/sock.c
co.c
fd86c9becc1154ee5643caafedf7cbdf8241c176 20-Feb-2013 Karl Relton <karllinuxtest.relton@ntlworld.com> Bluetooth: Make hidp_get_raw_report abort if the session is terminating

After linux 3.2 the hid_destroy_device call in hidp_session
cleaning up invokes a hook to the power_supply code which
in turn tries to read the battery capacity. This read will
trigger a call to hidp_get_raw_report which is bound to fail
because the device is being taken away - so rather than
wait for the 5 second timeout failure this changes enables
it to fail straight away.

Signed-off-by: Karl Relton <karllinuxtest.relton@ntlworld.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
bed71748346ae0807c7f7a2913965508dbd61403 30-Jan-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename hci_acl_disconn

As hci_acl_disconn function basically sends the HCI Disconnect Command
and it is used to disconnect ACL, SCO and LE links, renaming it to
hci_disconnect is more suitable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_core.c
ci_event.c
b67bfe0d42cac56c512dd5da4b1b347a23f4b70a 28-Feb-2013 Sasha Levin <sasha.levin@oracle.com> hlist: drop the node parameter from iterators

I'm not sure why, but the hlist for each entry iterators were conceived

list_for_each_entry(pos, head, member)

The hlist ones were greedy and wanted an extra parameter:

hlist_for_each_entry(tpos, pos, head, member)

Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.

Besides the semantic patch, there was some manual work required:

- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.

The semantic patch which is mostly the work of Peter Senna Tschudin is here:

@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;

type T;
expression a,c,d,e;
identifier b;
statement S;
@@

-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>

[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ci_sock.c
fcomm/sock.c
co.c
9afa3195b96da7d2320ec44d19fbfbded7a15571 22-Feb-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

Pull trivial tree from Jiri Kosina:
"Assorted tiny fixes queued in trivial tree"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (22 commits)
DocBook: update EXPORT_SYMBOL entry to point at export.h
Documentation: update top level 00-INDEX file with new additions
ARM: at91/ide: remove unsused at91-ide Kconfig entry
percpu_counter.h: comment code for better readability
x86, efi: fix comment typo in head_32.S
IB: cxgb3: delay freeing mem untill entirely done with it
net: mvneta: remove unneeded version.h include
time: x86: report_lost_ticks doesn't exist any more
pcmcia: avoid static analysis complaint about use-after-free
fs/jfs: Fix typo in comment : 'how may' -> 'how many'
of: add missing documentation for of_platform_populate()
btrfs: remove unnecessary cur_trans set before goto loop in join_transaction
sound: soc: Fix typo in sound/codecs
treewide: Fix typo in various drivers
btrfs: fix comment typos
Update ibmvscsi module name in Kconfig.
powerpc: fix typo (utilties -> utilities)
of: fix spelling mistake in comment
h8300: Fix home page URL in h8300/README
xtensa: Fix home page URL in Kconfig
...
21eaab6d19ed43e82ed39c8deb7f192134fb4a0e 21-Feb-2013 Linus Torvalds <torvalds@linux-foundation.org> Merge tag 'tty-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial patches from Greg Kroah-Hartman:
"Here's the big tty/serial driver patches for 3.9-rc1.

More tty port rework and fixes from Jiri here, as well as lots of
individual serial driver updates and fixes.

All of these have been in the linux-next tree for a while."

* tag 'tty-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (140 commits)
tty: mxser: improve error handling in mxser_probe() and mxser_module_init()
serial: imx: fix uninitialized variable warning
serial: tegra: assume CONFIG_OF
TTY: do not update atime/mtime on read/write
lguest: select CONFIG_TTY to build properly.
ARM defconfigs: add missing inclusions of linux/platform_device.h
fb/exynos: include platform_device.h
ARM: sa1100/assabet: include platform_device.h directly
serial: imx: Fix recursive locking bug
pps: Fix build breakage from decoupling pps from tty
tty: Remove ancient hardpps()
pps: Additional cleanups in uart_handle_dcd_change
pps: Move timestamp read into PPS code proper
pps: Don't crash the machine when exiting will do
pps: Fix a use-after free bug when unregistering a source.
pps: Use pps_lookup_dev to reduce ldisc coupling
pps: Add pps_lookup_dev() function
tty: serial: uartlite: Support uartlite on big and little endian systems
tty: serial: uartlite: Fix sparse and checkpatch warnings
serial/arc-uart: Miscll DT related updates (Grant's review comments)
...

Fix up trivial conflicts, mostly just due to the TTY config option
clashing with the EXPERIMENTAL removal.
ece31ffd539e8e2b586b1ca5f50bc4f4591e3893 18-Feb-2013 Gao feng <gaofeng@cn.fujitsu.com> net: proc: change proc_net_remove to remove_proc_entry

proc_net_remove is only used to remove proc entries
that under /proc/net,it's not a general function for
removing proc entries of netns. if we want to remove
some proc entries which under /proc/net/stat/, we still
need to call remove_proc_entry.

this patch use remove_proc_entry to replace proc_net_remove.
we can remove proc_net_remove after this patch.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
d4beaa66add8aebf83ab16d2fde4e4de8dac36df 18-Feb-2013 Gao feng <gaofeng@cn.fujitsu.com> net: proc: change proc_net_fops_create to proc_create

Right now, some modules such as bonding use proc_create
to create proc entries under /proc/net/, and other modules
such as ipv4 use proc_net_fops_create.

It looks a little chaos.this patch changes all of
proc_net_fops_create to proc_create. we can remove
proc_net_fops_create after this patch.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
fd5023111cf720db890ef34f305ac5d427e690a0 09-Feb-2013 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Synchronize with 'net' in order to sort out some l2tp, wireless, and
ipv6 GRE fixes that will be built on top of in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>
f5237f278f30a92401539a54f87ee0c717b6f818 08-Feb-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
25cc4ae913a46bcc11b03c37bec59568f2122a36 03-Feb-2013 Ying Xue <ying.xue@windriver.com> net: remove redundant check for timer pending state before del_timer

As in del_timer() there has already placed a timer_pending() function
to check whether the timer to be deleted is pending or not, it's
unnecessary to check timer pending state again before del_timer() is
called.

Signed-off-by: Ying Xue <ying.xue@windriver.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
a3d09356491d637548dbe815ddb966f52ec9e53a 01-Feb-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor mgmt_pending_foreach

This patch does a trivial refactor in mgmt_pending_foreach function.
It replaces list_for_each_safe by list_for_each_entry_safe, simplifying
the function.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
2b8a9a2e6a2143928819f2fb948d3904746e1582 01-Feb-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unneeded locking

This patch removes unneeded locking in hci_le_adv_report_evt. There
is no need to lock hdev before calling mgmt_device_found.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
405280887f8fb4e168a1bbc865917bb2b881db95 29-Jan-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Reduce critical section in sco_conn_ready

This patch reduces the critical section protected by sco_conn_lock in
sco_conn_ready function. The lock is acquired only when it is really
needed.

This patch fixes the following lockdep warning which is generated
when the host terminates a SCO connection.

Today, this warning is a false positive. There is no way those
two threads reported by lockdep are running at the same time since
hdev->workqueue (where rx_work is queued) is single-thread. However,
if somehow this behavior is changed in future, we will have a
potential deadlock.

======================================================
[ INFO: possible circular locking dependency detected ]
3.8.0-rc1+ #7 Not tainted
-------------------------------------------------------
kworker/u:1H/1018 is trying to acquire lock:
(&(&conn->lock)->rlock){+.+...}, at: [<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]

but task is already holding lock:
(slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa003436e>] sco_connect_cfm+0xbe/0x350 [bluetooth]
[<ffffffffa0015d6c>] hci_event_packet+0xd3c/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0

-> #0 (&(&conn->lock)->rlock){+.+...}:
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);

*** DEADLOCK ***

4 locks held by kworker/u:1H/1018:
#0: (hdev->name#2){.+.+.+}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#1: ((&hdev->rx_work)){+.+.+.}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#2: (&hdev->lock){+.+.+.}, at: [<ffffffffa000fbe9>] hci_disconn_complete_evt.isra.54+0x59/0x3c0 [bluetooth]
#3: (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]

stack backtrace:
Pid: 1018, comm: kworker/u:1H Not tainted 3.8.0-rc1+ #7
Call Trace:
[<ffffffff813e92f9>] print_circular_bug+0x1fb/0x20c
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa000fbd0>] ? hci_disconn_complete_evt.isra.54+0x40/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffff81202e90>] ? __dynamic_pr_debug+0x80/0x90
[<ffffffff8133ff7d>] ? kfree_skb+0x2d/0x40
[<ffffffffa0021644>] ? hci_send_to_monitor+0x1a4/0x1c0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104fdc1>] ? worker_thread+0x51/0x3e0
[<ffffffffa0004450>] ? hci_tx_work+0x800/0x800 [bluetooth]
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff8104fd70>] ? busy_worker_rebind_fn+0x100/0x100
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
3810285cf8cef5c3f9c4334a317b71b876125269 27-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Increment Management interface revision

This patch increments the management interface revision due to the
various fixes, improvements and other changes that have gone in lately.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
f0ff92fbfa14c1cf8c0346f1dde9c3eda26d5abf 27-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix link security setting when powering on

If a controller is powered on while the HCI_AUTO_OFF flag is set the
link security setting (HCI_LINK_SECURITY) might not be in sync with the
actual state of the controller (HCI_AUTH). This patch fixes the issue by
checking for inequality between the intended and actual settings and
sends a HCI_Write_Auth_Enable command if necessary.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
c00d575bd550d3d57aeec2522defa0cea589560c 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for 128-bit UUIDs in EIR data

This patch adds the necessary code for encoding a list of 128-bit UUIDs
into the EIR data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
cdf1963f7ba075772b4b5f91f395ed8fb84d0e70 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for 32-bit UUIDs in EIR data

This patch adds the necessary code for inserting a list of 32-bit UUIDs
into the EIR data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
213202edc9b5ae60eef2a915b83b4aa19b1c3617 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor UUID-16 list generation into its own function

We will need to create three separate UUID lists in the EIR data (for
16, 32 and 128 bit UUIDs) so the code is easier to follow if each list
is generated in their own function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
892bbc5794daac57bff09c584821ed271fa18046 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove useless eir_len variable from EIR creation

The amount of data encoded so far in the create_eir() function can be
calculated simply through the difference between the data and ptr
pointer variables. The eir_len variable then becomes essentially
useless.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
a10f27cf4272033d148d91ff12bb8f4b67dfaca4 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify UUID16 list generation for EIR

There's no need to use two separate loops to generate a UUID list for
the EIR data. This patch merges the two loops previously used for the
16-bit UUID list generation into a single loop, thus simplifying the
code a great deal.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
056341c8cb677356eb2c20a82e788ccb51c6a37b 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify UUID removal code

The UUID removal code can be simplified by using
list_for_each_entry_safe instead of list_for_each_safe.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
83be8eca2e67faaec45280224b798828bbfa69aa 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Keep track of UUID type upon addition

The primary purpose of the UUIDs is to enable generation of EIR and AD
data. In these data formats the UUIDs are split into separate fields
based on whether they're 16, 32 or 128 bit UUIDs. To make the generation
of these data fields simpler this patch adds a type member to the
bt_uuid struct and assigns a value to it as soon as the UUID is added to
the kernel. This way the type doesn't need to be calculated each time
the UUID list is later iterated.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4821002ce2baa130666c2d777e0ed30bee6c7702 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Simplify UUIDs clearing code

The code for clearing the UUIDs list can be simplified by using
list_for_each_entry_safe instead of list_for_each_safe.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
de66aa63054a6fe348869722221d5cd3463d74a0 26-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Store UUIDs in the same order that they were added

We should be encoding UUIDs to the EIR data in the same order that they
were added to the kernel, i.e. each UUID should be added to the end of
the UUIDs list. This patch fixes the issue by using list_add_tail
instead of list_add for storing the UUIDs.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4c02e2d444595200d0b18b889994aac3611cd288 30-Jan-2013 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix hci_conn timeout routine

If occurs a LE or SCO hci_conn timeout and the connection is already
established (BT_CONNECTED state), the connection is not terminated as
expected. This bug can be reproduced using l2test or scotest tool.
Once the connection is established, kill l2test/scotest and the
connection won't be terminated.

This patch fixes hci_conn_disconnect helper so it is able to
terminate LE and SCO connections, as well as ACL.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
8cf9fa1240229cbdd888236c0c43fcbad680cf00 29-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix handling of unexpected SMP PDUs

The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
CC: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
0f496df2d9ba48faa808b5fa330de0da1a2d29d7 30-Jan-2013 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
617677295b53a40d0e54aac4cbbc216ffbc755dd 29-Jan-2013 Jiri Kosina <jkosina@suse.cz> Merge branch 'master' into for-next

Conflicts:
drivers/devfreq/exynos4_bus.c

Sync with Linus' tree to be able to apply patches that are
against newer code (mvneta).
9b008c0457e583e10e62d1215bed6ab26ee54906 22-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for reading LE supported states

The LE supported states indicate the states and state combinations that
the link layer supports. This is important information for knowing what
operations are possible when dealing with multiple connected devices.
This patch adds reading of the supported states to the HCI init
sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
cf1d081f6597a45e5ff63f55c893494a8ae1cdaf 22-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for reading LE White List Size

The LE White List Size is necessary to be known before attempting to
feed the controller with any addresses intended for the white list. This
patch adds the necessary HCI command sending to the HCI init sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
60e77321985ab599fac010afdc465c3e30281a06 22-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add LE Local Features reading support

To be able to make the appropriate decisions for some LE procedures we
need to know the LE features that the local controller supports.
Therefore, it's important to have the LE Read Local Supported Features
HCI comand as part of the HCI init sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
5d0846d416a6c8b7fda1b24aa7369818a7dfa00e 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix returning proper cmd_complete for mgmt_block/unblock

The Block/Unblock Device Management commands should return Command
Complete instead of Command Status whenever possible so that user space
can distinguish exactly which command failed in the case of multiple
commands. This patch does the necessary changes in the command handler
to return the right event to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
06a63b19e9eb90402e465d60d4c2564afd3ca211 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix returning proper cmd_complete for mgmt_disconnect

The Disconnect Management command should return Command Complete instead
of Command Status whenever possible so that user space can distinguish
exactly which command failed in the case of multiple commands. This
patch does the necessary changes in the disconnect command handler to
return the right event to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
118da70b760f04bb2b8130ced97a9f9cc173440a 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for valid disconnect parameters in unpair_device

The valid values for the Disconnect parameter in the Unpair Device
command are 0x00 and 0x01. If any other value is encountered the command
should fail with the appropriate invalid params response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4ee71b2017336f68128515bdbe7c946a39aa9250 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for valid address type values in mgmt commands

This patch adds checks for valid address type values passed to mgmt
commands. If an invalid address type is encountered the code will return
a proper invalid params response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
44b20d33962a73ca14b934540e9168e0da1b49ab 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Check for valid key->authenticated value for LTKs

This patch adds necessary checks for the two allowed values of the
authenticated parameter of each Long Term Key, i.e. 0x00 and 0x01. If
any other value is encountered the valid response is to return invalid
params to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3f706b7205456c90cdc91e21eab36e2fcf4a8bce 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Refactor valid LTK data testing into its own function

This patch refactors valid LTK data testing into its own function. This
will help keep the code readable since there are several tests still
missing that need to be done on the LTK data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
54ad6d8a5afe1a6d162d8d229a3d8fc48b254d24 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for proper key->master value in Load LTKs

The allowed values for the key->master parameter in the Load LTKs
command are 0x00 and 0x01. If there is a key in the list with some other
value the command should fail with a proper invalid params response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
e57e619f463e7841940ef1b98969e23f71f5ee8a 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix returning proper mgmt status for Load LTKs

Failures of mgmt commands should be indicated with valid mgmt status
codes, and EINVAL is not one of them. Instead MGMT_STATUS_INVALID_PARAMS
should be returned.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4ae14301c3b180adaf6b72285499e7404819a023 20-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for correct mgmt_load_link_keys parameters

The debug_keys parameter is only allowed to have the values 0x00 and
0x01. Any other value should result in a proper command status with
MGMT_STATUS_INVALID_PARAMS.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
f950a30e2433f049c17fc47caced1397d25373a6 18-Jan-2013 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix pair device command reply if adapter is powered off

According to Bluetooth Management API specification Pair Device Command
should generate command complete event on both success and failure.
This fix replying with command status (which lacks address info) when
adapter is powered off.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
fe038884a83b85f2bb61c77609eacb5cf613d3fb 16-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix Class of Device indication when powering off

When a HCI device is powered off the Management interface specification
dictates that the class of device value is indicated as zero. This patch
fixes sending of the appropriate class of device changed event when a
HCI device is powered off.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4f73bc4dd3e8563ef4109f293a092820dff66d92 18-Jan-2013 Joe Millenbach <jmillenbach@gmail.com> tty: Added a CONFIG_TTY option to allow removal of TTY

The option allows you to remove TTY and compile without errors. This
saves space on systems that won't support TTY interfaces anyway.
bloat-o-meter output is below.

The bulk of this patch consists of Kconfig changes adding "depends on
TTY" to various serial devices and similar drivers that require the TTY
layer. Ideally, these dependencies would occur on a common intermediate
symbol such as SERIO, but most drivers "select SERIO" rather than
"depends on SERIO", and "select" does not respect dependencies.

bloat-o-meter output comparing our previous minimal to new minimal by
removing TTY. The list is filtered to not show removed entries with awk
'$3 != "-"' as the list was very long.

add/remove: 0/226 grow/shrink: 2/14 up/down: 6/-35356 (-35350)
function old new delta
chr_dev_init 166 170 +4
allow_signal 80 82 +2
static.__warned 143 142 -1
disallow_signal 63 62 -1
__set_special_pids 95 94 -1
unregister_console 126 121 -5
start_kernel 546 541 -5
register_console 593 588 -5
copy_from_user 45 40 -5
sys_setsid 128 120 -8
sys_vhangup 32 19 -13
do_exit 1543 1526 -17
bitmap_zero 60 40 -20
arch_local_irq_save 137 117 -20
release_task 674 652 -22
static.spin_unlock_irqrestore 308 260 -48

Signed-off-by: Joe Millenbach <jmillenbach@gmail.com>
Reviewed-by: Jamey Sharp <jamey@minilop.net>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/Kconfig
46818ed514102c8d251d4aff5c99ad3ff6805432 14-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix using system-global workqueue when not necessary

There's a per-HCI device workqueue (hdev->workqueue) that should be used
for general per-HCI device work (except hdev->req_workqueue that's for
hci_request() related work). This patch fixes places using the
system-global work queue and makes them use the hdev->workqueue instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
gmt.c
1920257316615676387794cc5fb838183b3bae7f 14-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use req_workqueue for hci_request operations

This patch converts work assignment relying on hci_request() from the
system-global work queue to the per-HCI device specific work queue
(hdev->req_workqueue) intended for hci_request() related tasks.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
gmt.c
6ead1bbc381a674c20f227dbe6f3a8c6f67ce7a2 14-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a new workqueue for hci_request operations

The hci_request function is blocking and cannot be called through the
usual per-HCI device workqueue (hdev->workqueue). While hci_request is
in progress any other work from the queue, including sending HCI
commands to the controller would be blocked and eventually cause the
hci_request call to time out.

This patch adds a second workqueue to be used by operations needing
hci_request and thereby avoiding issues with blocking other workqueue
users.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
2e124b4a390ca85325fae75764bef92f0547fa25 03-Jan-2013 Jiri Slaby <jslaby@suse.cz> TTY: switch tty_flip_buffer_push

Now, we start converting tty buffer functions to actually use
tty_port. This will allow us to get rid of the need of tty in many
call sites. Only tty_port will needed and hence no more
tty_port_tty_get in those paths.

Now, the one where most of tty_port_tty_get gets removed:
tty_flip_buffer_push.

IOW we also closed all the races in drivers not using tty_port_tty_get
at all yet.

Also we move tty_flip_buffer_push declaration from include/linux/tty.h
to include/linux/tty_flip.h to all others while we are changing it
anyway.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
05c7cd39907184328f48d3e7899f9cdd653ad336 03-Jan-2013 Jiri Slaby <jslaby@suse.cz> TTY: switch tty_insert_flip_string

Now, we start converting tty buffer functions to actually use
tty_port. This will allow us to get rid of the need of tty in many
call sites. Only tty_port will needed and hence no more
tty_port_tty_get in those paths.

tty_insert_flip_string this time.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
52e0b011e29f36bc5c02ea3adbf4d864a38373de 10-Jan-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix uuid output in debugfs

The uuid should be printed in the CPU endianness and not in little-endian.

Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sysfs.c
a1d704509d5b96756d3d4cfb7f10a555efeadb87 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending incorrect new_settings for mgmt_set_powered

The socket from which a mgmt_set_powered command was received should
only receive the command response but no new_settings event.

The mgmt_powered() function which is used to handle the situation with
the HCI_AUTO_OFF flag tries to check for a pending command to know which
socket to skip the event for, but since the pending command hasn't been
added this will not happen.

This patch fixes the issue by adding the pending command for the
HCI_AUTO_OFF case and thereby ensures that mgmt_powered() will skip the
right socket when sending the new_settings event, but still send the
proper response to the socket where the command came from.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
04106755763f558886a631338d12546345bae6e9 10-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix returning proper command status for start_discovery

Management commands should whenever possible fail with proper command
status or command complete events. This patch fixes the
mgmt_start_discovery command to do this for the failure cases where an
incorrect parameter value was passed to it ("not supported" if the
parameter value was valid but the controller doesn't support it and
"invalid params" if it isn't valid at all).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
a7e80f25ae2296d78163d75d753c796270464000 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for exact values of boolean mgmt parameters

All mgmt_set_* commands that take a boolean value encoded in the form of
a byte should only accept the values 0x00 and 0x01. This patch adds the
necessary checks for this and returns "invalid params" responses if
anything else is provided as the value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
13ecd8b6628c14c9a27832ce7c48315385272208 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move non-critical sections outside of the dev lock

This patch fixes sections of code that do not need hci_lock_dev to be
outside of the lock. Such sections include code that do not touch the
hdev at all as well as sections which just read a single byte from the
supported_features value (i.e. all lmp_*_capable() macros).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
ee98f4738050bb93823ce9ba849f5d78f5b8c1a1 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix accepting set_dev_class for non-BR/EDR controllers

The concept of Class of Device only exists for BR/EDR controllers. The
mgmt_set_dev_class command should therefore return a proper "not
supported" error if it is attempted for a controller that doesn't
support BR/EDR (e.g. a single mode LE-only one).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
575b3a02e20a10bb8110378ef363a8a174018680 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix checking for valid device class values

The two lowest bits of the minor device class value are reserved and
should be zero, and the three highest bits of the major device class
likewise. The management code should therefore test for this and return
a proper "invalid params" error if the condition is not met.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
715a5bf2db4df4a7df64f420d21fb49ba146b3fa 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing command complete for mgmt_load_long_term_keys

All management events are expected to indicate successful completion
through a command complete event, however the load long term keys
command was missing this. This patch adds the missing event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
e384662b1c1004e6b1e9d2c4979945a383c07b7d 09-Jan-2013 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix missing command complete event for mgmt_confirm_name

All management commands are expected to indicate successful completion
through a command complete event however the confirm name command was
missing it. This patch add the sending of the missing event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
b7e98b5100aad9290d7f06fcb9d1e80f7f62f05f 03-Jan-2013 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Check if the hci connection exists in SCO shutdown

Checking only for sco_conn seems to not be enough and lead to NULL
dereferences in the code, check for hcon instead.

<1>[11340.226404] BUG: unable to handle kernel NULL pointer dereference at
0000000
8
<4>[11340.226619] EIP is at __sco_sock_close+0xe8/0x1a0
<4>[11340.226629] EAX: f063a740 EBX: 00000000 ECX: f58f4544 EDX: 00000000
<4>[11340.226640] ESI: dec83e00 EDI: 5f9a081f EBP: e0fdff38 ESP: e0fdff1c
<0>[11340.226674] Stack:
<4>[11340.226682] c184db87 c1251028 dec83e00 e0fdff38 c1754aef dec83e00
00000000
e0fdff5c
<4>[11340.226718] c184f587 e0fdff64 e0fdff68 5f9a081f e0fdff5c c1751852
d7813800
62262f10
<4>[11340.226752] e0fdff70 c1753c00 00000000 00000001 0000000d e0fdffac
c175425c
00000041
<0>[11340.226793] Call Trace:
<4>[11340.226813] [<c184db87>] ? sco_sock_clear_timer+0x27/0x60
<4>[11340.226831] [<c1251028>] ? local_bh_enable+0x68/0xd0
<4>[11340.226846] [<c1754aef>] ? lock_sock_nested+0x4f/0x60
<4>[11340.226862] [<c184f587>] sco_sock_shutdown+0x67/0xb0
<4>[11340.226879] [<c1751852>] ? sockfd_lookup_light+0x22/0x80
<4>[11340.226897] [<c1753c00>] sys_shutdown+0x30/0x60
<4>[11340.226912] [<c175425c>] sys_socketcall+0x1dc/0x2a0
<4>[11340.226929] [<c149ba78>] ? trace_hardirqs_on_thunk+0xc/0x10
<4>[11340.226944] [<c18860f1>] syscall_call+0x7/0xb
<4>[11340.226960] [<c1880000>] ? restore_cur+0x5e/0xd7
<0>[11340.226969] Code: <f0> ff 4b 08 0f 94 c0 84 c0 74 20 80 7b 19 01 74
2f b8 0a 00 00

Reported-by: Chuansheng Liu <chuansheng.liu@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
7b064edae38d62d8587a8c574f93b53ce75ae749 10-Jan-2013 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Fix authentication if acl data comes before remote feature evt

If remote device sends l2cap info request before read_remote_ext_feature
completes then mgmt_connected will be sent in hci_acldata_packet() and
remote name request wont be sent and eventually authentication wont happen

Hcidump log of the issue

< HCI Command: Create Connection (0x01|0x0005) plen 13
bdaddr BC:85:1F:74:7F:29 ptype 0xcc18 rswitch 0x01 clkoffset 0x4bf7 (valid)
Packet type: DM1 DM3 DM5 DH1 DH3 DH5
> HCI Event: Command Status (0x0f) plen 4
Create Connection (0x01|0x0005) status 0x00 ncmd 1
> HCI Event: Connect Complete (0x03) plen 11
status 0x00 handle 12 bdaddr BC:85:1F:74:7F:29 type ACL encrypt 0x00
< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
handle 12
> HCI Event: Command Status (0x0f) plen 4
Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 1
> HCI Event: Read Remote Supported Features (0x0b) plen 11
status 0x00 handle 12
Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
> HCI Event: Max Slots Change (0x1b) plen 3
handle 12 slots 5
< HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
handle 12 page 1
> HCI Event: Command Status (0x0f) plen 4
Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
> ACL data: handle 12 flags 0x02 dlen 10
L2CAP(s): Info req: type 2
< ACL data: handle 12 flags 0x00 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x00b8
Enhanced Retransmission mode
Streaming mode
FCS Option
Fixed Channels
> HCI Event: Read Remote Extended Features (0x23) plen 13
status 0x00 handle 12 page 1 max 1
Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
> ACL data: handle 12 flags 0x02 dlen 10
L2CAP(s): Info req: type 3
< ACL data: handle 12 flags 0x00 dlen 20
L2CAP(s): Info rsp: type 3 result 0
Fixed channel list 0x00000002
L2CAP Signalling Channel
> HCI Event: Number of Completed Packets (0x13) plen 5
handle 12 packets 2

This patch moves sending mgmt_connected from hci_acldata_packet() to
l2cap_connect_req() since this code is to handle the scenario remote
device sends l2cap connect req too fast

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
2cap_core.c
0a9ab9bdb3e891762553f667066190c1d22ad62b 06-Jan-2013 Anderson Lizardo <anderson.lizardo@openbossa.org> Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()

The length parameter should be sizeof(req->name) - 1 because there is no
guarantee that string provided by userspace will contain the trailing
'\0'.

Can be easily reproduced by manually setting req->name to 128 non-zero
bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
input subsystem:

$ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af

("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
field in struct hid_device due to overflow.)

Cc: stable@vger.kernel.org
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
dbccd791a3fbbdac12c33834b73beff3984988e9 11-Dec-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix sending HCI commands after reset

After sending reset command wait for its command complete event before
sending next command. Some chips sends CC event for command received
before reset if reset was send before chip replied with CC.

This is also required by specification that host shall not send
additional HCI commands before receiving CC for reset.

< HCI Command: Reset (0x03|0x0003) plen 0 [hci0] 18.404612
> HCI Event: Command Complete (0x0e) plen 4 [hci0] 18.405850
Write Extended Inquiry Response (0x03|0x0052) ncmd 1
Status: Success (0x00)
< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0 [hci0] 18.406079
> HCI Event: Command Complete (0x0e) plen 4 [hci0] 18.407864
Reset (0x03|0x0003) ncmd 1
Status: Success (0x00)
< HCI Command: Read Local Supported Features (0x04|0x0003) plen 0 [hci0] 18.408062
> HCI Event: Command Complete (0x0e) plen 12 [hci0] 18.408835

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Cc: stable@vger.kernel.org
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
a6785be2f76e2c39b3008820e7bfef8f5fd838bc 13-Dec-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: mgmt: Avoid using magic number in status code

Use MGMT_STATUS_SUCCESS for success return code.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
47c37941b8895557409db286e6a441e6d557d62f 13-Dec-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: mgmt: Remove not needed restriction on add/remove OOB data

Those commands don't send any HCI commands to controller so there is no
need to restrict them to only powered up controller. This also makes
implementation more consistent as already stored remote OOB data
persist power toggle.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
cb6801c640c759fe02c812728c2661bd8ba5a302 07-Dec-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use set_bit / test_bit for amp_mgr state

Using bit operations solves problems with multiple requests
and clearing state.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
cbf54ad104cb2ec6f5734d95be1dc783bea0343b 07-Dec-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Remove dead code

Remove code which cannot execute. l2cap_conn_add for AMP_LINK
might only be invoked when receiving data in l2cap_recv_acldata.
But this case is checked in the first statement there.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
7a9898c6ff67ad640304fd3d02f9a22874483c3d 07-Dec-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Clean up logical link create / accept

Use chan->hs_hcon instead of lookup by dst address.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
8e05e3ba88adcf7ac644e6ef26676ea7c048a08c 07-Dec-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Send A2MP Create Phylink Rsp after Assoc write

Postpone sending A2MP Create Phylink Response until we got successful
HCI Command Complete after HCI Write Remote AMP Assoc.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
d6b67c6c0c54c1b18507c15cf1667a362959a0d3 08-Dec-2012 Rami Rosen <ramirose@gmail.com> Bluetooth: Remove unnecessary include l2cap.h

This patch removes unnecessary include of <net/bluetooth/l2cap.h>
in bluetooth/bnep/core.c.

Signed-off-by: Rami Rosen <ramirose@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
nep/core.c
d82603c6da7579c50ebe3fe7da6e3e267d9f6427 27-Dec-2012 Jorrit Schippers <jorrit@ncode.nl> treewide: Replace incomming with incoming in all comments and strings

Signed-off-by: Jorrit Schippers <jorrit@ncode.nl>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
ci_core.c
fd62c5450324af7f6cc12897b09b77285cd48a92 13-Dec-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID subsystem updates from Jiri Kosina:

1) Support for HID over I2C bus has been added by Benjamin Tissoires.
ACPI device discovery is still in the works.

2) Support for Win8 Multitiouch protocol is being added, most work done
by Benjamin Tissoires as well

3) EIO/ERESTARTSYS is fixed in hiddev/hidraw, fixes by Andrew Duggan
and Jiri Kosina

4) ION iCade driver added by Bastien Nocera

5) Support for a couple new Roccat devices has been added by Stefan
Achatz

6) HID sensor hubs are now auto-detected instead of having to list all
the VID/PID combinations in the blacklist array

7) other random fixes and support for new device IDs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (65 commits)
HID: i2c-hid: add mutex protecting open/close race
Revert "HID: sensors: add to special driver list"
HID: sensors: autodetect USB HID sensor hubs
HID: hidp: fallback to input session properly if hid is blacklisted
HID: i2c-hid: fix ret_count check
HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches
HID: i2c-hid: remove extra .irq field in struct i2c_hid
HID: i2c-hid: reorder allocation/free of buffers
HID: i2c-hid: fix memory corruption due to missing hid declaration
HID: i2c-hid: remove superfluous include
HID: i2c-hid: remove unneeded test in i2c_hid_remove
HID: i2c-hid: i2c_hid_get_report may fail
HID: i2c-hid: also call i2c_hid_free_buffers in i2c_hid_remove
HID: i2c-hid: fix error messages
HID: i2c-hid: fix return paths
HID: i2c-hid: remove unused static declarations
HID: i2c-hid: fix i2c_hid_dbg macro
HID: i2c-hid: fix checkpatch.pl warning
HID: i2c-hid: enhance Kconfig
HID: i2c-hid: change I2C name
...
818b930bc15077fc00ff16bb22c5df1857f05afa 12-Dec-2012 Jiri Kosina <jkosina@suse.cz> Merge branches 'for-3.7/upstream-fixes', 'for-3.8/hidraw', 'for-3.8/i2c-hid', 'for-3.8/multitouch', 'for-3.8/roccat', 'for-3.8/sensors' and 'for-3.8/upstream' into for-linus

Conflicts:
drivers/hid/hid-core.c
4529eefad087f97b33c0f31984d924b1f15d7bae 06-Dec-2012 Lamarque V. Souza <lamarque@gmail.com> HID: hidp: fallback to input session properly if hid is blacklisted

This patch against kernel 3.7.0-rc8 fixes a kernel oops when turning on the
bluetooth mouse with id 0458:0058 [1].

The mouse in question supports both input and hid sessions, however it is
blacklisted in drivers/hid/hid-core.c so the input session is one that should
be used. Long ago (around kernel 3.0.0) some changes in the bluetooth
subsystem made the kernel do not fallback to input session when hid session is
not supported or blacklisted. This patch restore that behaviour by making the
kernel try the input session if hid_add_device returns ENODEV.

The patch exports hid_ignore() from hid-core.c so that it can be used in the
bluetooth subsystem.

[1] https://bugzilla.kernel.org/show_bug.cgi?id=39882

Signed-off-by: Lamarque V. Souza <lamarque@gmail.com>
Acked-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
06ef5c4bbb9816e7a7eb44917f11c2e3375fb51a 03-Dec-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
0b27a4b97cb1874503c78453c0903df53c0c86b2 03-Dec-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Revert "Bluetooth: Fix possible deadlock in SCO code"

This reverts commit 269c4845d5b3627b95b1934107251bacbe99bb68.

The commit was causing dead locks and NULL dereferences in the sco code:

[28084.104013] BUG: soft lockup - CPU#0 stuck for 22s! [kworker/u:0H:7]
[28084.104021] Modules linked in: btusb bluetooth <snip [last unloaded:
bluetooth]
...
[28084.104021] [<c160246d>] _raw_spin_lock+0xd/0x10
[28084.104021] [<f920e708>] sco_conn_del+0x58/0x1b0 [bluetooth]
[28084.104021] [<f920f1a9>] sco_connect_cfm+0xb9/0x2b0 [bluetooth]
[28084.104021] [<f91ef289>]
hci_sync_conn_complete_evt.isra.94+0x1c9/0x260 [bluetooth]
[28084.104021] [<f91f1a8d>] hci_event_packet+0x74d/0x2b40 [bluetooth]
[28084.104021] [<c1501abd>] ? __kfree_skb+0x3d/0x90
[28084.104021] [<c1501b46>] ? kfree_skb+0x36/0x90
[28084.104021] [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]
[28084.104021] [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]

Cc: stable@vger.kernel.org
Reported-by: Chan-yeol Park <chanyeol.park@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
f2592d3ee3c5817981f343b90bfb9c5612f38d23 29-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Change NO_FCS_RECV to RECV_NO_FCS

Make code more readable by changing CONF_NO_FCS_RECV which is read
as "No L2CAP FCS option received" to CONF_RECV_NO_FCS which means
"Received L2CAP option NO_FCS". This flag really means that we have
received L2CAP FRAME CHECK SEQUENCE (FCS) OPTION with value "No FCS".

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
cbabee788ff881b87bbaf258caf080b49a61fa43 29-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Process receiving FCS_NONE in L2CAP Conf Rsp

Process L2CAP Config rsp Pending with FCS Option 0x00 (No FCS)
which is sent by Motorola Windows 7 Bluetooth stack. The trace
is shown below (all other options are skipped).

...
< ACL data: handle 1 flags 0x00 dlen 48
L2CAP(s): Config req: dcid 0x0043 flags 0x00 clen 36
...
FCS Option 0x00 (No FCS)
> ACL data: handle 1 flags 0x02 dlen 48
L2CAP(s): Config req: dcid 0x0041 flags 0x00 clen 36
...
FCS Option 0x01 (CRC16 Check)
< ACL data: handle 1 flags 0x00 dlen 47
L2CAP(s): Config rsp: scid 0x0043 flags 0x00 result 4 clen 33
Pending
...
> ACL data: handle 1 flags 0x02 dlen 50
L2CAP(s): Config rsp: scid 0x0041 flags 0x00 result 4 clen 36
Pending
...
FCS Option 0x00 (No FCS)
< ACL data: handle 1 flags 0x00 dlen 14
L2CAP(s): Config rsp: scid 0x0043 flags 0x00 result 0 clen 0
Success
> ACL data: handle 1 flags 0x02 dlen 14
L2CAP(s): Config rsp: scid 0x0041 flags 0x00 result 0 clen 0
Success
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
60918918a9f3455859a4be0d4e381003cbdb843f 29-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix missing L2CAP EWS Conf parameter

If L2CAP_FEAT_FCS is not supported we sould miss EWS option
configuration because of break. Make code more readable by
combining FCS configuration in the single block.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
5d05416e0907b0dd30b62b002bed3b85e6efbd61 29-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Check that AMP is present and active

Before starting quering remote AMP controllers make sure
that there is local active AMP controller.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ced5c338d7b696021058c23fb6a286def2171df5 28-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Mark controller radio powered down after HCIDEVDOWN

After getting HCIDEVDOWN controller did not mark itself as 0x00 which
means: "The Controller radio is available but is currently physically
powered down". The result was even if the hdev was down we return
in controller list value 0x01 "status 0x01 (Bluetooth only)".

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5e4e3972b8da23e270fa37670caec4d32f2197f7 28-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Refactor l2cap_send_disconn_req

l2cap_send_disconn_req takes 3 parameters of which conn might be
derived from chan. Make this conversion inside l2cap_send_disconn_req.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ffa88e02bc67a1496fae762ad899e8f49136e7a1 23-Nov-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Move double negation to macros

Some comparisons needs to double negation(!!) in order to make the value
of the field boolean. Add it to the macro makes the code more readable.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
20714bfef84d3e690c9c6f8e9cd46543b5ae1eed 21-Nov-2012 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Implement deferred sco socket setup

In order to authenticate and configure an incoming SCO connection, the
BT_DEFER_SETUP option was added. This option is intended to defer reply
to Connect Request on SCO sockets.
When a connection is requested, the listening socket is unblocked but
the effective connection setup happens only on first recv. Any send
between accept and recv fails with -ENOTCONN.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
co.c
b96e9c671b05f95126753a22145d4509d45ca197 21-Nov-2012 Frédéric Dalleau <frederic.dalleau@linux.intel.com> Bluetooth: Add BT_DEFER_SETUP option to sco socket

This option will set the BT_SK_DEFER_SETUP bit in socket flags.

Signed-off-by: Frédéric Dalleau <frederic.dalleau@linux.intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
b9b5ef188e5a2222cfc16ef62a4703080750b451 21-Nov-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: cancel power_on work when unregistering the device

We need to cancel the hci_power_on work in order to avoid it run when we
try to free the hdev.

[ 1434.201149] ------------[ cut here ]------------
[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
_power_on+0x0/0x90
[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-
20121112-sasha-00018-g2f4ce0e #127
[ 1434.210760] Call Trace:
[ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
[ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
[ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
[ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
[ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
[ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
[ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330
[ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0
[ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
[ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10
[ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60
[ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20
[ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30
[ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
[ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250
[ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
[ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10
[ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0
[ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
[ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17
[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---

Cc: stable@vger.kernel.org
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
dc2a0e20fbc85a71c63aa4330b496fda33f6bf80 21-Nov-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add missing lock nesting notation

This patch fixes the following report, it happens when accepting rfcomm
connections:

[ 228.165378] =============================================
[ 228.165378] [ INFO: possible recursive locking detected ]
[ 228.165378] 3.7.0-rc1-00536-gc1d5dc4 #120 Tainted: G W
[ 228.165378] ---------------------------------------------
[ 228.165378] bluetoothd/1341 is trying to acquire lock:
[ 228.165378] (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0000aa0>] bt_accept_dequeue+0xa0/0x180 [bluetooth]
[ 228.165378]
[ 228.165378] but task is already holding lock:
[ 228.165378] (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0205118>] rfcomm_sock_accept+0x58/0x2d0 [rfcomm]
[ 228.165378]
[ 228.165378] other info that might help us debug this:
[ 228.165378] Possible unsafe locking scenario:
[ 228.165378]
[ 228.165378] CPU0
[ 228.165378] ----
[ 228.165378] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[ 228.165378] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[ 228.165378]
[ 228.165378] *** DEADLOCK ***
[ 228.165378]
[ 228.165378] May be due to missing lock nesting notation

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/sock.c
d2ff5ee919f0b1377595df80ba49c9921ce4ee62 21-Nov-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
b3117494772d8f906625905c6e203af745ee3530 21-Nov-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

Conflicts:
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
drivers/net/wireless/iwlwifi/pcie/tx.c
2b2fec4d08a0aabe20d2e749cb7978f04217af65 20-Nov-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Remove OOB data if device was discovered in band

OOB authentication mechanism should be used only if pairing process
has been activated by previous OOB information exchange (Core Spec
4.0 , vol. 1, Part A, 5.1.4.3). Stored OOB data for specific device
should be removed if that device was discovered in band later on.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
fd45bf4c923308b19d8baa3c227d26a0e7d79fa7 20-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Set no FCS for incoming L2CAP chan

When receiving L2CAP Create Channel Request set the channel as
L2CAP_FCS_NONE. Then in "L2CAP Config req" following field will
be set: "FCS Option 0x00 (No FCS)". So by default High Speed
channels have no FCS.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
1bb166e66cc46323d3757ce1027cc1c767498d50 20-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Improve error message printing

Instead of printing:
"[ 7763.082007] Bluetooth: 2"
print something like:
"[ 7763.082007] Bluetooth: Trailing bytes: 2 in sframe"

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
37295996ce181a2a4e74308070abf06bd822f7a1 20-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Set local_amp_id after getting Phylink Completed evt

local_amp_id is used in l2cap_physical_cfm and shall be set up
before calling it.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
62748ca16f2f79a62d90fb45963233fb10f726c4 20-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix sending L2CAP Create Chan Req

When receiving Physical Link Completed event we need to create L2CAP
channel with L2CAP Create Chan Request. Current code was sending
this command only if connection was pending (which is probably
needed in channel move case). If channel is not moved but created
Create Chan should be sent for outgoing channel which is checked
with BT_CONNECT flag.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
62cd50e262182685c291bc86076e74ef6f7331b1 14-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Use __constant for constants

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
12d6cc60f2d02d5754ca662b414f8f96200b14a6 14-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Disable FCS only for new HS channels

Set chan->fcs to L2CAP_FCS_NONE only for new L2CAP channels
(not moved). Other side can still request to use FCS.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
2cap_core.c
a514b17fab51c1433db920d76cf8ddda959e5da0 14-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Refactor locking in amp_physical_cfm

Remove locking from l2cap_physical_cfm and lock chan inside
amp_physical_cfm.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
2cap_core.c
522db70286fcce420e5fc1be107912fbd3806323 15-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded local_amp_id initialization

local_amp_id is already set in l2cap_connect() which is called several
lines above.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
96eff46e9f5632efa0d2941f7e028701a5f1a0f6 15-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use __l2cap_no_conn_pending helper

Use helper instead of test_bit. This is the only place left using
test CONF_CONNECT_PEND flag.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
c1d5dc4ac15be45c7061e207f06ad8dfba0c2170 08-Nov-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating advertising state flags and data

This patch adds a callback for the HCI_LE_Set_Advertise_Enable command.
The callback is responsible for updating the HCI_LE_PERIPHERAL flag
updating as well as updating the advertising data flags field to
indicate undirected connectable advertising.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
3f0f524bafcd2025c12e215f13207c7be0a13bf9 08-Nov-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for setting LE advertising data

This patch adds support for setting basing LE advertising data. The
three elements supported for now are the advertising flags, the TX power
and the friendly name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
bbaf444a89dd7dd7effd8ed2f4e4ec64da3cc1da 08-Nov-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use proper invalid value for tx_power

The core specification defines 127 as the "not available" value (well,
"reserved" for BR/EDR and "not available" for LE - but essentially the
same). Therefore, instead of testing for 0 (which is in fact a valid
value) we should be using this invalid value to test if the tx_power is
available.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
gmt.c
b7fd76d114568d0b1e0d443049ed597b3a55f9c6 14-Nov-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
482049f75750d73358e65236b933417b69f9cc25 08-Nov-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix memory leak when removing a UUID

When removing a UUID from the list in the remove_uuid() function we must
also kfree the entry in addition to removing it from the list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
fbe96d6ff9f4e361e1b2ec0a30140e17af7e3854 30-Oct-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Notify about device registration before power on

It is important that the monitor interface gets notified about
a new device before its power on procedure has been started.

For some reason that is no longer working as expected and the power
on procedure runs first. It is safe to just notify about device
registration and trigger the power on procedure afterwards.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
896ea28ea824d49671fc7e9315d9c5be491a644f 25-Oct-2012 Paulo Sérgio <paulo.sergio@openbossa.org> Bluetooth: Fix error status when pairing fails

When pairing fails due to wrong confirm value, the management layer
doesn't report a proper error status. It sends
MGMT_STATUS_CONNECT_FAILED instead of MGMT_STATUS_AUTH_FAILED.

Most of management functions that receive a status as a parameter
expects for it to be encoded as a HCI status. But when a SMP pairing
fails, the SMP layer sends the SMP reason as the error status to the
management layer.

This commit maps all SMP reasons to HCI_ERROR_AUTH_FAILURE, which will
be converted to MGMT_STATUS_AUTH_FAILED in the management layer.

Reported-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Reviewed-by: João Paulo Rechi Vita <jprvita@openbossa.org>
Signed-off-by: Paulo Sérgio <paulo.sergio@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
476e44cb19f1fbf2d5883dddcc0ce31b33b45915 19-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix having bogus entries in mgmt_read_index_list reply

The mgmt_read_index_list uses one loop to calculate the max needed size
of its response with the help of an upper-bound of the controller count.
The second loop is more strict as it checks for HCI_SETUP (which might
have gotten set after the first loop) and could result in some indexes
being skipped. Because of this the function needs to readjust the event
length and index count after filling in the response array.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
fffadc08ebf1f4c61bb8f9be0f1d8c3c053d815f 01-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Rename ctrl_id to remote_amp_id

Since we have started to use local_amp_id for local AMP
Controller Id it makes sense to rename ctrl_id to remote_amp_id
since it represents remote AMP controller Id.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
2cap_core.c
6e1df6a60372b6ea00c480c1cd8c8c8134357d89 01-Nov-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Process Create Chan Request

Add processing L2CAP Create Chan Request. When channel is created
save associated high speed link hs_hcon.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
cf70ff220a918b25d383510f913de52308d04bb2 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use l2cap_physical_cfm in phylink complete evt

When receiving HCI Phylink Complete event run amp_physical_cfm
which initialize BR/EDR L2CAP channel associated with High Speed
link and run l2cap_physical_cfm which shall send L2CAP Create
Chan Request.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
ci_event.c
f351bc72676e2666543511558215fe3c95d4336f 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Check for hs_hcon instead of ctrl_id

When deciding whether to send EFS configuration response with success,
check rather for existence of High Speed physical link hs_hcon then
ctrl_id. There might be cases when there is ctrl_id but high speed link
is not established yet.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
419e08c1121ab346bf5f66fe0a21950529355cee 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Disconnect logical link when deleting chan

Disconnect logical link for high speed channel hs_hchan
associated with L2CAP channel chan.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
2cap_core.c
e58917b990ef0cc3903aa962236a0dae4f1f81a0 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Remove hci_conn receiving error command status

When receiving HCI Event: Command Status for Create Physical Link
with Error code remove AMP hcon.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
9eef6b3a9e38d5f8ad315b2a7db153392e6a77d6 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Process Disc Physical Link Complete evt

Add processing for HCI Disconnection Physical Link Complete Event.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
606e2a10a6d23e900dad0b098a09438a5f7e0495 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Process Disc Logical Link

Add processing for HCI Disconnection Logical Link Complete
Event.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
ci_event.c
5ce66b59d787478f57a6f3368ff23d75a06e76e2 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Add Logical Link Create function

After physical link is created logical link needs to be created.
The process starts after L2CAP channel is created and L2CAP
Configuration Response with result PENDING is received.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
ci_event.c
2cap_core.c
770bfefa2cbe8f5911860fef1a68ea873a9bbdbe 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Derive remote and local amp id from chan struct

l2cap_chan already keeps information about *_amp_id.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
439f34acead5bb1679f194c2023f05b90dcb8b4c 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Return correct L2CAP response type

Return L2CAP_CREATE_CHAN_RSP for Create Channel Request and
L2CAP_CONN_RSP for Create Connection Request.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
336178a33491685039d154d1f0a8bd696f51699b 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Save hs_hchan instead of hs_hcon in loglink complete

When logical link creation is completed we need to save hs_hchan
which represents logical link instead of hs_hcon representing
physical link. hs_hcon shall be saved when receiving physical link
complete event.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ba6fc31727c07e11a7b700a9c17e91ab4bed2f4c 31-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Fix braces style and remove empty line

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
612dfce9fbd2e564bcd656d4b7f7fa7d72966c47 29-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: mgmt: Use __constant when dealing with constants

__constant_cpu_to_le*() is the right go here.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
258c4ed076387fc900ea52869eab9b7ee67ce864 23-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Remove unnecessary include export.h

For files only using THIS_MODULE and/or EXPORT_SYMBOL, map
them onto including export.h -- or if the file isn't even
using those, then just delete the include.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
nep/netdev.c
ci_event.c
e9b02748ffc043e8a36f7893bbf58bb886f0b7e4 25-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add put(hcon) when deleting hchan

When refcnt reaches zero disconnect timeout will run and hci_conn
will be disconnected.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
27695fb415ab150e1972a882c2538bf9bf130cb0 25-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Process Logical Link complete evt

After receiving HCI Logical Link Complete event finish EFS
configuration by sending L2CAP Conf Response with success code.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
2cap_core.c
d5e911928bd8325918bda3df59e84b0c17a0cdab 25-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Process Physical Link Complete evt

Add processing for HCI Physical Link Complete event. Upon
successful status received start L2CAP create channel process.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
35ba9561b9b5dc1e5921b927440bd6d3844f0577 25-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use helper function sending EFS conf rsp

There is helper function used to send EFS Configuration Response.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
fe79c6fea30a7b6d1a8757c9bfce2f6426c68436 25-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Remove unneeded assignment

Assignment is not needed here since err is always gets value.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
430a61b8037e3184eb7e59220bb4a43530b8d0f6 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending unnecessary HCI_LE_Host_Enable

This patch fixes sending an unnecessary HCI_LE_Host_Enable command if
the command has already been sent as part of the default HCI init
sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
1225a6bdf87446134789f3fc70ca75a056bbb1ed 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix unnecessary EIR update during powering on

When powered on the EIR data gets updated as the last step by mgmt.
Therefore avoid an update when getting a local name update as that's
part of the normal HCI init sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
6b4b73ee75bd65c4a47b1a323cb7c5180a6d2ea7 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix sending unnecessary HCI_Write_SSP_Mode command

This patch fixes sending an unnecessary HCI_Write_SSP_Mode command if
the command has already been sent as part of the default HCI init
sequence.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
5ed8eb2f6b5710c09bd1adb40aa795a424e21143 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix setting host feature bits for SSP

When we get a successful command complete for HCI_Write_SSP_Mode we need
to update the host feature bits for the hdev struct accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
f15504788d7b1613ef2ef0a673cfe250c16a6b0d 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Disallow LE scanning and connecting in peripheral role

When an adapter is in the LE peripheral role scanning for other devices
or initiating connections to them is not allowed. This patch makes sure
that such attempts will result in appropriate error returns.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
ci_core.c
976eb20e61e33dd3e7840bc26bc5d33ab9ca9c5c 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Make use feature test macros

For better code readability and avoiding simple bugs of checking the
wrong byte of the features make use of feature test macros whenever
possible.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
53b2caabbe97193e6231dbcc0d48f7e1888fa38e 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix updating host feature bits for LE

When LE has been enabled with the simultaneous BR/EDR & LE parameter set
to true we should also update the host features stored in struct hci_dev
accordingly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
33c525c0a37abd136f014f473f5a2efddba58167 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Restrict BR/EDR settings to BR/EDR-only adapters

This patch makes sure that settings which are specific for BR/EDR
capable adapters are not allowed for non-BR/EDR (e.g. LE-only) adapters.
Instead, a "not supported" error is returned of such a setting is
attempted to be set for a non-BR/EDR adapter.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
7f0ae647b29ba80d5a1127804ba478e3de8a6b4c 24-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix HCI command sending when powering on LE-only adapters

This patch makes sure that we don't send BR/EDR-only commands for
LE-only adapters when they get powered on. Doing this would just cause
command errors.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
4611dfa85ece8a26ff46b099a6d91df733066c73 24-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Replace *_init() for *_setup()

le_init() and bredr_init() are now called le_setup() and bredr_setup() to
avoid duplicates names over the tree even if they are all static.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
8fa19098ebc700f14b0f8d0fb957e7748e14c44b 19-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Read adversiting channel TX power during init sequence

This patch adds the reading of the LE advertising channel TX power to
the HCI init sequence of LE-capable controllers. This data will be used
e.g. for inclusion in the advertising data packets when advertising is
enabled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
e36b04c805e452689d468f9783e5dffa61e38be7 19-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add setting of the LE event mask

This patch adds setting of the LE event mask to the HCI init procedure
for LE-capable controllers. Right now we only set the default mask which
is good enough for the events available in the 4.0 core specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
572c7f8429e3c015dd8931b2d3f71b512a7f15f1 19-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix LE MTU reporting for HCIGETDEVINFO

This patch fixes the use of le_mtu and le_pkts values in the
HCIGETDEVINFO ioctl for LE-only controllers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
e1171e8d9c50c38a9adba72bb23949d9b975335c 19-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add initial support for LE-only controllers

This patch splits off most the HCI init sequence commands from a fixed
set into a conditional one that is sent once the HCI_Read_Local_Features
and HCI_Read_Local_Version_Information commands complete. This is
necessary since many of the current fixed commands are not allowed for
LE-only controllers.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
2ad8f54bc86809c2a8de3830e3ed275fcc6401ed 23-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Replace include linux/module.h with linux/export.h

include <linux/export.h> is the right to go here.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mtp/capi.c
mtp/sock.c
ea5a5c73a278b24f05022b6f073bf5d196a2b271 23-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: trivial: Remove newline before EOF

Trivial fix.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
config
3f7a56c4ff438f4727439cb048034f56320dd228 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Start channel move when socket option is changed

Channel moves are triggered by changes to the BT_CHANNEL_POLICY
sockopt when an ERTM or streaming-mode channel is connected.

Moves are only started if enable_hs is true.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
e6a3ee6e8aa27d0a38be7ead0c1624041697ffbc 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Do not retransmit data during a channel move

Do not retransmit previously-sent data when a "receiver ready" s-frame
with the "final" flag is received during a move.

The ERTM state machines will resynchronize at the end of a channel
move, and the state machine needs to avoid state changes during a
move.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
a549574da39f0a6df68ffdb72dd015d04a8486de 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Ignore BR/EDR packet size constraints when fragmenting for AMP

When operating over BR/EDR, ERTM accounts for the maximum over-the-air
packet size when setting the PDU size. AMP controllers do not use the
same over-the-air packets, so the PDU size should only be based on the
HCI MTU of the AMP controller.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
36c86c8566cec67924ae6f372d9066cc9e92ad0e 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Configure appropriate timeouts for AMP controllers

The L2CAP spec recommends specific retransmit and monitor timeouts for
ERTM channels that are on AMP controllers. These timeouts are
calculated from the AMP controller's best effort flush timeout.

BR/EDR controllers use the default retransmit and monitor timeouts.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
b99e13ade709274104f5c2b8a26dc7d2953fc58e 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Do not send data during channel move

Outgoing ERTM data is queued during a channel move. The ERTM state
machine is partially reset at the start of a move, and must be
resynchronized with the remote state machine at the end of the move.
Data is not sent so that there are no state transitions between the
partial reset and the resync.

Streaming mode frames are dropped during a move.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d5f8a75d88ecef3987158a94e8070bdfb46b09bd 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Flag ACL frames as complete for AMP controllers

AMP controllers expect to transmit only "complete" ACL frames. These
frames have both the "start" and "cont" bits set. AMP does not allow
fragmented ACLs.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
8eb200bd2f1c772dcb7f108f690ef03b054be04e 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Handle physical link completion

Several different actions may be taken when an AMP physical link
becomes available. A channel being created on an AMP controller must
continue the connection process. A channel being moved needs to
either send a move request or a move response. A failed physical link
will revert to using a BR/EDR controller if possible.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
3fd71a0a438aa5bd43f52f3feec24a4cb3b799d3 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add move confirm response handling

The move confirm response concludes the channel move command sequence.
Receipt of this command indicates that data may begin to flow again.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
1500109bbc6cc42ec6c8445f1cf04d25fa54a57b 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add logical link confirm

The logical link confirm callback is executed when the AMP controller
completes its logical link setup. During a channel move, a newly
formed logical link allows a move responder to send a move channel
response. A move initiator will send a move channel confirm. A
failed logical link will end the channel move and send an appropriate
response or confirm command indicating a failure.

If the channel is being created on an AMP controller, L2CAP
configuration is completed after the logical link is set up.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
5b155ef960202b20a5cae43b9e675f4326e2375c 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Move channel response

The move response command includes a result code indicating
"pending", "success", or "failure" status. A pending result is
received when the remote address is still setting up a physical link,
and will be followed by success or failure. On success, logical link
setup will proceed. On failure, the move is stopped. The receiver of
a move channel response must always follow up by sending a move
channel confirm command.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
168df8e57e7c1afce3f86a86ae106f82ff7c18d8 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add state to hci_chan

On an AMP controller, hci_chan maps to a logical link. When a channel
is being moved, the logical link may or may not be connected already.
The hci_chan->state is used to determine the existance of a useable
logical link so the link can be either used or requested.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
5f3847a4788e7205a6ad2ac363f968c9618074f1 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add move channel confirm handling

After sending a move channel response, a move responder waits for a
move channel confirm command. If the received command has a
"confirmed" result the move is proceeding, and "unconfirmed" means the
move has failed and the channel will not change controllers.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
32b32735ca1439e2ead658dd63234c0c380af8ac 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add new ERTM receive states for channel move

Two new states are required to implement channel moves with the ERTM
receive state machine.

The "WAIT_P" state is used by a move responder to wait for a "poll"
flag after a move is completed (success or failure). "WAIT_F" is
similarly used by a move initiator to wait for a "final" flag when the
move is completing. In either state, the reqseq value in the
poll/final frame tells the state machine exactly which frame should be
expected next.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
02b0fbb92dbb0e3c50f1c955547444e3997c80e3 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Channel move request handling

On receipt of a channel move request, the request must be validated
based on the L2CAP mode, connection state, and controller
capabilities. ERTM channels must have their state machines cleared
and transmission paused while the channel move takes place.

If the channel is being moved to an AMP controller then
an AMP physical link must be prepared. Moving the channel back to
BR/EDR proceeds immediately.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
b1a130b7d372c5ccc2001d4ee08928b5324f0a76 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Lookup channel structure based on DCID

Processing a move channel request involves getting the channel
structure using the destination channel ID. Previous code could only
look up using the source channel ID.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
5909cf30f380d13bb59e81e4cb17c3714cb94e68 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove unnecessary intermediate function

Resolves a conflict resolution issue in "Bluetooth: Fix L2CAP coding
style". The remaining connect and create channel response handler is
renamed to better reflect its use for both response types.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
1700915fef115b13c43fe3974d0dbb619e6a187d 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add L2CAP create channel request handling

The L2CAP create channel request is very similar to an L2CAP connect
request, but it has an additional parameter for the controller ID. If
the controller id is 0, the channel is set up on the BR/EDR controller
(just like a connect request). Using a valid high speed controller ID
will cause the channel to be initially created on that high speed
controller. While the L2CAP data will be initially routed over the
AMP controller, the L2CAP fixed signaling channel only uses BR/EDR.

When a create channel request is received for a high speed controller,
a pending response is always sent first. After the high speed
physical and logical links are complete a success response will be
sent.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
08333283a7347c33589f31c9b1d1b7a4f3c3f7a3 24-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add new l2cap_chan struct members for high speed channels

An L2CAP channel using high speed continues to be associated with a
BR/EDR l2cap_conn, while also tracking an additional hci_conn
(representing a physical link on a high speed controller) and hci_chan
(representing a logical link). There may only be one physical link
between two high speed controllers. Each physical link may contain
several logical links, with each logical link representing a channel
with specific quality of service.

During a channel move, the destination channel id, current move state,
and role (initiator vs. responder) are tracked and used by the channel
move state machine. The ident value associated with a move request
must also be stored in order to use it in later move responses.

The active channel is stored in local_amp_id.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
9b34f40c20111ba658f88e1669598db494be1fbc 23-Oct-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

Conflicts:
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
net/mac80211/mlme.c
bc27d5f14363a1065bf9437a5bca5409492b6c06 19-Oct-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
f706adfeade767d2194c9f39c0f75e944b0bdd23 18-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Get amp_mgr reference in HS hci_conn

When assigning amp_mgr in hci_conn (type AMP_LINK) get also reference.
In hci_conn_del those references would be put for both conn types
AMP_LINK and ACL_LINK associated with amp_mgr.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
3d02a9265c5414b07b372dde616174d3c89071a0 15-Oct-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
56f6098441adb9487f6e0439429fc536afcf9e71 15-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Zero bredr pointer when chan is deleted

If BREDR L2CAP chan is deleted and this chan is the channel through
which High Speed traffic is routed to AMP then zero pointer to
the chan in amp_mgr to prevent accessing it.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
79de886d9c40be1d82d414ccc5640268c705af39 15-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Send EFS Conf Rsp only for BR/EDR chan

Do not send EFS Configuration Response for High Speed channel yet.
It will be sent after receiving Logical Link Complete event.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
1d13a254e14565e6a2d91f7552203406a30d1ee2 15-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Drop packets when no l2cap conn exist

High Speed hci_conn should always have l2cap_conn associated with it.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d73a098804b4d1d254b1caf1d114e5b707dee060 15-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle complete frames in l2cap

Check flags type in switch statement and handle new frame
type ACL_COMPLETE used for High Speed data over AMP.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
204a6e54280d53e6990e536998fbf8dfba41ecd3 15-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use Loglink handle in ACL Handle field

For AMP HCI controller use Logical Link handle in HCI ACL
Handle field.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
300229f962b36e292524b26c86962d7339010b44 12-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Rename __l2cap_connect() to l2cap_connect()

Use of "__" usually means we need to call the function with a lock held,
which is not the case here.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2dc4e5105f012bda7eef2f459ed3d5299ded9672 12-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Add chan->ops->defer()

When DEFER_SETUP is set defer() will trigger an authorization
request to the userspace.

l2cap_chan_no_defer() is meant to be used when one does not want to
support DEFER_SETUP (A2MP for example).

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
2cap_sock.c
644912e18ac1d27f57f6673b0236b568ff750fd1 12-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Move bt_accept_enqueue() to l2cap_sock.c

This is part of the move the parent socket usage to l2cap_sock.c

The change is safe when it comes to locking, bt_accept_enqueue() is still
protected by the parent socket lock inside the
l2cap_sock_new_connection_cb() code.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
1bbb3095a5912be4b9c90397ef2182a5a328865b 04-Oct-2012 Eric W. Biederman <ebiederm@xmission.com> userns: Properly print bluetooth socket uids

With user namespace support enabled building bluetooth generated the warning.
net/bluetooth/af_bluetooth.c: In function ‘bt_seq_show’:
net/bluetooth/af_bluetooth.c:598:7: warning: format ‘%u’ expects argument of type ‘unsigned int’, but argument 7 has type ‘kuid_t’ [-Wformat]

Convert sock_i_uid from a kuid_t to a uid_t before printing, to avoid
this problem.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Cc: Masatake YAMATO <yamato@redhat.com>
Cc: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
f_bluetooth.c
b699ec0d99825713d30a057c432d0e29f07c5490 06-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Call ops->teardown() without checking for NULL

Users that don't implement teardown() should use l2cap_chan_no_teardown()

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d117773ce5c73eaa51f3283f89802f4491b27b2e 06-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use locked l2cap_state_change()

No one was protecting the state set in l2cap_send_disconn_req()

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
1d8b1fd55aa1dfa9edd74ebb467db9358fa56f8a 06-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: use l2cap_chan_set_err()

l2cap_conn_unreliable() doesn't take the sk lock, so we need to take it
using l2cap_chan_set_err().

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
8bcde1f2ab732a7d7db1de854dcc0747ffecb7c2 29-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove GFP_ATOMIC usage from l2cap_core.c

Since we change the Bluetooth core to run in process context we don't need
to use GFP_ATOMIC in many of places we were using it. The we just replace
by GFP_KERNEL.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2d7928184c3d8724064de282be4e3c3d70f39d32 06-Oct-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix L2CAP coding style

Follow the net subsystem coding style

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
065a13e2cc665f6547dc7e8a9d6b6565badf940a 11-Oct-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: SMP: Fix setting unknown auth_req bits

When sending a pairing request or response we should not just blindly
copy the value that the remote device sent. Instead we should at least
make sure to mask out any unknown bits. This is particularly critical
from the upcoming LE Secure Connections feature perspective as
incorrectly indicating support for it (by copying the remote value)
would cause a failure to pair with devices that support it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
4c89b6aad5b7c5c56dadca66af6ceae0addbf2bf 11-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Factor out common L2CAP connection code

L2CAP connect requests and create channel requests share a significant
amount of code. This change moves common code to a new function.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
f5a2598d80fda49756f234a43bc332a13ce95128 11-Oct-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Process create response and connect response identically

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
bd1eb66ba4eee21de3be24212b135f57101ad930 10-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle AMP_LINK connection

AMP_LINK represents physical link between AMP controllers.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
ci_event.c
76ef7cf7722331097f5f47d23342128b1b5d072d 10-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle number of compl blocks for AMP_LINK

Add handling blocks count for AMP link.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
42c4e53e7ac3d4069105e852d1ee24e6ee9e57b8 10-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Add handle to hci_chan structure

hci_chan will be identified by handle used in logical link creation
process. This handle is used in AMP ACL-U packet handle field.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
53502d69be49e3dd5bc95ab0f2deeaea260bd617 10-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle AMP_LINK timeout

When AMP_LINK timeouts execute HCI_OP_DISCONN_PHY_LINK as analog to
HCI_OP_DISCONNECT for ACL_LINK.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
12d5978165944a9c5b059a8258685539387fcf90 10-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Allow to set flush timeout

Enable setting of flush timeout via setsockopt

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
5bcb80944dffe68055c1745dc919d22ee1e276a5 10-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Use __constant modifier for RFCOMM PSM

Since the RFCOMM_PSM is constant, __constant_cpu_to_le16() is
the right go here.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/core.c
d8aece2af380a251daf2351d92dd38b9edf10b84 10-Oct-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Use __constant modifier for L2CAP SMP CID

Since the L2CAP_CID_SMP is constant, __constant_cpu_to_le16() is
the right go here.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
23d3a86948b65055345dc1fe778513e4bf3b07d6 08-Oct-2012 Sasha Levin <sasha.levin@oracle.com> Bluetooth: don't attempt to free a channel that wasn't created

We may currently attempt to free a channel which wasn't created due to
an error in the initialization path, this would cause a NULL ptr deref.

This would cause the following oops:

[ 12.919073] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
[ 12.919131] IP: [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50
[ 12.919135] PGD 0
[ 12.919138] Oops: 0002 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[ 12.919193] Dumping ftrace buffer:
[ 12.919242] (ftrace buffer empty)
[ 12.919314] Modules linked in:
[ 12.919318] CPU 1
[ 12.919319] Pid: 6210, comm: krfcommd Tainted: G W 3.6.0-next-20121004-sasha-00005-gb010653-dirty #30
[ 12.919374] RIP: 0010:[<ffffffff836645c4>] [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50
[ 12.919377] RSP: 0000:ffff880066933c38 EFLAGS: 00010246
[ 12.919378] RAX: ffffffff8366c780 RBX: 0000000000000000 RCX: 6666666666666667
[ 12.919379] RDX: 0000000000000fa0 RSI: ffffffff84d3f79e RDI: 0000000000000010
[ 12.919381] RBP: ffff880066933c48 R08: ffffffff859989f8 R09: 0000000000000001
[ 12.919382] R10: 0000000000000000 R11: 7fffffffffffffff R12: 0000000000000000
[ 12.919383] R13: ffff88009b00a200 R14: ffff88009b00a200 R15: 0000000000000001
[ 12.919385] FS: 0000000000000000(0000) GS:ffff880033600000(0000) knlGS:0000000000000000
[ 12.919437] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 12.919440] CR2: 0000000000000010 CR3: 0000000005026000 CR4: 00000000000406e0
[ 12.919446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 12.919451] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 12.919504] Process krfcommd (pid: 6210, threadinfo ffff880066932000, task ffff880065c4b000)
[ 12.919506] Stack:
[ 12.919510] ffff88009b00a200 ffff880032084000 ffff880066933c68 ffffffff8366c7bc
[ 12.919513] 7fffffffffffffff ffff880032084000 ffff880066933c98 ffffffff833ae0ae
[ 12.919516] ffff880066933ca8 0000000000000000 0000000000000000 ffff88009b00a200
[ 12.919517] Call Trace:
[ 12.919522] [<ffffffff8366c7bc>] l2cap_sock_destruct+0x3c/0x80
[ 12.919527] [<ffffffff833ae0ae>] __sk_free+0x1e/0x1f0
[ 12.919530] [<ffffffff833ae2f7>] sk_free+0x17/0x20
[ 12.919585] [<ffffffff8366ca4e>] l2cap_sock_alloc.constprop.5+0x9e/0xd0
[ 12.919591] [<ffffffff8366cb9e>] l2cap_sock_create+0x7e/0x100
[ 12.919652] [<ffffffff83a4f32a>] ? _raw_read_lock+0x6a/0x80
[ 12.919658] [<ffffffff836402c4>] ? bt_sock_create+0x74/0x110
[ 12.919660] [<ffffffff83640308>] bt_sock_create+0xb8/0x110
[ 12.919664] [<ffffffff833aa232>] __sock_create+0x282/0x3b0
[ 12.919720] [<ffffffff833aa0b0>] ? __sock_create+0x100/0x3b0
[ 12.919725] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0
[ 12.919779] [<ffffffff833aa37f>] sock_create_kern+0x1f/0x30
[ 12.919784] [<ffffffff83675714>] rfcomm_l2sock_create+0x44/0x70
[ 12.919787] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0
[ 12.919790] [<ffffffff836785fe>] rfcomm_run+0x4e/0x1f0
[ 12.919846] [<ffffffff836785b0>] ? rfcomm_process_sessions+0x17e0/0x17e0
[ 12.919852] [<ffffffff81138ee3>] kthread+0xe3/0xf0
[ 12.919908] [<ffffffff8117b12e>] ? put_lock_stats.isra.14+0xe/0x40
[ 12.919914] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0
[ 12.919968] [<ffffffff83a5077c>] ret_from_fork+0x7c/0x90
[ 12.919973] [<ffffffff81138e00>] ? flush_kthread_work+0x1f0/0x1f0
[ 12.920161] Code: 83 ec 08 f6 05 ff 58 44 02 04 74 1b 8b 4f 10 48 89 fa 48 c7 c6 d9 d7 d4 84 48 c7 c7 80 9e aa 85 31 c0 e8 80
ac 3a fe 48 8d 7b 10 <f0> 83 6b 10 01 0f 94 c0 84 c0 74 05 e8 8b e0 ff ff 48 83 c4 08
[ 12.920165] RIP [<ffffffff836645c4>] l2cap_chan_put+0x34/0x50
[ 12.920166] RSP <ffff880066933c38>
[ 12.920167] CR2: 0000000000000010
[ 12.920417] ---[ end trace 5a9114e8a158ab84 ]---

Introduced in commit 61d6ef3e ("Bluetooth: Make better use of l2cap_chan
reference counting").

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
8936fa6d1c202abeb94c51c68897342e8714dd69 08-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: L2CAP: Fix using default Flush Timeout for EFS

There are two Flush Timeouts: one is old Flush Timeot Option
which is 2 octets and the second is Flush Timeout inside EFS
which is 4 octets long.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
dcc042d56f66fb2a9db6a2683e6aa4815782da8b 05-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use block_mtu for AMP controller

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
a0c234fe8972aa6a5afe2db6c27a3f5d5fbd88e7 05-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Factor out phylink_add

Add direction parameter to phylink_add since it is anyway set later.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
fa4ebc66c432d0e0ec947cb754d4144c4a681f28 05-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Factor out amp_ctrl_add

Add ctrl_id parameter to amp_ctrl_add since we always set it
after function ctrl is created.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
85e34368dea6fc8a2d16464e01c85d3b7bd682bd 05-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix dereference after NULL check

Move code dereferencing possible NULL pointer to the check branch.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
079db0c6e3854b3af9808268f3b884fa48ed0034 05-Oct-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Fix possible NULL dereference

Check that link key exist before accessing.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
aecdc33e111b2c447b622e287c6003726daa1426 02-Oct-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking changes from David Miller:

1) GRE now works over ipv6, from Dmitry Kozlov.

2) Make SCTP more network namespace aware, from Eric Biederman.

3) TEAM driver now works with non-ethernet devices, from Jiri Pirko.

4) Make openvswitch network namespace aware, from Pravin B Shelar.

5) IPV6 NAT implementation, from Patrick McHardy.

6) Server side support for TCP Fast Open, from Jerry Chu and others.

7) Packet BPF filter supports MOD and XOR, from Eric Dumazet and Daniel
Borkmann.

8) Increate the loopback default MTU to 64K, from Eric Dumazet.

9) Use a per-task rather than per-socket page fragment allocator for
outgoing networking traffic. This benefits processes that have very
many mostly idle sockets, which is quite common.

From Eric Dumazet.

10) Use up to 32K for page fragment allocations, with fallbacks to
smaller sizes when higher order page allocations fail. Benefits are
a) less segments for driver to process b) less calls to page
allocator c) less waste of space.

From Eric Dumazet.

11) Allow GRO to be used on GRE tunnels, from Eric Dumazet.

12) VXLAN device driver, one way to handle VLAN issues such as the
limitation of 4096 VLAN IDs yet still have some level of isolation.
From Stephen Hemminger.

13) As usual there is a large boatload of driver changes, with the scale
perhaps tilted towards the wireless side this time around.

Fix up various fairly trivial conflicts, mostly caused by the user
namespace changes.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1012 commits)
hyperv: Add buffer for extended info after the RNDIS response message.
hyperv: Report actual status in receive completion packet
hyperv: Remove extra allocated space for recv_pkt_list elements
hyperv: Fix page buffer handling in rndis_filter_send_request()
hyperv: Fix the missing return value in rndis_filter_set_packet_filter()
hyperv: Fix the max_xfer_size in RNDIS initialization
vxlan: put UDP socket in correct namespace
vxlan: Depend on CONFIG_INET
sfc: Fix the reported priorities of different filter types
sfc: Remove EFX_FILTER_FLAG_RX_OVERRIDE_IP
sfc: Fix loopback self-test with separate_tx_channels=1
sfc: Fix MCDI structure field lookup
sfc: Add parentheses around use of bitfield macro arguments
sfc: Fix null function pointer in efx_sriov_channel_type
vxlan: virtual extensible lan
igmp: export symbol ip_mc_leave_group
netlink: add attributes to fdb interface
tg3: unconditionally select HWMON support when tg3 is enabled.
Revert "net: ti cpsw ethernet: allow reading phy interface mode from DT"
gre: fix sparse warning
...
3498d13b8090c0b0ef911409fbc503a7c4cca6ef 01-Oct-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge tag 'tty-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY changes from Greg Kroah-Hartman:
"As we skipped the merge window for 3.6-rc1 for the tty tree,
everything is now settled down and working properly, so we are ready
for 3.7-rc1. Here's the patchset, it's big, but the large changes are
removing a firmware file and adding a staging tty driver (it depended
on the tty core changes, so it's going through this tree instead of
the staging tree.)

All of these patches have been in the linux-next tree for a while.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

Fix up more-or-less trivial conflicts in
- drivers/char/pcmcia/synclink_cs.c:
tty NULL dereference fix vs tty_port_cts_enabled() helper function
- drivers/staging/{Kconfig,Makefile}:
add-add conflict (dgrp driver added close to other staging drivers)
- drivers/staging/ipack/devices/ipoctal.c:
"split ipoctal_channel from iopctal" vs "TTY: use tty_port_register_device"

* tag 'tty-3.6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (235 commits)
tty/serial: Add kgdb_nmi driver
tty/serial/amba-pl011: Quiesce interrupts in poll_get_char
tty/serial/amba-pl011: Implement poll_init callback
tty/serial/core: Introduce poll_init callback
kdb: Turn KGDB_KDB=n stubs into static inlines
kdb: Implement disable_nmi command
kernel/debug: Mask KGDB NMI upon entry
serial: pl011: handle corruption at high clock speeds
serial: sccnxp: Make 'default' choice in switch last
serial: sccnxp: Remove mask termios caps for SW flow control
serial: sccnxp: Report actual baudrate back to core
serial: samsung: Add poll_get_char & poll_put_char
Powerpc 8xx CPM_UART setting MAXIDL register proportionaly to baud rate
Powerpc 8xx CPM_UART maxidl should not depend on fifo size
Powerpc 8xx CPM_UART too many interrupts
Powerpc 8xx CPM_UART desynchronisation
serial: set correct baud_base for EXSYS EX-41092 Dual 16950
serial: omap: fix the reciever line error case
8250: blacklist Winbond CIR port
8250_pnp: do pnp probe before legacy probe
...
bc8dce4f7b4908bac69acac34d19b4234ba19cee 28-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Fix potential NULL dereference

Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR
controller and fixes dereference possible NULL pointer.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
a248afdc1b5916c2bfd007233112333d85aa28f6 30-Sep-2012 David S. Miller <davem@davemloft.net> Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

John W. Linville says:

====================
Here is another batch of updates intended for 3.7...

Highlights include an hci_connect re-write in Bluetooth, HCI/LLC
layer separation in NFC, removal of the raw pn544 NFC driver, NFC LLCP
raw sockets support, improved IBSS auth frame handling in mac80211,
full-MAC AP mode notification support in mac80211, a lot of attention
paid to brcmfmac, and the usual level of updates to iwlwifi, ath9k,
mwifiex, and rt2x00, and various other updates.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
6a06e5e1bb217be077e1f8ee2745b4c5b1aa02db 28-Sep-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
drivers/net/team/team.c
drivers/net/usb/qmi_wwan.c
net/batman-adv/bat_iv_ogm.c
net/ipv4/fib_frontend.c
net/ipv4/route.c
net/l2tp/l2tp_netlink.c

The team, fib_frontend, route, and l2tp_netlink conflicts were simply
overlapping changes.

qmi_wwan and bat_iv_ogm were of the "use HEAD" variety.

With help from Antonio Quartulli.

Signed-off-by: David S. Miller <davem@davemloft.net>
13465c0aeb9c56a4e4799f25aeff41d05f8a3fab 28-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Correct assoc_len size

Correct assoc_len and fix warning for x86-64 by using %zu specifier.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2e430be386e97224c37086a5a48fa05a9f9b79bb 28-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use %zu print specifier for size_t type

Correct warnings

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
c487606f835a93a725bac1aefd536be98f22474d 28-Sep-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
net/nfc/netlink.c

Signed-off-by: John W. Linville <linville@tuxdriver.com>
29d8a5909bba10accb82eb805c884a2943d7710f 20-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Factor out Create Configuration Response

Use function to factor out similar code. For BR/EDR send EFS
Configuration Response immediately, for HS response will be sent
after receiving HCI Logical Link Complete event in the following
patches.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ee22be7ef4f1d010a76fb41dc8fc687d38e606a3 20-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Factor out hci_queue_acl

Use hci_chan as parameter instead of hci_conn as we need logical
handle from hci_chan for AMP link.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
d945df256a7b2446227fafae2f89db85597412ef 24-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> bluetooth: Remove unneeded batostr function

batostr is not needed anymore since for printing Bluetooth
addresses we use %pMR specifier.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ib.c
7028a8860f07d0efc5fdd7527fec065b818d108b 24-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use %pMR instead of baswap in seq_show

Use new bluetooth address print specifier %pMR for printing
bluetooth addresses instead of dedicated variable and baswap.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
fcb73338ed531dcc00cb17ca76fe3e05f774e4e9 24-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr

Instead of old unsafe batostr function use %pMR print specifier
for printing Bluetooth addresses in sprintf and seq_printf
statements.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mtp/core.c
ci_sysfs.c
idp/core.c
2cap_core.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
6ed93dc6427d14cdfe0b272cc0a9ee4685ce9ad7 24-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use %pMR in debug instead of batostr

Instead of old unsafe batostr function use %pMR print specifier
for printing Bluetooth addresses in debug and error statements.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
nep/core.c
ci_conn.c
ci_core.c
ci_event.c
2cap_core.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
36a75f1b3ecf94dcf140b9d3d2f7a03b7e258480 18-Sep-2012 Jefferson Delfes <jefferson.delfes@openbossa.org> Bluetooth: Force the process of unpair command if disconnect failed

The unpair process tries to disconnect any connection pending with
remote. If there are some connection in connecting state, disconnect
command will fail and unpair mgmt command will stay pending.

That pending mgmt command can cause strange behavior like automatic
unpair after a lost connection.

Signed-off-by: Jefferson Delfes <jefferson.delfes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
392f44d3e7894f6fe314b85b4a1611b7b1d98226 27-Sep-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix two warnings in BT_DBG

We just need to use the right modifiers

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
ci_event.c
0b26ab9dce74f8ac77d7eef0d683ab1d527e45b1 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle Accept phylink command status evt

When receiving HCI Command Status event for Accept Physical Link
execute HCI Write Remote AMP Assoc with data saved from A2MP Create
Physical Link Request.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
ci_event.c
dffa387110025801862d7ad09f4e850d06ff55a9 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Accept Physical Link

When receiving A2MP Create Physical Link message execute HCI
Accept Physical Link command to AMP controller.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
9495b2ee757f7747d7c28f9ba8d7edc53005ec2d 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Process Chan Selected event

Channel Selected event indicates that link information data is available.
Read it with Read Local AMP Assoc command. The data shall be sent in the
A2MP Create Physical Link Request.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
ci_event.c
2766be48a7181d7f2a84831ca7e7be248fb6fdb5 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Add fallback to normal l2cap init sequence

When there is no remote AMP controller found fallback to normal
L2CAP sequence.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
93c284ee901f7d7bdd09087e92abefb7496c3777 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Write remote AMP Assoc

When receiving HCI Command Status after HCI Create Physical Link
execute HCI Write Remote AMP Assoc command to AMP controller.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
ci_event.c
a02226d6ff5098e6b97590cc55aabe7faf0860ed 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Create Physical Link

When receiving A2MP Get AMP Assoc Response execute HCI Create Physical
Link to AMP controller. Define function which will run when receiving
HCI Command Status.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
ci_event.c
5a349186692950b13896abc3fb2f491d023f95a1 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Add AMP key calculation

Function calculates AMP keys using hmac_sha256 helper. Calculated keys
are Generic AMP Link Key (gamp) and Dedicated AMP Link Key with
keyID "802b" for 802.11 PAL.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
config
mp.c
ba221bbabadd5fc2c80677b52178138fd694cc26 27-Sep-2012 Dmitry Kasatkin <dmitry.kasatkin@intel.com> Bluetooth: Add function to derive AMP key using hmac

hmac(sha256) will be used for AMP key generation.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
93c3e8f5c9a0e4dc6b6c93108dcf3ec54ab1191a 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Choose connection based on capabilities

Choose which L2CAP connection to establish by checking support
for HS and remote side supported features.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
9a5e94dbb4aa306742a47cbbcb0a44d4fc77a9e4 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Get AMP Assoc Rsp

When receiving A2MP Get AMP Assoc Response save assoc data to remote
AMP controller list and prepare for creating physical link.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
0d868de9d8760c76f6d4c6c777935c05ef272caa 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Getinfo Rsp

Process A2MP Getinfo Response, send Get AMP Assoc Req.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
cb8488c0b60a947c0ef4a1a94573a7fefd3f20b4 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Handle create / disc phylink req

Use hci_conn structure to keep track about AMP physical connections.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
52c0d6e56b634b195e377192182391d526cdd5e4 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Remote AMP ctrl definitions

Create remote AMP controllers structure. It is used to keep information
about discovered remote AMP controllers by A2MP protocol.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
mp.c
3161ae1c72f03b021bc67504c13025626c26d30c 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Physical link struct and helpers

Define physical link structures. Physical links are represented by
hci_conn structure. For BR/EDR we use type ACL_LINK and for AMP
we use AMP_LINK.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
aa09537d80bf7e6282103618eb496f03e76f2953 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process Discover Response

When receiving A2MP Discover Response send A2MP Get Info Request
for each AMP controller in the discovery list.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
903e45411099ae8292f5ce637ad0c72f6fef61db 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use HCI cmd to Read Loc AMP Assoc

When receiving A2MP Get AMP Assoc Request execute Read Local AMP Assoc
HCI command to AMP controller. If the AMP Assoc data is larger than it
can fit to HCI event only fragment is read. When all fragments are read
send A2MP Get AMP Assoc Response.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
akefile
2mp.c
mp.c
ci_event.c
8e2a0d92c56ec6955526a8b60838c9b00f70540d 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Use HCI cmd to Read AMP Info

When receiving A2MP Get Info Request execute Read Local AMP Info HCI
command to AMP controller with function to be executed upon receiving
command complete event. Function will handle A2MP Get Info Response.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
ci_event.c
f97268fccdd4e76462195216fcab621b8d4a6cd1 27-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Create amp_mgr global list

Create amp_mgr_list global list which will be used by different
hci devices to find amp_mgr.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
791ef39cd18ae2745a63c51a5dbbd23312be0744 24-Sep-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next
1199992df2417dc9a1db1b19930ea4d0a697a61e 22-Sep-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
bf5b30b8a4416de04f1ac1196281ddb318669464 21-Sep-2012 Zhao Hongjiang <zhaohongjiang@huawei.com> net: change return values from -EACCES to -EPERM

Change return value from -EACCES to -EPERM when the permission check fails.

Signed-off-by: Zhao Hongjiang <zhaohongjiang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
23b3b1330abc643e1fbb7cfffcb6947e2583cff2 06-Sep-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update management interface revision

For each kernel release where commands or events are added to the
management interface, the revision field should be increment by one.

The increment should only happen once per kernel release and not
for every command/event that gets added. The revision value is for
informational purposes only, but this simple policy would make any
future debugging a lot simple.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
92a25256f142d55e25f9959441cea6ddeabae57e 06-Sep-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Implement support for passkey notification

This patch adds support for Secure Simple Pairing with devices that have
KeyboardOnly as their IO capability. Such devices will cause a passkey
notification on our side and optionally also keypress notifications.
Without this patch some keyboards cannot be paired using the mgmt
interface.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Cc: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a 14-Sep-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix not removing power_off delayed work

For example, when a usb reset is received (I could reproduce it
running something very similar to this[1] in a loop) it could be
that the device is unregistered while the power_off delayed work
is still scheduled to run.

Backtrace:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: To Be Filled By O.E.M.
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
Call Trace:
[<ffffffff8124cc00>] ? free_obj_work+0x57/0x91
[<ffffffff81058f88>] warn_slowpath_common+0x7e/0x97
[<ffffffff81059035>] warn_slowpath_fmt+0x41/0x43
[<ffffffff8124ccb6>] debug_print_object+0x7c/0x8d
[<ffffffff8106e3ec>] ? __queue_work+0x259/0x259
[<ffffffff8124d63e>] ? debug_check_no_obj_freed+0x6f/0x1b5
[<ffffffff8124d667>] debug_check_no_obj_freed+0x98/0x1b5
[<ffffffffa00aa031>] ? bt_host_release+0x10/0x1e [bluetooth]
[<ffffffff810fc035>] kfree+0x90/0xe6
[<ffffffffa00aa031>] bt_host_release+0x10/0x1e [bluetooth]
[<ffffffff812ec2f9>] device_release+0x4a/0x7e
[<ffffffff8123ef57>] kobject_release+0x11d/0x154
[<ffffffff8123ed98>] kobject_put+0x4a/0x4f
[<ffffffff812ec0d9>] put_device+0x12/0x14
[<ffffffffa009472b>] hci_free_dev+0x22/0x26 [bluetooth]
[<ffffffffa0280dd0>] btusb_disconnect+0x96/0x9f [btusb]
[<ffffffff813581b4>] usb_unbind_interface+0x57/0x106
[<ffffffff812ef988>] __device_release_driver+0x83/0xd6
[<ffffffff812ef9fb>] device_release_driver+0x20/0x2d
[<ffffffff813582a7>] usb_driver_release_interface+0x44/0x7b
[<ffffffff81358795>] usb_forced_unbind_intf+0x45/0x4e
[<ffffffff8134f959>] usb_reset_device+0xa6/0x12e
[<ffffffff8135df86>] usbdev_do_ioctl+0x319/0xe20
[<ffffffff81203244>] ? avc_has_perm_flags+0xc9/0x12e
[<ffffffff812031a0>] ? avc_has_perm_flags+0x25/0x12e
[<ffffffff81050101>] ? do_page_fault+0x31e/0x3a1
[<ffffffff8135eaa6>] usbdev_ioctl+0x9/0xd
[<ffffffff811126b1>] vfs_ioctl+0x21/0x34
[<ffffffff81112f7b>] do_vfs_ioctl+0x408/0x44b
[<ffffffff81208d45>] ? file_has_perm+0x76/0x81
[<ffffffff8111300f>] sys_ioctl+0x51/0x76
[<ffffffff8158db22>] system_call_fastpath+0x16/0x1b

[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
aad3d0e343900a4c2c5dbc73f76550aa64a0ac1b 06-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix freeing uninitialized delayed works

When releasing L2CAP socket which is in BT_CONFIG state l2cap_chan_close
invokes l2cap_send_disconn_req which cancel delayed works which are only
set in BT_CONNECTED state with l2cap_ertm_init. Add state check before
cancelling those works.

...
[ 9668.574372] [21085] l2cap_sock_release: sock cd065200, sk f073e800
[ 9668.574399] [21085] l2cap_sock_shutdown: sock cd065200, sk f073e800
[ 9668.574411] [21085] l2cap_chan_close: chan f073ec00 state BT_CONFIG sk f073e800
[ 9668.574421] [21085] l2cap_send_disconn_req: chan f073ec00 conn ecc16600
[ 9668.574441] INFO: trying to register non-static key.
[ 9668.574443] the code is fine but needs lockdep annotation.
[ 9668.574446] turning off the locking correctness validator.
[ 9668.574450] Pid: 21085, comm: obex-client Tainted: G O 3.5.0+ #57
[ 9668.574452] Call Trace:
[ 9668.574463] [<c10a64b3>] __lock_acquire+0x12e3/0x1700
[ 9668.574468] [<c10a44fb>] ? trace_hardirqs_on+0xb/0x10
[ 9668.574476] [<c15e4f60>] ? printk+0x4d/0x4f
[ 9668.574479] [<c10a6e38>] lock_acquire+0x88/0x130
[ 9668.574487] [<c1059740>] ? try_to_del_timer_sync+0x60/0x60
[ 9668.574491] [<c1059790>] del_timer_sync+0x50/0xc0
[ 9668.574495] [<c1059740>] ? try_to_del_timer_sync+0x60/0x60
[ 9668.574515] [<f8aa1c23>] l2cap_send_disconn_req+0xe3/0x160 [bluetooth]
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
562fcc246ebe31ade6e1be08585673b9b2785498 29-Aug-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: mgmt: Fix enabling LE while powered off

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
write changes to controller. As a result it's not possible to start device
discovery session on LE controller as it uses interleaved discovery which
requires LE Supported Host flag in extended features.

This patch ensures HCI Write LE Host Supported is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Cc: stable@vger.kernel.org
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 29-Aug-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: mgmt: Fix enabling SSP while powered off

When new BT USB adapter is plugged in it's configured while still being powered
off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
write changes to controller. As a result remote devices won't use Secure Simple
Pairing with our device due to SSP Host Support flag disabled in extended
features and may also reject SSP attempt from our side (with possible fallback
to legacy pairing).

This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
called to power on controller and clear HCI_AUTO_OFF flag.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Cc: stable@vger.kernel.org
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
7ac3c93e5dd74486ca4f8f0b02ae55182658d2e5 17-Sep-2012 Greg Kroah-Hartman <gregkh@linuxfoundation.org> Merge 3.6-rc6 into tty-next

This pulls in the fixes in 3.6-rc6

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
b48b63a1f6e26b0dec2c9f1690396ed4bcb66903 15-Sep-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
net/netfilter/nfnetlink_log.c
net/netfilter/xt_LOG.c

Rather easy conflict resolution, the 'net' tree had bug fixes to make
sure we checked if a socket is a time-wait one or not and elide the
logging code if so.

Whereas on the 'net-next' side we are calculating the UID and GID from
the creds using different interfaces due to the user namespace changes
from Eric Biederman.

Signed-off-by: David S. Miller <davem@davemloft.net>
e71dfabab03129182a955663cbd53406714d96c0 06-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: Add Read Data Block Size to amp_init

Add Read Data Block Size HCI cmd to AMP initialization, then it
makes possible to send data.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
93f71941c6d3ead73ca74d447b4007c6908f6eb5 06-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Remove empty line

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
9472007c62ecc8f21daa2e1e252bf73b67e535fc 06-Sep-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Make hci_chan_del return void

Return code is not needed in hci_chan_del

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
6b536b5e5e1da32f3ba1e3f42c7bf2f80d37dc6b 31-Aug-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded zero init

hdev is allocated with kzalloc so zero initialization is not needed.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
fac805f8c198092de9a2842efd7f5022e2937b18 07-Sep-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
777bf135b77071672662c67f0abffcf433450d68 07-Sep-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

John W. Linville says:

====================
Please pull these fixes intended for 3.6. There are more commits
here than I would like -- I got a bit behind while I was stalking
Steven Rostedt in San Diego last week... I'll slow it down after this!

There are a couple of pulls here. One is from Johannes:

"Please pull (according to the below information) to get a few fixes.

* a fix to properly disconnect in the driver when authentication or
association fails
* a fix to prevent invalid information about mesh paths being reported
to userspace
* a memory leak fix in an nl80211 error path"

The other comes via Gustavo:

"A few updates for the 3.6 kernel. There are two btusb patches to add
more supported devices through the new USB_VENDOR_AND_INTEFACE_INFO()
macro and another one that add a new device id for a Sony Vaio laptop,
one fix for a user-after-free and, finally, two patches from Vinicius
to fix a issue in SMP pairing."

Along with those...

Arend van Spriel provides a fix for a use-after-free bug in brcmfmac.

Daniel Drake avoids a hang by not trying to touch the libertas hardware
duing suspend if it is already powered-down.

Felix Fietkau provides a batch of ath9k fixes that adress some
potential problems with power settings, as well as a fix to avoid a
potential interrupt storm.

Gertjan van Wingerde provides a register-width fix for rt2x00, and
a rt2x00 fix to prevent incorrectly detecting the rfkill status.
He also provides a device ID patch.

Hante Meuleman gives us three brcmfmac fixes, one that properly
initializes a command structure, one that fixes a race condition that
could lose usb requests, and one that removes some log spam.

Marc Kleine-Budde offers an rt2x00 fix for a voltage setting on some
specific devices.

Mohammed Shafi Shajakhan sent an ath9k fix to avoid a crash related to
using timers that aren't allocated when 2 wire bluetooth coexistence
hardware is in use.

Sergei Poselenov changes rt2800usb to do some validity checking for
received packets, avoiding crashes on an ARM Soc.

Stone Piao gives us an mwifiex fix for an incorrectly set skb length
value for a command buffer.

All of these are localized to their specific drivers, and relatively
small. The power-related patches from Felix are bigger than I would
like, but I merged them in consideration of their isolation to ath9k
and the sensitive nature of power settings in wireless devices.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
d8343f125710fb596f7a88cd756679f14f4e77b9 24-Aug-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix sending a HCI Authorization Request over LE links

In the case that the link is already in the connected state and a
Pairing request arrives from the mgmt interface, hci_conn_security()
would be called but it was not considering LE links.

Reported-by: João Paulo Rechi Vita <jprvita@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
cc110922da7e902b62d18641a370fec01a9fa794 24-Aug-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Change signature of smp_conn_security()

To make it clear that it may be called from contexts that may not have
any knowledge of L2CAP, we change the connection parameter, to receive
a hci_conn.

This also makes it clear that it is checking the security of the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
mp.c
e372dc6c62bf0246a07f3291a26c562cc8659fbd 27-Aug-2012 Greg Kroah-Hartman <gregkh@linuxfoundation.org> Merge 3.6-rc3 into tty-next

This picks up all of the different fixes in Linus's tree that we also need here.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1304a7343b30fc4f16045412efdbb4179a3d9255 22-Aug-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
f91c8468df97d0ac18132eb38283524a74317901 18-Aug-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix establishing ESCO links

Commit 4cd2d98340b4f03d5532c30fdaeb451b035429cb "Bluetooth: Simplify
the connection type handling" broke the creation of ESCO links.

This patch adds a type parameter to hci_connect_sco() so it creates
the connection of the right kind.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
144ad33020a0af66fbb188ef3f13ca91c5326a69 27-Jul-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Use kref for l2cap channel reference counting

This patch changes the struct l2cap_chan and associated code to use
kref api for object refcounting and freeing.

Suggested-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ab19516a50b375c11b9fa442954a43454a730950 27-Jul-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: debug: Correct the PSM printing

Earlier we were printing chan->psm before assigning any value.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
f0d6a0ea330617454032d6e2ed48759858a44427 09-Aug-2012 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: mgmt: Add device disconnect reason

MGMT_EV_DEVICE_DISCONNECTED will now expose the disconnection reason to
userland, distinguishing four possible values:

0x00 Reason not known or unspecified
0x01 Connection timeout
0x02 Connection terminated by local host
0x03 Connection terminated by remote host

Note that the local/remote distinction just determines which side
terminated the low-level connection, regardless of the disconnection of
the higher-level profiles.

This can sometimes be misleading and thus must be used with care. For
example, some hardware combinations would report a locally initiated
disconnection even if the user turned Bluetooth off in the remote side.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
fa1bd91809d58b3c183611556219fafd93c08625 09-Aug-2012 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Fix minor coding style in hci_event.c

Replace the status checks with the short form of the boolean expression.

Signed-off-by: Mikel Astiz <mikel.astiz@bmw-carit.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
31f470738bf9fefc9399a45710c74322121119ac 07-Aug-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Use preferred method for NULL check

Use standard bluetooth way to check NULL pointer !var instead of
var == NULL.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
792039c73cf176c8e39a6e8beef2c94ff46522ed 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: L2CAP - Fix info leak via getsockname()

The L2CAP code fails to initialize the l2_bdaddr_type member of struct
sockaddr_l2 and the padding byte added for alignment. It that for leaks
two bytes kernel stack via the getsockname() syscall. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_sock.c
9344a972961d1a6d2c04d9008b13617bcb6ec2ef 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: RFCOMM - Fix info leak via getsockname()

The RFCOMM code fails to initialize the trailing padding byte of struct
sockaddr_rc added for alignment. It that for leaks one byte kernel stack
via the getsockname() syscall. Add an explicit memset(0) before filling
the structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)

The RFCOMM code fails to initialize the two padding bytes of struct
rfcomm_dev_list_req inserted for alignment before copying it to
userland. Additionally there are two padding bytes in each instance of
struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
dev_num times two bytes uninitialized kernel heap memory.

Allocate the memory using kzalloc() to fix this issue.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
9ad2de43f1aee7e7274a4e0d41465489299e344b 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)

The RFCOMM code fails to initialize the key_size member of struct
bt_security before copying it to userland -- that for leaking one
byte kernel stack. Initialize key_size with 0 to avoid the info
leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
3f68ba07b1da811bf383b4b701b129bfcb2e4988 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: HCI - Fix info leak via getsockname()

The HCI code fails to initialize the hci_channel member of struct
sockaddr_hci and that for leaks two bytes kernel stack via the
getsockname() syscall. Initialize hci_channel with 0 to avoid the
info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
e15ca9a0ef9a86f0477530b0f44a725d67f889ee 15-Aug-2012 Mathias Krause <minipli@googlemail.com> Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)

The HCI code fails to initialize the two padding bytes of struct
hci_ufilter before copying it to userland -- that for leaking two
bytes kernel stack. Add an explicit memset(0) before filling the
structure to avoid the info leak.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo Padovan <gustavo@padovan.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
09d5d4aa647367eeb42352a2bc9d438b9c703670 07-Aug-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Shorten variable scope

Make code more clear by moving sk and bt vars to the place where
they are actually used.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
61a0cfb008f57ecf7eb28ee762952fb42dc15d15 02-Aug-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix use-after-free bug in SMP

If SMP fails, we should always cancel security_timer delayed work.
Otherwise, security_timer function may run after l2cap_conn object
has been freed.

This patch fixes the following warning reported by ODEBUG:

WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
Hardware name: Bochs
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x27
Modules linked in: btusb bluetooth
Pid: 440, comm: kworker/u:2 Not tainted 3.5.0-rc1+ #4
Call Trace:
[<ffffffff81174600>] ? free_obj_work+0x4a/0x7f
[<ffffffff81023eb8>] warn_slowpath_common+0x7e/0x97
[<ffffffff81023f65>] warn_slowpath_fmt+0x41/0x43
[<ffffffff811746b1>] debug_print_object+0x7c/0x8d
[<ffffffff810394f0>] ? __queue_work+0x241/0x241
[<ffffffff81174fdd>] debug_check_no_obj_freed+0x92/0x159
[<ffffffff810ac08e>] slab_free_hook+0x6f/0x77
[<ffffffffa0019145>] ? l2cap_conn_del+0x148/0x157 [bluetooth]
[<ffffffff810ae408>] kfree+0x59/0xac
[<ffffffffa0019145>] l2cap_conn_del+0x148/0x157 [bluetooth]
[<ffffffffa001b9a2>] l2cap_recv_frame+0xa77/0xfa4 [bluetooth]
[<ffffffff810592f9>] ? trace_hardirqs_on_caller+0x112/0x1ad
[<ffffffffa001c86c>] l2cap_recv_acldata+0xe2/0x264 [bluetooth]
[<ffffffffa0002b2f>] hci_rx_work+0x235/0x33c [bluetooth]
[<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
[<ffffffff81038e22>] process_one_work+0x185/0x2fe
[<ffffffff81038dc3>] ? process_one_work+0x126/0x2fe
[<ffffffff81059f2e>] ? lock_acquired+0x1b5/0x1cf
[<ffffffffa00028fa>] ? le_scan_work+0x11d/0x11d [bluetooth]
[<ffffffff81036fb6>] ? spin_lock_irq+0x9/0xb
[<ffffffff81039209>] worker_thread+0xcf/0x175
[<ffffffff8103913a>] ? rescuer_thread+0x175/0x175
[<ffffffff8103cfe0>] kthread+0x95/0x9d
[<ffffffff812c5054>] kernel_threadi_helper+0x4/0x10
[<ffffffff812c36b0>] ? retint_restore_args+0x13/0x13
[<ffffffff8103cf4b>] ? flush_kthread_worker+0xdb/0xdb
[<ffffffff812c5050>] ? gs_change+0x13/0x13

This bug can be reproduced using hctool lecc or l2test tools and
bluetoothd not running.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
e6dd548b9a3c7b3fcdd2fd97880abf7597e8334b 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add type information to the hci_connect() debug statement

Now that we have a "connect" function for each link type, we should be
able to indentify which function is going to be called.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
4cd2d98340b4f03d5532c30fdaeb451b035429cb 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Simplify a the connection type handling

Now that we have separate ways of doing connections for each link type,
we can do better than an "if" statement to handle each link type.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
b7d839bfff78a01705f3d7b0acd5257dc7b067c9 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Refactor SCO connection into its own function

We can do the same that we did for the other link types, for SCO
connections. The only thing that's worth noting is that as SCO
links need an ACL link, this functions uses the function that adds
an ACL link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
db4742756ae2a836618cd5acf599522573589149 29-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Refactor ACL connection into its own function

The hci_connect() function was starting to get too complicated to be
quickly understood. We can separate the creation of a new ACL
connection into its own function.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
d04aef4cccf203fdfd1716e9ba458060cbab0928 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Refactor LE connection into its own function

The code that handles LE connection is already quite separated from
the rest of the connection procedure, so we can easily put it into
its own.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
1aef866968223ddfd7268457b642a9233f0b8006 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Rename LE and ACL connection functions

These names were causing much confusion, so we rename these functions
that send HCI commands to be more similar in naming to the actual HCI
commands that will be sent.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
57f5d0d1d9f8e59819cb0ab4b707364c54b5b2d1 28-Jul-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Remove some functions from being exported

Some connection related functions are only used inside hci_conn.c
so no need to have them exported.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
734cc1783816ae358cef45673a29bf7af974e147 07-Aug-2012 Jiri Slaby <jslaby@suse.cz> TTY: use tty_port_register_device

Currently we have no way to assign tty->port while performing tty
installation. There are two ways to provide the link tty_struct =>
tty_port. Either by calling tty_port_install from tty->ops->install or
tty_port_register_device called instead of tty_register_device when
the device is being set up after connected.

In this patch we modify most of the drivers to do the latter. When the
drivers use tty_register_device and we have tty_port already, we
switch to tty_port_register_device. So we have the tty_struct =>
tty_port link for free for those.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
89c8d91e31f267703e365593f6bfebb9f6d2ad01 08-Aug-2012 Alan Cox <alan@linux.intel.com> tty: localise the lock

The termios and other changes mean the other protections needed on the driver
tty arrays should be adequate. Turn it all back on.

This contains pieces folded in from the fixes made to the original patches

| From: Geert Uytterhoeven <geert@linux-m68k.org> (fix m68k)
| From: Paul Gortmaker <paul.gortmaker@windriver.com> (fix cris)
| From: Jiri Kosina <jkosina@suze.cz> (lockdep)
| From: Eric Dumazet <eric.dumazet@gmail.com> (lockdep)

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
49dfbb9129c4edb318578de35cc45c555df37884 18-Jul-2012 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Fix socket not getting freed if l2cap channel create fails

If l2cap_chan_create() fails then it will return from l2cap_sock_kill
since zapped flag of sk is reset.

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
d08fd0e712a834d4abb869c0215a702e290bc51e 19-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: smp: Fix possible NULL dereference

smp_chan_create might return NULL so we need to check before
dereferencing smp.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
c3e7c0d90b14a3e7ac091d24cef09efb516d587b 19-Jul-2012 Ram Malovany <ramm@ti.com> Bluetooth: Set name_state to unknown when entry name is empty

When the name of the given entry is empty , the state needs to be
updated accordingly.

Cc: stable@vger.kernel.org
Signed-off-by: Ram Malovany <ramm@ti.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
7cc8380eb10347016d95bf6f9d842c2ae6d12932 19-Jul-2012 Ram Malovany <ramm@ti.com> Bluetooth: Fix using a NULL inquiry cache entry

If the device was not found in a list of found devices names of which
are pending.This may happen in a case when HCI Remote Name Request
was sent as a part of incoming connection establishment procedure.
Hence there is no need to continue resolving a next name as it will
be done upon receiving another Remote Name Request Complete Event.
This will fix a kernel crash when trying to use this entry to resolve
the next name.

Cc: stable@vger.kernel.org
Signed-off-by: Ram Malovany <ramm@ti.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
c810089c27e48b816181b454fcc493d19fdbc2ba 19-Jul-2012 Ram Malovany <ramm@ti.com> Bluetooth: Fix using NULL inquiry entry

If entry wasn't found in the hci_inquiry_cache_lookup_resolve do not
resolve the name.This will fix a kernel crash when trying to use NULL
pointer.

Cc: stable@vger.kernel.org
Signed-off-by: Ram Malovany <ramm@ti.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
a9ea3ed9b71cc3271dd59e76f65748adcaa76422 19-Jul-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix legacy pairing with some devices

Some devices e.g. some Android based phones don't do SDP search before
pairing and cancel legacy pairing when ACL is disconnected.

PIN Code Request event which changes ACL timeout to HCI_PAIRING_TIMEOUT
is only received after remote user entered PIN.

In that case no L2CAP is connected so default HCI_DISCONN_TIMEOUT
(2 seconds) is being used to timeout ACL connection. This results in
problems with legacy pairing as remote user has only few seconds to
enter PIN before ACL is disconnected.

Increase disconnect timeout for incomming connection to
HCI_PAIRING_TIMEOUT if SSP is disabled and no linkey exists.

To avoid keeping ACL alive for too long after SDP search set ACL
timeout back to HCI_DISCONN_TIMEOUT when L2CAP is connected.

2012-07-19 13:24:43.413521 < HCI Command: Create Connection (0x01|0x0005) plen 13
bdaddr 00:02:72:D6:6A:3F ptype 0xcc18 rswitch 0x01 clkoffset 0x0000
Packet type: DM1 DM3 DM5 DH1 DH3 DH5
2012-07-19 13:24:43.425224 > HCI Event: Command Status (0x0f) plen 4
Create Connection (0x01|0x0005) status 0x00 ncmd 1
2012-07-19 13:24:43.885222 > HCI Event: Role Change (0x12) plen 8
status 0x00 bdaddr 00:02:72:D6:6A:3F role 0x01
Role: Slave
2012-07-19 13:24:44.054221 > HCI Event: Connect Complete (0x03) plen 11
status 0x00 handle 42 bdaddr 00:02:72:D6:6A:3F type ACL encrypt 0x00
2012-07-19 13:24:44.054313 < HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
handle 42
2012-07-19 13:24:44.055176 > HCI Event: Page Scan Repetition Mode Change (0x20) plen 7
bdaddr 00:02:72:D6:6A:3F mode 0
2012-07-19 13:24:44.056217 > HCI Event: Max Slots Change (0x1b) plen 3
handle 42 slots 5
2012-07-19 13:24:44.059218 > HCI Event: Command Status (0x0f) plen 4
Read Remote Supported Features (0x01|0x001b) status 0x00 ncmd 0
2012-07-19 13:24:44.062192 > HCI Event: Command Status (0x0f) plen 4
Unknown (0x00|0x0000) status 0x00 ncmd 1
2012-07-19 13:24:44.067219 > HCI Event: Read Remote Supported Features (0x0b) plen 11
status 0x00 handle 42
Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
2012-07-19 13:24:44.067248 < HCI Command: Read Remote Extended Features (0x01|0x001c) plen 3
handle 42 page 1
2012-07-19 13:24:44.071217 > HCI Event: Command Status (0x0f) plen 4
Read Remote Extended Features (0x01|0x001c) status 0x00 ncmd 1
2012-07-19 13:24:44.076218 > HCI Event: Read Remote Extended Features (0x23) plen 13
status 0x00 handle 42 page 1 max 1
Features: 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00
2012-07-19 13:24:44.076249 < HCI Command: Remote Name Request (0x01|0x0019) plen 10
bdaddr 00:02:72:D6:6A:3F mode 2 clkoffset 0x0000
2012-07-19 13:24:44.081218 > HCI Event: Command Status (0x0f) plen 4
Remote Name Request (0x01|0x0019) status 0x00 ncmd 1
2012-07-19 13:24:44.105214 > HCI Event: Remote Name Req Complete (0x07) plen 255
status 0x00 bdaddr 00:02:72:D6:6A:3F name 'uw000951-0'
2012-07-19 13:24:44.105284 < HCI Command: Authentication Requested (0x01|0x0011) plen 2
handle 42
2012-07-19 13:24:44.111207 > HCI Event: Command Status (0x0f) plen 4
Authentication Requested (0x01|0x0011) status 0x00 ncmd 1
2012-07-19 13:24:44.112220 > HCI Event: Link Key Request (0x17) plen 6
bdaddr 00:02:72:D6:6A:3F
2012-07-19 13:24:44.112249 < HCI Command: Link Key Request Negative Reply (0x01|0x000c) plen 6
bdaddr 00:02:72:D6:6A:3F
2012-07-19 13:24:44.115215 > HCI Event: Command Complete (0x0e) plen 10
Link Key Request Negative Reply (0x01|0x000c) ncmd 1
status 0x00 bdaddr 00:02:72:D6:6A:3F
2012-07-19 13:24:44.116215 > HCI Event: PIN Code Request (0x16) plen 6
bdaddr 00:02:72:D6:6A:3F
2012-07-19 13:24:48.099184 > HCI Event: Auth Complete (0x06) plen 3
status 0x13 handle 42
Error: Remote User Terminated Connection
2012-07-19 13:24:48.179182 > HCI Event: Disconn Complete (0x05) plen 4
status 0x00 handle 42 reason 0x13
Reason: Remote User Terminated Connection

Cc: stable@vger.kernel.org
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
2cap_core.c
269c4845d5b3627b95b1934107251bacbe99bb68 15-Jun-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix possible deadlock in SCO code

sco_chan_del() only has conn != NULL when called from sco_conn_del() so
just move the code from it that deal with conn to sco_conn_del().

[ 120.765529]
[ 120.765529] ======================================================
[ 120.766529] [ INFO: possible circular locking dependency detected ]
[ 120.766529] 3.5.0-rc1-10292-g3701f94-dirty #70 Tainted: G W
[ 120.766529] -------------------------------------------------------
[ 120.766529] kworker/u:3/1497 is trying to acquire lock:
[ 120.766529] (&(&conn->lock)->rlock#2){+.+...}, at:
[<ffffffffa00b7ecc>] sco_chan_del+0x4c/0x170 [bluetooth]
[ 120.766529]
[ 120.766529] but task is already holding lock:
[ 120.766529] (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at:
[<ffffffffa00b8401>] sco_conn_del+0x61/0xe0 [bluetooth]
[ 120.766529]
[ 120.766529] which lock already depends on the new lock.
[ 120.766529]
[ 120.766529]
[ 120.766529] the existing dependency chain (in reverse order) is:
[ 120.766529]
[ 120.766529] -> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[ 120.766529] [<ffffffff8107980e>] lock_acquire+0x8e/0xb0
[ 120.766529] [<ffffffff813c19e0>] _raw_spin_lock+0x40/0x80
[ 120.766529] [<ffffffffa00b85e9>] sco_connect_cfm+0x79/0x300
[bluetooth]
[ 120.766529] [<ffffffffa0094b13>]
hci_sync_conn_complete_evt.isra.90+0x343/0x400 [bluetooth]
[ 120.766529] [<ffffffffa009d447>] hci_event_packet+0x317/0xfb0
[bluetooth]
[ 120.766529] [<ffffffffa008aa68>] hci_rx_work+0x2c8/0x890
[bluetooth]
[ 120.766529] [<ffffffff81047db7>] process_one_work+0x197/0x460
[ 120.766529] [<ffffffff810489d6>] worker_thread+0x126/0x2d0
[ 120.766529] [<ffffffff8104ee4d>] kthread+0x9d/0xb0
[ 120.766529] [<ffffffff813c4294>] kernel_thread_helper+0x4/0x10
[ 120.766529]
[ 120.766529] -> #0 (&(&conn->lock)->rlock#2){+.+...}:
[ 120.766529] [<ffffffff81078a8a>] __lock_acquire+0x154a/0x1d30
[ 120.766529] [<ffffffff8107980e>] lock_acquire+0x8e/0xb0
[ 120.766529] [<ffffffff813c19e0>] _raw_spin_lock+0x40/0x80
[ 120.766529] [<ffffffffa00b7ecc>] sco_chan_del+0x4c/0x170
[bluetooth]
[ 120.766529] [<ffffffffa00b8414>] sco_conn_del+0x74/0xe0
[bluetooth]
[ 120.766529] [<ffffffffa00b88a2>] sco_disconn_cfm+0x32/0x60
[bluetooth]
[ 120.766529] [<ffffffffa0093a82>]
hci_disconn_complete_evt.isra.53+0x242/0x390 [bluetooth]
[ 120.766529] [<ffffffffa009d747>] hci_event_packet+0x617/0xfb0
[bluetooth]
[ 120.766529] [<ffffffffa008aa68>] hci_rx_work+0x2c8/0x890
[bluetooth]
[ 120.766529] [<ffffffff81047db7>] process_one_work+0x197/0x460
[ 120.766529] [<ffffffff810489d6>] worker_thread+0x126/0x2d0
[ 120.766529] [<ffffffff8104ee4d>] kthread+0x9d/0xb0
[ 120.766529] [<ffffffff813c4294>] kernel_thread_helper+0x4/0x10
[ 120.766529]
[ 120.766529] other info that might help us debug this:
[ 120.766529]
[ 120.766529] Possible unsafe locking scenario:
[ 120.766529]
[ 120.766529] CPU0 CPU1
[ 120.766529] ---- ----
[ 120.766529] lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
[ 120.766529]
lock(&(&conn->lock)->rlock#2);
[ 120.766529]
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
[ 120.766529] lock(&(&conn->lock)->rlock#2);
[ 120.766529]
[ 120.766529] *** DEADLOCK ***

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
cd17decbd9af41c9548bb108ccf156519f8253ec 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor in hci_le_conn_complete_evt

This patch moves the hci_conn check to begining of hci_le_conn_
complete_evt in order to improve code's readability and better
error handling.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
b47a09b33a4612ace2958996ce6e0134be23d043 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Lookup hci_conn in hci_le_conn_complete_evt

This patch does a trivial code refactoring in hci_conn lookup in
hci_le_conn_complete_evt. It performs the hci_conn lookup at the
begining of the function since it is used by both flows (error
and success).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
0c95ab78be36e56ca69e36bc679f9dfd3d25f31e 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Find hci_conn by BT_CONNECT state

This patch changes hci_cs_le_create_conn to perform hci_conn lookup
by state instead of bdaddr.

Since we can have only one LE connection in BT_CONNECT state, we can
perform LE hci_conn lookup by state. This way, we don't rely on
hci_sent_cmd_data helper to find the hci_conn object.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
f00a06ac14becc3d78fecdf2513cc23ee267a96b 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor hci_cs_le_create_conn

This patch does some code refactoring in hci_cs_le_create_conn
function. The hci_conn object is only needed in case of failure,
therefore hdev locking and hci_conn lookup were moved to
if-statement scope.

Also, the conn->state check was removed since we should always
close the connection if it fails.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
847012c5e04544aef485dfec29c1c07dc90615a4 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unneeded code

This patch removes some unneeded code from hci_cs_le_create_conn.

If the hci_conn is not found, it means this LE connection attempt
was triggered by a thrid-party tool (e.g. hcitool). We should not
create this new hci_conn in LE Create Connection command status
event since it is already properly handled in LE Connection
Complete event.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
b9b343d25484bbceaee454ab422daafb1c5eda96 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix hci_le_conn_complete_evt

We need to check the 'Role' parameter from the LE Connection
Complete Event in order to properly set 'out' and 'link_mode'
fields from hci_conn structure.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
230fd16a2333fef9c012b054a127c7d157f7a7af 27-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Trivial refactoring

This patch replaces the unlock-and-return statements by the goto
statement.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
de9b9212c7fd3e87608194f1c73fc06cd6cc7dfb 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/sco via bt_procfs_init()

Added /proc/net/sco via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
co.c
c6f5df16a2710e64090078dfbaa86c54a27c0874 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/rfcomm via bt_procfs_init()

Added /proc/net/rfcomm via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
fcomm/sock.c
5b28d95c13e876037d2c692e61862bb3e98249af 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/l2cap via bt_procfs_init()

Added /proc/net/l2cap via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
5c6ad8eee0a8c5fb4ba8b741008490da9eb66af6 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/hidp via bt_procfs_init()

Added /proc/net/hidp via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/sock.c
f7c8663789038c4bc71b81e3c858a35c999347a8 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/hci via bt_procfs_init()

Added /proc/net/hci via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_sock.c
8c8de589cedd375934d96e073d2b9077a00f10c2 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/cmtp via bt_procfs_init()

Added /proc/net/cmtp via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mtp/sock.c
77cf5585a31fdad48c16ddae9be154f5afe22c1c 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: Added /proc/net/bnep via bt_procfs_init()

Added /proc/net/bnep via bt_procfs_init().

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
nep/sock.c
256a06c8a85df676e80263af349daad1283e529e 25-Jul-2012 Masatake YAMATO <yamato@redhat.com> Bluetooth: /proc/net/ entries for bluetooth protocols

lsof command can tell the type of socket processes are using.
Internal lsof uses inode numbers on socket fs to resolve the type of
sockets. Files under /proc/net/, such as tcp, udp, unix, etc provides
such inode information.

Unfortunately bluetooth related protocols don't provide such inode
information. This patch series introduces /proc/net files for the protocols.

This patch against af_bluetooth.c provides facility to the implementation
of protocols. This patch extends bt_sock_list and introduces two exported
function bt_procfs_init, bt_procfs_cleanup.

The type bt_sock_list is already used in some of implementation of
protocols. bt_procfs_init prepare seq_operations which converts
protocol own bt_sock_list data to protocol own proc entry when the
entry is accessed.

What I, lsof user, need is just inode number of bluetooth
socket. However, people may want more information. The bt_procfs_init
takes a function pointer for customizing the show handler of
seq_operations.

In v4 patch, __acquires and __releases attributes are added to suppress
sparse warning. Suggested by Andrei Emeltchenko.

In v5 patch, linux/proc_fs.h is included to use PDE. Build error is
reported by Fengguang Wu.

Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
4af66c691f4e5c2db9bb00793669a548e9db1974 13-Jul-2012 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Free the l2cap channel list only when refcount is zero

Move the l2cap channel list chan->global_l under the refcnt
protection and free it based on the refcnt.

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Reviewed-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
2cap_sock.c
3064837289259843310b266a9422aca5f5b4b9c7 13-Jul-2012 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Move l2cap_chan_hold/put to l2cap_core.c

Refactor the code in order to use the l2cap_chan_destroy()
from l2cap_chan_put() under the refcnt protection.

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Reviewed-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ee72d150ada90d33cc6e222fbdd7f980c16d974d 23-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove locking in hci_user_passkey_request_evt

This patch removes hdev locking in hci_user_passkey_request_evt
since it is not needed. mgmt_user_passkey_request simply calls
mgmt_event which does not require hdev locking at all.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
9e66463127ff7238020c3c4e7f84dfbc23e5c2b5 24-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Make connect / disconnect cfm functions return void

Return values are never used because callers hci_proto_connect_cfm
and hci_proto_disconn_cfm return void.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
co.c
c58e810eb0916f9197378435af72136fb7c97f43 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_no_flush_capable where applicable

This patch replaces all LMP_NO_FLUSH bit checking by the helper
macro lmp_no_flush_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
999dcd10a88243ab304966a506b4975ce5f1e3bb 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_sniffsubr_capable where applicable

This patch replaces all LMP_SNIFF_SUBR bit checking by the helper
macro lmp_sniffsubr_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
6eded1004abb060fbdf69611abc560c717f2bb8b 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_sniff_capable where applicable

This patch replaces all LMP_SNIFF bit checking by the helper macro
lmp_sniff_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
9f92ebf6c72de444801ab4a922965bd1f90834ae 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_rswitch_capable where applicable

This patch replaces all LMP_RSWITCH bit checking by the helper macro
lmp_rswitch_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
45db810fb71a94926c10f4dbbb5ca7913983f83b 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_esco_capable where applicable

This patch replaces all LMP_ESCO bit checking by the helper macro
lmp_esco_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
9a1a1996d54a92cae2affa1de689cb04ebe7bce1 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_ssp_capable where applicable

This patch replaces all LMP_SIMPLE_PAIR bit checking by the helper
macro lmp_ssp_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
c383ddc481a1774702473b4bb0d2927aab3f2d5a 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_le_capable where applicable

This patch replaces all LMP_LE bit checking by the helper macro
lmp_le_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
gmt.c
ed3fa31f35896b42c54333edabf0a9e986fa952c 24-Jul-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use lmp_bredr_capable where applicable

This patch replaces all LMP_NO_BREDR bit checking by the helper
macro lmp_bredr_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
78eb2f985c17eab34a0ef919b3263d6b08064e98 19-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix processing A2MP chan in security_cfm

Do not process A2MP channel in l2cap_security_cfm

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d9fc1d54f6f8123909cdee4fa98ab1ebf6c8651c 19-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Do not shadow hdr variable

Fix compile warnings below:

...
net/bluetooth/a2mp.c:505:33: warning: symbol 'hdr' shadows an earlier one
net/bluetooth/a2mp.c:498:25: originally declared here
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
8e8c7e36fb216d2d072116de3bec6130627ad691 19-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Fix printing A2MP cmd code format

Print A2MP code format according to Bluetooth style.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
bb4b2a9ae38ef3bac69627f35e4f916752631fd1 19-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: mgmt: Managing only BR/EDR HCI controllers

Add check that HCI controller is BR/EDR. AMP controller shall not be
managed by mgmt interface and consequently user space.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
gmt.c
c87985a3ce723995fc7b25e598238d67154108a1 06-Aug-2012 Greg Kroah-Hartman <gregkh@linuxfoundation.org> Merge tty-next into 3.6-rc1

This handles the merge issue in:
arch/um/drivers/line.c
arch/um/drivers/line.h
And resolves the duplicate patches that were in both trees do to the
tty-next branch not getting merged into 3.6-rc1.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
90b90f60c4f8e3a8525dfeb4aec46a9c7a29c857 20-Jul-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem
adc8d746caa67fff4b53ba3e5163a6cbacc3b523 14-Jul-2012 Alan Cox <alan@linux.intel.com> tty: move the termios object into the tty

This will let us sort out a whole pile of tty related races. The
alternative would be to keep points and refcount the termios objects.
However
1. They are tiny anyway
2. Many devices don't use the stored copies
3. We can remove a pty special case

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
6d31a88cb2e01d46c0cb74aa5da529e1f92ae3db 14-Jul-2012 Alan Cox <alan@linux.intel.com> tty: revert incorrectly applied lock patch

I sent GregKH this after the pre-requisites. He dropped the pre-requesites
for good reason and unfortunately then applied this patch. Without this
reverted you get random kernel memory corruption which will make bisecting
anything between it and the properly applied patches a complete sod.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
467a3ca5cab64a16b5ec46ebb1895c84c280dcfe 16-Jul-2012 Greg Kroah-Hartman <gregkh@linuxfoundation.org> Merge branch 'v3.6-rc7' into tty-next

This is to sync up on Linus's branch to get the other tty and core changes.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
83ce9a06b5307c8d759ddd8e4f49e2495fb321f7 28-Jun-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Change page scan interval in fast connectable mode

This patch is based on a user space (hciops) patch which never made it
upstream but does make sense to include in the mgmt part of the kernel.

(User space) commit message from Dmitriy Paliy:
"
Page scan interval in fast connectable mode is changed from 22.5 msec to
160 msec to perform less aggressive page scanning. This is done
accordingly to controller vendor recommendation.

Primary concern is that current parameters 22.5 interval, 11.25 window,
and interleaved scanning occupy whole radio bandwidth. Changing interval
to 160 msec should be sufficient for both speeding up connection
establishment and leaving space for other activities, like inquiry scan,
e.g.
"

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
c20f8e35ca8b0583323d310ec63a0f0d17cfdcf5 10-Jul-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use tx window from config response for ack timing

This change addresses an L2CAP ERTM throughput problem when a remote
device does not fully utilize the available transmit window.

The L2CAP ERTM transmit window size determines the maximum number of
unacked frames that may be outstanding at any time. It is configured
separately for each direction of an ERTM connection. Each side sends a
configuration request with a tx_win field indicating how many unacked
frames it is capable of receiving before sending an ack. The
configuration response's tx_win field shows how many frames the
transmitter will actually send before waiting for an ack.

It's important to trace both the actual transmit window (to check for
validity of incoming frames) and the number of frames that the
transmitter will send before waiting (to send acks at the appropriate
time). Now there are separate tx_win and ack_win values. ack_win is
updated based on configuration responses, and is used to determine
when acks are sent.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
a0dfe0ab6bf194805ce9d6a2dc81efab7a4a7fda 11-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Print amp_mgr refcnt

Improve debug output.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
9f1db00cdc9429593a887c20fb4372a6fb82a96c 11-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Use standard hex object specifiers in hci_event

To help debugging printed hex object use standard bluetooth
specifiers in hci_event. The patch changes format from 0x%04x to 0x%4.4x;
print manufacturer id and handle in hex instead of int; print opcode
always in 0x%4.4x format; status in 0x%2.2x.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
89d8b4078921023c52551b641b647352751ae714 10-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Add debug to l2cap_security_cfm

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ad0ac6ca5ffc959b7f8af2c76da4bf2f120aa0ee 10-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Print CID and PSM in hex format

Correct places where CID and PSM were printed as int. For CID: 0x%4.4x
is used and for PSM: 0x%2.2x.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
b44006728d1e553dcebe114252ed8b617db3eace 10-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Correct types specifiers for L2CAP

Avoid unneeded type conversion by correcting type specifiers in debug
statements for L2CAP.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2104786b429766adb32b5300bb5b4258abfd4b16 10-Jul-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: debug: Add printing num of cmds queued

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
afeb019d0ac329feb500dca444d9692064789096 09-Jul-2012 Jaganath Kanakkassery <jaganath.k@samsung.com> Bluetooth: Refactor PIN code rejection to use user_pairing_resp()

Reuse user_pairing_resp() to send PIN code negative reply

Signed-off-by: Jaganath Kanakkassery <jaganath.k@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
f5e3bcc504c3c35cc6e06a9ee42efed7c274066b 29-Jun-2012 Alan Cox <alan@linux.intel.com> tty: localise the lock

The termios and other changes mean the other protections needed on the driver
tty arrays should be adequate. Turn it all back on.

This contains pieces folded in from the fixes made to the original patches

| From: Geert Uytterhoeven <geert@linux-m68k.org> (fix m68k)
| From: Paul Gortmaker <paul.gortmaker@windriver.com> (fix cris)
| From: Jiri Kosina <jkosina@suze.cz> (lockdep)
| From: Eric Dumazet <eric.dumazet@gmail.com> (lockdep)

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
ce2be9acff7f71b94e3d68e08df3f1592cae05a3 29-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Do not auto off AMP controller

Since AMP controller is not managed by user space do not shut it down.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
d300fa9b14549c64e63691356c68483bcfeb0f04 19-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Route traffic only through BR/EDR controller

If AMP controller is first in the list then Bluetooth traffic might
be routed through it (if source is not specified). The patch
prevents this case and also checks that source is BR/EDR.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
38b3fef1730319e2730af3fc9f73698e3a9aeb4a 15-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Improve debugging messages for hci_conn

Improve debugging of hci_conn objects by: adding print to hci_conn
refcounting, adding object spcifier when missing, change conn to hcon
since conn is heavily used for l2cap_conn objects and this is misleading.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
b26d344c6b87058ae3e8f919a18580abfc4204eb 29-Jun-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
drivers/net/caif/caif_hsi.c
drivers/net/usb/qmi_wwan.c

The qmi_wwan merge was trivial.

The caif_hsi.c, on the other hand, was not. It's a conflict between
1c385f1fdf6f9c66d982802cd74349c040980b50 ("caif-hsi: Replace platform
device with ops structure.") in the net-next tree and commit
39abbaef19cd0a30be93794aa4773c779c3eb1f3 ("caif-hsi: Postpone init of
HIS until open()") in the net tree.

I did my best with that one and will ask Sjur to check it out.

Signed-off-by: David S. Miller <davem@davemloft.net>
f3747e2f2cea74264e1f8031b94d413b426d0436 28-Jun-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking update from David Miller:

1) Pairing and deadlock fixes in bluetooth from Johan Hedberg.

2) Add device IDs for AR3011 and AR3012 bluetooth chips. From
Giancarlo Formicuccia and Marek Vasut.

3) Fix wireless regulatory deadlock, from Eliad Peller.

4) Fix full TX ring panic in bnx2x driver, from Eric Dumazet.

5) Revert the two commits that added skb_orphan_try(), it causes
erratic bonding behavior with UDP clients and the gains it used to
give are mostly no longer happening due to how BQL works. From Eric
Dumazet.

6) It took two tries, but Thomas Graf fixed a problem wherein we
registered ipv6 routing procfs files before their backend data were
initialized properly.

7) Fix max GSO size setting in be2net, from Sarveshwar Bandi.

8) PHY device id mask is wrong for KSZ9021 and KS8001 chips, fix from
Jason Wang.

9) Fix use of stale SKB data pointer after skb_linearize() call in
batman-adv, from Antonio Quartulli.

10) Fix memory leak in IXGBE due to missing __GFP_COMP, from Alexander
Duyck.

11) Fix probing of Gobi devices in qmi_wwan usbnet driver, from Bjørn
Mork.

12) Fix suspend/resume and open failure handling in usbnet from Ming
Lei.

13) Attempt to fix device r8169 hangs for certain chips, from Francois
Romieu.

14) Fix advancement of RX dirty pointer in some situations in sh_eth
driver, from Yoshihiro Shimoda.

15) Attempt to fix restart of IPV6 routing table dumps when there is an
intervening table update. From Eric Dumazet.

16) Respect security_inet_conn_request() return value in ipv6 TCP. From
Neal Cardwell.

17) Add another iPAD device ID to ipheth driver, from Davide Gerhard.

18) Fix access to freed SKB in l2tp_eth_dev_xmit(), and fix l2tp lockdep
splats, from Eric Dumazet.

19) Make sure all bridge devices, regardless of whether they were
created via netlink or ioctls, have their rtnetlink ops hooked up.
From Thomas Graf and Stephen Hemminger.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (81 commits)
9p: fix min_t() casting in p9pdu_vwritef()
can: flexcan: use be32_to_cpup to handle the value of dt entry
xen/netfront: teardown the device before unregistering it.
bridge: Assign rtnl_link_ops to bridge devices created via ioctl (v2)
vhost: use USER_DS in vhost_worker thread
ixgbe: Do not pad FCoE frames as this can cause issues with FCoE DDP
net: l2tp_eth: use LLTX to avoid LOCKDEP splats
mac802154: add missed braces
net: l2tp_eth: fix l2tp_eth_dev_xmit race
net/mlx4_en: Release QP range in free_resources
net/mlx4: Use single completion vector after NOP failure
net/mlx4_en: Set correct port parameters during device initialization
ipheth: add support for iPad
caif-hsi: Add missing return in error path
caif-hsi: Bugfix - Piggyback'ed embedded CAIF frame lost
caif: Clear shutdown mask to zero at reconnect.
tcp: heed result of security_inet_conn_request() in tcp_v6_conn_request()
ipv6: fib: fix fib dump restart
batman-adv: fix race condition in TT full-table replacement
batman-adv: only drop packets of known wifi clients
...
60d2c25251cac20d8c142a03e230237528b68430 26-Jun-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID fixes from Jiri Kosina:
"The most important one is a purification of Kconfig for CONFIG_HID;
the inclusion of HID groups and autoloading didn't leave the Kconfig
in a really consistent state. Henrik's patch fixes that. In addition
to that, there are two small fixes for logitech and magicmouse
drivers."

* 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: Fix the generic Kconfig options
HID: magicmouse: Correct report range of major / minor axes
HID: logitech: don't use stack based dj_report structures
b82c29d81df0ead8b66041702d1dd88e778ab806 26-Jun-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
e486463e82e4dca9e8f4413649088b21c9ff87e5 26-Jun-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
drivers/net/usb/qmi_wwan.c
net/batman-adv/translation-table.c
net/ipv6/route.c

qmi_wwan.c resolution provided by Bjørn Mork.

batman-adv conflict is dealing merely with the changes
of global function names to have a proper subsystem
prefix.

ipv6's route.c conflict is merely two side-by-side additions
of network namespace methods.

Signed-off-by: David S. Miller <davem@davemloft.net>
1f41a6a9947615dca37d80b044ab81616e956a67 25-Jun-2012 Henrik Rydberg <rydberg@euromail.se> HID: Fix the generic Kconfig options

The generic HID driver is obviously not a special driver, so move it
outside of the special drivers menu. Explain the usage and make the
default follow the HID setting. This should simplify migration from
older kernels. While at it, remove the redundant HID_SUPPORT option
and modify the HID and USB_HID entries to better explain the bus
structure.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/Kconfig
790eff4429e45b850859f1bb8117846dafd5f86a 08-Jun-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Use GFP_KERNEL in mgmt events functions

cmd_status, cmd_complete and mgmt_event functions are executed in
process context and they are not called inside atomic sections. Thus,
they should use GFP_KERNEL for memory allocation instead of GFP_ATOMIC.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
12b9456502d421a8272615fb641349eb2013b6d8 08-Jun-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Use GFP_KERNEL in mgmt_pending_add

We are allowed to sleep in mgmt_pending_add, so we should use
GFP_KERNEL for memory allocations instead of GFP_ATOMIC.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
92c4c2049762dc0ef2b152df8c787051db1cdf60 08-Jun-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Use GFP_KERNEL in mgmt_handlers

add_uuid and get_connections mgmt_handlers are executed by user
threads running in kernel-mode.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
9345d40c580d0f3dfc040add0e6371b1a629c1cc 15-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use AUTO_OFF constant in jiffies

Move AUTO_OFF_TIMEOUT to other constants changing name to
HCI_AUTO_OFF_TIMEOUT and convert to jiffies.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
33cef264cd945d64ae8cbbfc5f246661f9655483 18-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix compile warnings in mgmt

Commit af7985bf85840e3dc90ba108a679db044f91f00e introduced regression
resulting in complie warnings:

...
net/bluetooth/mgmt.c:3568:27: warning: invalid assignment: |=
net/bluetooth/mgmt.c:3568:27: left side has type restricted __le32
net/bluetooth/mgmt.c:3568:27: right side has type int
net/bluetooth/mgmt.c:3570:27: warning: invalid assignment: |=
net/bluetooth/mgmt.c:3570:27: left side has type restricted __le32
net/bluetooth/mgmt.c:3570:27: right side has type int
net/bluetooth/mgmt.c:3580:21: warning: cast from restricted __le32
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
f960727e6c98a36018029c0512aa03f1c5faa914 13-Jun-2012 Vishal Agarwal <vishal.agarwal@stericsson.com> Bluetooth: Fix sending HCI_Disconnect only when connected

HCI_Disconnect should only be sent after connection is established.
If connection is not yet established and HCI_Disconnect is called
then disconnection complete will be received with a handle which
does not exist and hence this event will be ignored.
But as mgmt.c will not receive this event, its variable for pending
command is not cleared.This will result in future Disconnect commands
for that BD Address to be blocked with error busy.

Signed-off-by: Vishal Agarwal <vishal.agarwal@stericsson.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
211c17aaee644bb808fbdeef547ac99db92c01ed 13-Jun-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

Conflicts:
drivers/net/wireless/ath/ath9k/main.c
net/bluetooth/hci_event.c
3701f94451ea341fb5305cb55f7afc04bf0dc56e 11-Jun-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove magic value in disconnect mgmt handler

This patch replaces the magic value of variable 'reason' by the
proper macro.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
af7985bf85840e3dc90ba108a679db044f91f00e 11-Jun-2012 Jefferson Delfes <jefferson.delfes@openbossa.org> Bluetooth: Fix flags of mgmt_device_found event

Change flags field to matches userspace structure.
This field needs to be converted to little endian before forward it.

Signed-off-by: Jefferson Delfes <jefferson.delfes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
11778716ededa873f24eebaae011e52f3d27dfca 11-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix not setting HCI_RESET flag for AMP

Move reset function to common initialization section fixing
not setting HCI_RESET flag for amp_init.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
f0e0951007b051046587e73ffc9716caa024d537 11-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct debug print specifier for u16 objects

Some functions print u16 objects as "0xc03" others as "0x0c03". Patch
ensures that opcodes printed are the in the same format and consistent
with bluetooth code.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
bda4f23a5c20deabb07545591be872145528b4ed 11-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add opcode to error message

Sometimes HCI command sending timeouts and gives error message without
specifying which command causes error. Patch makes sure that opcode
is printed to help debugging.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
5f246e890502fed387e0f959e2224ea680c03423 11-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Update HCI timeouts constants to use msecs_to_jiffies

The HCI constants are always used in form of jiffies. So just
include the conversion from msecs in the define itself. This has the
advantage of making the code where the timeout is used more readable
and avoiding unnecessary conversions.

The patch is similar to commit ba13ccd9 doing the same job for L2CAP

Reported-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
975b91bb17e70c0dc33ad07f16097106a9c2c6a2 11-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use standard HCI cmd timeout for RESET

Remove magic and use standard HCI cmd timeout

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
8f321f853ea33330c7141977cd34804476e2e07e 08-Jun-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix using uninitialized option in RFCMode

If remote device sends bogus RFC option with invalid length,
undefined options values are used. Fix this by using defaults when
remote misbehaves.

This also fixes the following warning reported by gcc 4.7.0:

net/bluetooth/l2cap_core.c: In function 'l2cap_config_rsp':
net/bluetooth/l2cap_core.c:3302:13: warning: 'rfc.max_pdu_size' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.max_pdu_size' was declared here
net/bluetooth/l2cap_core.c:3298:25: warning: 'rfc.monitor_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.monitor_timeout' was declared here
net/bluetooth/l2cap_core.c:3297:25: warning: 'rfc.retrans_timeout' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.retrans_timeout' was declared here
net/bluetooth/l2cap_core.c:3295:2: warning: 'rfc.mode' may be used uninitialized in this function [-Wmaybe-uninitialized]
net/bluetooth/l2cap_core.c:3266:24: note: 'rfc.mode' was declared here

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
cbe461c526e1e0f8b55f91180df64f02d8daed45 12-Jun-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Conflicts:
net/bluetooth/hci_event.c
1d0c4da8f717937aeda47a72bc769d80f8776795 10-Jun-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix style in hidp code

Follow the net rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
idp/core.c
1c2e004183178e1947882cd2e74f37826f45230e 08-Jun-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add support for encryption key refresh

With LE/SMP the completion of a security level elavation from medium to
high is indicated by a HCI Encryption Key Refresh Complete event. The
necessary behavior upon receiving this event is a mix of what's done for
auth_complete and encryption_change, which is also where most of the
event handling code has been copied from.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
4dab786482d706a2a41cd16cf174671d640a9870 07-Jun-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP security elevation from medium to high

If we have an unauthenticated key it is not sufficient to acheive high
security. Therefore, when deciding whether to encrypt the link or
request pairing, it is essential to in addition to checking the
existence of a key to also check whether it is authenticated or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
d06cc416f517a25713dedd9e2a9ccf4f3086c09a 06-Jun-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix deadlock and crash when SMP pairing times out

The l2cap_conn_del function tries to cancel_sync the security timer, but
when it's called from the timeout function itself a deadlock occurs.
Subsequently the "hcon->l2cap_data = NULL" that's supposed to protect
multiple calls to l2cap_conn_del never gets cleared and when the
connection finally drops we double free's etc which will crash the
kernel.

This patch fixes the issue by using the HCI_CONN_LE_SMP_PEND for
protecting against this. The same flag is also used for the same purpose
in other places in the SMP code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
4c47d7396420160d27209f578680141874c0110b 07-Jun-2012 Vishal Agarwal <vishal.agarwal@stericsson.com> Bluetooth: Fix LE pairing completion on connection failure

For BR/EDR pairing is assumed to be finished when connection is
done. For LE if connection is successful it did not necessarily
mean that pairing is also done but if the connection is unsuccessful
it should be assumed that pairing procedure is also finished.
This patch registers a new function with connect_cfm_cb callback for
LE link which sends the pairing complete signal to user space if
connection is unsuccessful.

Signed-off-by: Vishal Agarwal <vishal.agarwal@stericsson.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
476585ecf08067ac4e81d1a4cb19e2caf2093471 06-Jun-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix SMP pairing method selection

The tk_request function takes the local IO capability as the second last
parameter and the remote IO capability as the last parameter. They were
previously swapped: when we receive a pairing response
req->io_capability contains the local one and rsp->io_capability the
remote one.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
mp.c
7490c6c2013dc1d42557d7c4694930631b0d0f34 01-Jun-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove magic disconnect reason

The macro gives a better idea of the what the error really is.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
d060991f3bf4b6f8e9c5dec0c210fe76d9165000 01-Jun-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix checking the wrong flag when accepting a socket

Most probably a typo, the check should have been for BT_SK_DEFER_SETUP
instead of BT_DEFER_SETUP (which right now only represents a socket
option).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
0431a43ca5ada5ffd3668116b64168f4a1a64286 01-Jun-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Filter duplicated reports in LE scan

This patch enables filtering duplicated advertising reports during
LE scan.

Some LE devices advertise using very small intervals generating lots
of equal advertising report events to the host. Each event generates
a mgmt_device_found event which is copied to userspace.

Enabling this feature, duplicated advertising reports are filtered
at controller's link layer. This way, the controller doesn't wake up
the host to report duplicated advertising reports and, consequently,
less data is copied to userspace.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_core.c
7e1af8a3a51dbf5dc7392fb294a0830f7e853aa8 29-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Create empty l2cap ops function

A2MP doesn't use part of the L2CAP chan ops API so we just create general
empty function instead of the A2MP specific one.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2mp.c
8c3a4f004e706fd7e681c68c6de4946c8c76b976 31-May-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename L2CAP_LE_DEFAULT_MTU

This patch renames L2CAP_LE_DEFAULT_MTU macro to L2CAP_LE_MIN_MTU
since it represents the minimum MTU value, not the default MTU
value for LE.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
682877c31fc1b6510b694b6b8e78d8dde53a47cc 31-May-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check MTU value in l2cap_sock_setsockopt_old

If user tries to set an invalid MTU value, l2cap_sock_setsockopt_old
should return -EINVAL.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_sock.c
6fcb06a28d150095f042c477fbe20a9767d9a951 31-May-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Change default MTU for L2CAP ATT channel

This patch changes the default MTU value for L2CAP ATT fixed channel
to L2CAP_DEFAULT_MTU (672 octets).

Differently from others L2CAP channels, in L2CAP ATT fixed channel
there is no MTU negotiation. The MTU value for that channel is up to
the L2CAP implementation. The only restriction in L2CAP spec is the
MTU value must not be less than 23 octets.

At ATT protocol level (on top of L2CAP), we have the ATT_MTU which
defines the maximum size of any ATT message sent between client and
server. GATT profile defines ATT_MTU default value to 23 octets. If
a GATT based profile wants to use ATT_MTU greater than 23 octets
(e.g. HID over GATT profile), it should negotiate a new value by
executing the GATT Exchange MTU sub-procedure.

Thus, in order to support any value of ATT_MTU negotiated at ATT
protocol level, our L2CAP implementation should have L2CAP ATT
fixed channel MTU equal or greater than ATT_MAX_MTU (512 octets).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
4f72b3291c9537a3c3c94552e248eaed8e4f8492 30-May-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Fix not removing hci_conn for failed LE connection

This patch changes way LE Connection Complete event with error status are
handled. BDADDR returned in such event packet do not need to be valid and
should not be used to search for existing hci_conn. Instead, any hci_conn
with BT_CONNECT state should be matched since there can be only one
pending LE outgoing connection at any time.

If not handled properly, appriopriate hci_conn will not be removed and
subsequent connection to given peer will try to reuse it without making
actual connection attempt.

2012-05-07 11:21:39.133378 < HCI Command: LE Create Connection (0x08|0x000d) plen 25
bdaddr 00:22:D0:10:13:EE type 1
2012-05-07 11:21:39.138774 > HCI Event: Command Status (0x0f) plen 4
LE Create Connection (0x08|0x000d) status 0x00 ncmd 1
2012-05-07 11:21:44.752854 < HCI Command: LE Create Connection Cancel (0x08|0x000e) plen 0
2012-05-07 11:21:44.759475 > HCI Event: Command Complete (0x0e) plen 4
LE Create Connection Cancel (0x08|0x000e) ncmd 1
2012-05-07 11:21:44.764479 > HCI Event: LE Meta Event (0x3e) plen 19
LE Connection Complete
status 0x02 handle 0, role master
bdaddr 00:00:00:00:00:00 (Public)

[14898.739425] [6603] hci_connect: hci0 dst 00:22:D0:10:13:EE
[14898.739429] [6603] hci_conn_add: hci0 dst 00:22:D0:10:13:EE
[14898.739434] [6603] hci_conn_init_sysfs: conn ffff880079f03000
[14898.739440] [6603] hci_send_cmd: hci0 opcode 0x200d plen 25
[14898.739443] [6603] hci_send_cmd: skb len 28
[14898.739487] [6603] hci_chan_create: hci0 conn ffff880079f03000
...
[14938.860231] [55] hci_send_cmd: hci0 opcode 0x200e plen 0
...
[14938.876427] [55] hci_le_conn_complete_evt: hci0 status 2
[14938.876433] [55] hci_conn_add: hci0 dst 00:00:00:00:00:00
[14938.876439] [55] hci_conn_init_sysfs: conn ffff88007aeff800
[14938.876454] [55] hci_send_to_control: len 14
[14938.876470] [55] l2cap_connect_cfm: hcon ffff88007aeff800 bdaddr 00:00:00:00:00:00 status 2
[14938.876474] [55] hci_conn_del: hci0 conn ffff88007aeff800 handle 0

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_event.c
489dc48e7583d825304b0aff3fc17e706627b3c8 30-May-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Return proper mgmt state when LE pairing connection failed

MGMT_STATUS_BUSY should be returned when LE pairing cannot be started due
to another outgoing connection attempt is ongoing.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
gmt.c
dfc94dbdb999154dc2ff44e6011a4912c0b29e88 30-May-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Allow only one LE connection attempt

Only one outgoing LE connection attempt should be possible.
hci_connect() will now return -EBUSY in case there's another pending
outgoing connection.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
ci_conn.c
f0f6279976c8f0768468293546785c18894a704c 29-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove unused err var from l2cap_segment_sdu()

Trivial fix, let the code cleaner.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
ba7aa64fe24d293bd433b82c30d505ab8611673f 29-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Create function to return the ERTM header size

Simplify the handling of different ERTM header size. We were the same
check in some places of the code, and more is expected to come, so just
replace them with a function.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
6810fca724d2a3c08c0d2eb8510648e7a36ab592 31-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Make l2cap_att_channel return void

l2cap_att_channel always returns 0 which is not used.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
84104b241d26302cb9083779d06741002534a58e 31-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Make l2cap_conless_channel return void

l2cap_conless_channel always return 0 which is not used.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
13ca56e0537aa148b7e7a6ea38ca6a6a1dc3e197 31-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Make l2cap_data_channel return void

l2cap_data_channel always return 0 which is not used anywhere,
make it void function.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
3cabbfdad3150e0083a64c951701c970ef970c77 31-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Do not reference hci_conn

Make A2MP channel special channel which do not reference hci_conn.
This prevents from keeping ACL connection open when all L2CAP
channels got closed.

hci_conn_hold and hci_conn_put are not reference counts on the
hci_conn structure in the typical way. They are reference counts for
the ACL. When you do the last hci_conn_put, the ACL is disconnected
after a timeout.

Reported-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
fd83e2c27c1bd8b0e9dc7596339c2411385f8b0c 30-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Do not check func ready existence

Functions will be always defined and in case not implemented as
dummy __no_func.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
97e8e89d2d8185b7644c9941636d3682eedc517b 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Manage incoming connections

Handle incoming A2MP connection by creating AMP manager and
processing A2MP messages.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
416fa7527d6bf658e5517ea36d2de9270be2c11e 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Handling fixed channels

A2MP fixed channel do not have sk

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
2cap_core.c
f6410a849b76f56c78d989786eb427b85a559b9f 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Command Responses

Process A2MP responses, print cmd code and ident for now.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
6113f84fc1a8962aed25f54a115b196e9aea151f 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Disc Physlink Request

Placeholder for A2MP Disconnect Physlink Request.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
e072f5dab22e7bf0a10daf854acc0fc271396ee7 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Create Physlink Request

Placeholder for A2MP Create Physlink Request.
Handles requests with invalid controler id as shown below:

...
> ACL data: handle 11 flags 0x02 dlen 50
A2MP: Create Physical Link req: local id 1 remote id 85
Assoc data:
<skipped>
< ACL data: handle 11 flags 0x00 dlen 15
A2MP: Create Physical Link rsp: local id 85 remote id 1 status 1
Invalid Controller ID
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
a28381dc9ca3e54b0678e2cd7c68c1afb2d7cc76 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Get AMP Assoc Request

Example trace when receiving AMP Assoc Request with wrong AMP id.
...
> ACL data: handle 11 flags 0x02 dlen 13
A2MP: Get AMP Assoc req: id 238
< ACL data: handle 11 flags 0x00 dlen 14
A2MP: Get AMP Assoc rsp: id 238 status (1) Invalid Controller ID
assoc data:
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
47f2d97d38816aaca94c9b6961c6eff1cfcd0bd6 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Get Info Request

Process A2MP Get Info Request.
Example of trace log for invalid controller id is shown below:

...
> ACL data: handle 11 flags 0x02 dlen 13
A2MP: Get Info req: id 238
< ACL data: handle 11 flags 0x00 dlen 30
A2MP: Get Info rsp: id 238 status (1) Invalid Controller ID
...

Note that If the Status field is set to Invalid Controller ID all subsequent
fields in the AMP Get Info Response shall be ignored by the receiver.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
329d81af29344a2ad2f9595310be74644421797a 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Change Notify

Placeholder for A2MP Change Notify handler.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
8598d064cbf22b2d84c7cd8a9fcb97138baffe3f 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Discover Request

Adds helper functions to count HCI devs and process A2MP Discover
Request, code makes sure that first controller in the list is
BREDR one. Trace is shown below:

...
> ACL data: handle 11 flags 0x02 dlen 16
A2MP: Discover req: mtu/mps 670 mask: 0x0000
< ACL data: handle 11 flags 0x00 dlen 22
A2MP: Discover rsp: mtu/mps 670 mask: 0x0000
Controller list:
id 0 type 0 (BR-EDR) status 0x01 (Bluetooth only)
id 1 type 1 (802.11 AMP) status 0x01 (Bluetooth only)
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
21dbd2ce35f6d2b4aa5363be6c839cdb50644e11 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP Command Reject

Placeholder for future A2MP Command Reject handler.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
6b44d9b8d96b37f72ccd7335b32f386a67b7f1f4 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Process A2MP messages

Implement basic processing for AMP Manager Protocol (A2MP).

Example below shows processing unrecognized command.
...
> ACL data: handle 11 flags 0x02 dlen 12
A2MP: code 0x00 ident 3 len 0
< ACL data: handle 11 flags 0x00 dlen 14
A2MP: Command Reject: reason (0) - Command not recognized
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
46d5c9088fbcc8a570bc271f77940973d9cae074 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Add chan callbacks

Add L2CAP chan ops callbacks.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
f6d3c6e783b0e9f75b18232f8ff8cd5dbc3f7301 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Build and Send msg helpers

Helper function to build and send A2MP messages.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
9740e49d17e55f3832661fd99a8e0a17e921a82e 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: AMP Manager basic functions

Define AMP Manager and some basic functions.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2mp.c
ci_conn.c
466f8004f364e9cb46d9124109972489eccfb404 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: A2MP: Create A2MP channel

Create and initialize fixed A2MP channel

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
akefile
2mp.c
2cap_core.c
0181a70f549bd1683d18a5a1d79ac25bcdb76570 29-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Use defined PSMLEN instead of magic

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2dfa1003ccd19b435de0be00f6afb7ccdffd7596 28-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: check for already existent channel before create new one

Move this check to before the channel time creation simplifies the code
and avoid memory allocation if the channel already exist.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
538266929eb7165f92b91eb0f403120fe759e742 28-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Move check for backlog size to l2cap_sock.c

Remove socket specific code from l2cap_core.c

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
0797e01d877b9677d07b89e0776c061df8878f27 28-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use chan->state instead of sk->sk_state

These vars are kept in sync so we can use chan->state here.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
54a59aa2b562872781d6a8fc89f300d360941691 28-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add l2cap_chan->ops->ready()

This move socket specific code to l2cap_sock.c.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
c0df7f6e06e1aeccee39c801af7f78cadeb9f345 28-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Move clean up code and set of SOCK_ZAPPED to l2cap_sock.c

This remove a bit more of socket code from l2cap core, this calls set the
SOCK_ZAPPED and do some clean up depending on the socket state.

Reported-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
80b980279508edd1a92d8d77ec99b0ddad00c5fe 28-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use chan as parameters for l2cap chan ops

Use chan instead of void * makes more sense here.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
3df92b31b2b593c5a067634ef2c30e76b2b2548d 27-May-2012 Sasha Levin <levinsasha928@gmail.com> Bluetooth: Really fix registering hci with duplicate name

Commit fc50744 ("Bluetooth: Fix registering hci with duplicate name") didn't
fully fix the duplicate naming issue with devices, and duplicate device names
could still be created:

[ 142.484097] device: 'hci1': device_add
[...]
[ 150.545263] device: 'hci1': device_add
[ 150.550128] kobject: 'hci1' (ffff880014cc4e58): kobject_add_internal: parent: 'bluetooth', set: 'devices'
[ 150.558979] ------------[ cut here ]------------
[ 150.561438] WARNING: at fs/sysfs/dir.c:529 sysfs_add_one+0xb0/0xd0()
[ 150.572974] Hardware name: Bochs
[ 150.580502] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1'
[ 150.584444] Pid: 7563, comm: trinity-child1 Tainted: G W 3.4.0-next-20120524-sasha #296
[...]

Instead of the weird logic and the attempt at keeping the device list sorted,
just use an IDA.

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
6754e0df133b088aa97ae6f2d3fd5377e43d1fc6 25-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use l2cap_chan_ready() in LE path

This replace code in l2cap_le_conn_ready() by a similar code in
l2cap_chan_ready().

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2f84a2e6a6978810b06b5f33892152183f1dace9 25-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove extra l2cap_state_change(BT_CONNECTED)

This is already performed inside l2cap_chan_ready(), so we don't need it
here again.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
35d401df3db4cb7a0403b42641bbf5694e64d374 25-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Get a more accurate L2CAP PDU len

Both FCS and Extended header might be or might not be present in a ERTM
channel.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
82781e634f815e9a675ef643a5e11da0cf77ce0e 25-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use __constant modifier in HCI code

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
ac73498cbb54ebe3a06709ba7e4feb99c83113bf 24-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use __constant when dealing with constants

__constant_cpu_to_le16() is the right go here.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2983fd682444180e45567ce8147a612b97ba69da 24-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Define and use PSM identifiers

Define assigned Protocol and Service Multiplexor (PSM) identifiers
and use them instead of magic numbers.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2cap_sock.c
6d3c730f03e0d1aed2125c1a64ad8857c63f5163 24-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Use lmp_ssp_capable() macro

Make the check more user friendly.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
2d369359f1e0fa13852404ff2f8063235a27d8a7 23-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Send a configuration request after security confirmation

Sometimes an ACL link must be raised to a higher security level after
an L2CAP connection is requested, but before a connection response is
sent. In this case, a connection response sent by L2CAP was not
immediately followed by a configuration request. Other code paths do
send this configuration request right away. It was possible for the
connection to stall while L2CAP waited for the remote device (like
PTS) to trigger the configuration process.

Here is an abbreviated hcidump of the failure case with PTS:

1337806446.051982 > ACL data: handle 43 flags 0x02 dlen 10
L2CAP(s): Info req: type 2
1337806446.052050 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x000000b8
1337806446.595320 > ACL data: handle 43 flags 0x02 dlen 12
L2CAP(s): Connect req: psm 4097 scid 0x0041
1337806446.595673 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 1 status 0
1337806446.595679 < ACL data: handle 43 flags 0x00 dlen 10
L2CAP(s): Info req: type 2
1337806446.669835 > ACL data: handle 43 flags 0x02 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x00000028
1337806446.669899 < HCI Command: Authentication Requested (0x01|0x0011) plen 2
1337806446.669906 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 1 status 1
<security setup here>
1337806446.769888 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 0 status 0

At this point, the connection stalls and no further messages are sent
on the L2CAP signaling channel. No data is received either.

If we immediately send a configuration request after a successful connect
response, the connection completes:

1337724090.041162 > ACL data: handle 43 flags 0x02 dlen 10
L2CAP(s): Info req: type 2
1337724090.041236 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x000000b8
1337724090.597128 > ACL data: handle 43 flags 0x02 dlen 12
L2CAP(s): Connect req: psm 4097 scid 0x0041
1337724090.597236 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 1 status 0
1337724090.597244 < ACL data: handle 43 flags 0x00 dlen 10
L2CAP(s): Info req: type 2
1337724090.660842 > ACL data: handle 43 flags 0x02 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x00000028
1337724090.660926 < HCI Command: Authentication Requested (0x01|0x0011) plen 2
1337724090.660934 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 1 status 1
<security setup here>
1337724090.755162 < ACL data: handle 43 flags 0x00 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0041 result 0 status 0
1337724090.755171 < ACL data: handle 43 flags 0x00 dlen 23
L2CAP(s): Config req: dcid 0x0041 flags 0x00 clen 11
1337724091.361847 > ACL data: handle 43 flags 0x02 dlen 29
L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 0 clen 15
1337724091.863808 > ACL data: handle 43 flags 0x02 dlen 23
L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 11
1337724091.863882 < ACL data: handle 43 flags 0x00 dlen 29
L2CAP(s): Config rsp: scid 0x0041 flags 0x00 result 0 clen 15
1337724092.683745 > ACL data: handle 43 flags 0x02 dlen 12
L2CAP(d): cid 0x0040 len 8 [psm 4097]
0000: 00 00 11 22 33 44 34 2f ..."3D4/

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
59e54bd15d63f102c71c3ce695bca5ed90926e46 23-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Define L2CAP conf continuation flag

Define Continuation flag which the only flag used from Flags field
in L2CAP Configuration Request and Response.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
8449e381a8558fb1d911017ea26bae681fea4240 23-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove unneeded EXPORT_SYMBOL

After l2cap, sco and bluetooth modules merge some symbols doesn't need to
be exported anymore.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
8c520a59927a5600973782505dbb750d985057c4 23-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove unnecessary headers include

Most of the include were unnecessary or already included by some other
header.
Replace module.h by export.h where possible.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
nep/core.c
nep/netdev.c
nep/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
idp/core.c
idp/sock.c
2cap_core.c
2cap_sock.c
ib.c
gmt.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
mp.c
8fc9ced398824739d3c25c8aa7f6f34d8e7a49d9 23-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in the subsystem

This is some leftover from the last patches that fixed style. It is mostly
line over 80 characters fixes reported by checkpatch.pl.
checkpatch.pl is clean for these files now.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
ib.c
gmt.c
fc5fef615a963c8b13abf0bbc2a8e8d7c3fd1ffb 23-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove 'register' usage from the subsystem

Let the compiler chooses what is best.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_sock.c
co.c
6039aa73a1323edc2d6d93a22505d4dc28f38e3f 23-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove most of the inline usage

Only obvious cases were left as inline, mostly oneline functions.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
nep/netdev.c
ci_core.c
ci_event.c
ci_sock.c
idp/core.c
gmt.c
fcomm/core.c
fcomm/tty.c
co.c
4f42a8cd4905e69ba4dd694d9338aeee1bb7e9ab 23-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Remove empty line

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
5325e5bb86f6dd2977f0891b9eaff57293538d50 23-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Preserve L2CAP flags values

Previous callers of l2cap_build_conf_rsp in l2cap_config_req use
flags instead of continuation flag hardcoded value. It does not change
logic and preserve future possible flags.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
9b3b44604ac8e06d299718c5d0fa0b91b675ae0b 23-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use defined link key size

Remove magic number with defined link key size.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
a6c511c636848f871f5b7aef38e25e5b894b3b48 23-May-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Rename HCI_QUIRK_NO_RESET to HCI_QUIRK_RESET_ON_CLOSE

HCI_QUIRK_NO_RESET name is misleading - purpose of this quirk is to
reset device on close instead of init, not to not reset at all.
Rename it to HCI_QUIRK_RESET_ON_CLOSE to avoid confusion.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
d660366d53119fbd988e1b1d6ea2c00358a8e688 21-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove dead int returns

These functions were returning always 0, we just make then void.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
be4aad05af0ec949a91e7bbaa55c02a954714473 21-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Remove double check for BT_CONNECTED

The same check is done just before call l2cap_streaming_send()

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
401bb1f768c842b9fbfaeb7741cc5cf17c70ffd1 21-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Silent sparse warnings

Silence warnings below:

net/bluetooth/l2cap_core.c:1662:24: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:1662:27: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:1683:24: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:1683:27: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:2260:46: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:2574:33: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:2581:33: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:4556:24: warning: Using plain integer
as NULL pointer
net/bluetooth/l2cap_core.c:4556:27: warning: Using plain integer
as NULL pointer

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
ee556f662ca9e96a3cdb0d10745f9fd0cbf549af 19-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Do not purge queue in Basic Mode

chan->tx_q is only initialized if we use ERTM or Streaming mode.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
d1de6d46dc7b503d77ec59c849acacadfece1da1 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Enable ERTM by default

This enables the new receive and transmit state machines.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
273759e2c3bd69efe74799c446df69d9ea5ca418 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Set txwin values for streaming mode

The transmit window values must be configured for streaming mode, even
though streaming mode does not have a window. This enables use of
extended headers when the transmit window socket option is set to 64
or larger.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
6ea0048575089e9a714e08bc3debec4b1b9d7664 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove unneccesary inline

Let the compiler decide if inlining is appropriate.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
0362520bf9d35f09c2693e14352f4b0ad07397fa 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Simplify the ERTM ack timeout

Since l2cap_send_ack can trigger extra actions like sending iframes,
don't call it. Just send an RR or RNR frame if an ack needs sending.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
80909e04de4dbbe76a220ccd5f9b32d8d5a8c22c 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use the ERTM transmit state machine from timeout handlers

Different states have different actions for retransmit and monitor
timeouts, so remove the logic for those actions from the timer handlers.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
4239d16f360ce4c8a1798508dd171ebce93985ba 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Check rules when setting retransmit or monitor timers

The ERTM specification requires the retransmit timer to be cancelled
when the monitor timer is set. The retransmit timer cannot be set
again while the monitor timer is pending.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
c9e3d5e00408c96f82b88a8de5d54f7a1343b110 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use new header structures in l2cap_send_rr_or_rnr

struct l2cap_ctrl is now used, and the sframe is now sent directly
rather than depending on a separate call.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
fcd289df8892268ec0783588e0d7e0346fd6a1cd 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Handle incoming REJ frames

REJ frames are sent by the remote device to request that all frames
after a given sequence number be retransmitted. These are also an
implicit indication that the remote device is not in a busy state and
can receive new iframes.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
f80842a83ec224e70ebbd11a20832e71e5911b45 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Handle SREJ requests to resend unacked frames

When a remote device sends an SREJ, retransmit the frame with the
corresponding sequence number (subject to special cases with poll and
final flags). An SREJ is also an implicit indication the the remote
device is not in a busy state.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
63838725c6478102894cfb88feb2a9b1c331855d 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Reassemble all available data when retransmissions succeed.

As retransmitted packets arrive, attempt to reassemble SDUs. If all
requested retransmissions have been received, acknowledge them and
transition back to the RECV state.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
bed68bde7ebdb591cc67921261307626c8f37936 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Send SREJ frames when packets go missing

The ERTM specification lays out three scenarios for sending SREJ
frames to request retransmission of specific frames. l2cap_send_srej
requests all frames up to a given txseq that are not already queued
for reassembly. l2cap_send_srej_tail only requests the most recent
missing frame. l2cap_send_srej_list resends SREJ frames for data that
was requested for resend but never received.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
e1fbd4c19a5c4d4f490d70e73745cf2cf0dc1955 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add implementation for retransmitting all unacked frames

This adds l2cap_ertm_resend to retransmit frames based on the sequence
numbers in chan->retrans_list. If the retransmit limit is reached for
any individual frame is reached, the connection is dropped. skbs that
are cloned already are copied to avoid modifying shared data (this is
uncommon). To retransmit all frames, l2cap_retransmit_all now builds
a list of all unacked sequence numbers and then calls
l2cap_ertm_resend.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
d2a7ac5d5d3a0b166ac128883bd088064c029fe5 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add the ERTM receive state machine

This adds a top-level state machine with handlers for two receive
states defined in the ERTM spec, RECV and SREJ_SENT. The reqseq value
of the incoming frame is also validated at the top level and a
disconnection is forced if it is invalid. The actions for the RECV
and SREJ_SENT states are implemented according to the state tables in
the ERTM specification.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
e31f76337257616aca0ea15abee271513b17426c 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Update l2cap_send_i_or_rr_or_rnr to fit the spec better

This action now exactly matches what is defined in the ERTM
specification, including clearing the remote busy flag and setting the
retransmit timer rather than retransmitting frames directly. The spec
does not retransmit frames as part of this action, since
retransmission is only triggered by REJ, SREJ, or an RR with the final
bit set. struct l2cap_ctrl is also used to set up header values.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
61aa4f5b9f43b21668aec51da2df3e9ed5f4226d 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use the transmit state machine for busy state changes

This lets the transmit state machine handle local busy state changes,
since different actions are taken in the different transmit states.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
0a0aba42b8daba55e4d2bdfc3c8ca7d7d827b723 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Refactor l2cap_send_ack

The function now encapsulates more of the logic to either immediately
send an ack if the transmit window is over 75% full, or wait for the
ack timer to expire if the transmit window is not full enough. It is
also able to push out waiting iframes that can carry an
acknowledgement.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
f5dbb0772df3feb2bb5eda8a9f0e0acdeb25653f 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove receive code that has been superceded

This deletes the receive code that had handlers for each frame type at
the top level, and then had logic to determine the receive state
within each handler.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
4b51dae96731c9d82f5634e75ac7ffd3b9c1b060 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add streaming mode receive and incoming packet classifier

Streaming mode reception is fairly simple, with in-sequence frames
being reassembled as they arrive. Out-of-sequence frames are dropped,
and also clear any partially-assembled SDUs that may exist.

The packet classifier determines if the txseq value of the incoming
packet is expected, invalid (resulting in a disconnection), invalid
(ignorable), duplicate, or having to do with an SREJ request that was
previously sent. The rules for each classification are defined in the
ERTM specification, and consolidating these rules in one place helps
clarify the receive state machine.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
cec8ab6e20a7fbdc056894ff7b3fbdbc2a82a563 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Consolidate common receive code for ERTM and streaming mode

Creates a new l2cap_data_rcv function that combines previous code from
l2cap_ertm_data_rcv and l2cap_data_channel. This reduces duplicate
code for streaming mode, and sets up a framework for the ERTM receive
state machine.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
a67d7f6fca776317bb478c96f25196972c05d173 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Refactor l2cap_send_sframe

The new implementation uses struct l2cap_ctrl to set up the sframe
fields, and also reduces duplicate acks by canceling the ack timer
whenever an RR or RNR frame is sent. sframe PDU generation is also
split in to a separate function to separate it from the logic related
to the connection state and sframe type.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
18a48e76640c590a14b0286c9da5fde6ac146cc2 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Refactor l2cap_ertm_send

The new implementation is aware of the new transmit state machine, and
uses struct l2cap_ctrl to compose ERTM headers. It also has improved
error handling for allocation failures, and does not send the packet
until after all skb and channel data structures are updated.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
3733937d96f3fe4dfc3b8da43385d739e905ff41 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Refactor l2cap_streaming_send

This new implementation uses struct l2cap_ctrl to compose the
streaming mode headers.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
608bcc6d70850be9e3aa7c3831045304a2a65fbb 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add a new L2CAP ERTM transmit state machine.

This implements a top-level transmit state machine with handlers for
the two ERTM states defined in the specification: XMIT and WAIT_F.

The state machine accepts an event and, optionally, a list of skbs to
transmit. In addition to data transmission, the local busy state can
be modified, acks are processed, and monitor and retransmit timeouts
are handled. This mirrors the structure of the state tables in the
spec.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
b191e031b744f16116e9a546e36b13aadb8cba00 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Change default state of ERTM disable flag

This is to allow for ERTM state machine replacement in the patches
that follow.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2cap_core.c
2827011f666e157f3307d55070a75e1d1110b194 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix early return from l2cap_chan_del

This fixes a regression from commit
2ead70b8390d199ca04cd35311b51f5f3676079e that is present in all
kernels starting at v3.0.

When L2CAP information was moved to struct l2cap_chan, a check was
added to l2cap_chan_del to avoid certain cleanup operations when ERTM
or streaming mode had not yet been initialized. The logic in the
check did not take in to account that chan->conf_state is set to 0 in
l2cap_chan_ready, so l2cap_chan_del failed to cancel timers and leaked
memory any time the ERTM queues or lists were not empty.

This change makes sure that l2cap_chan_del only returns early if
ERTM initialization was not performed.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
9dc9affcb776b75f6d3e5d69d6e2a679407854f1 18-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Free allocated ERTM SREJ list if init fails

If the ERTM SREJ list is properly allocated but the retransmit list
allocation fails, the SREJ list must be freed before returning from
l2cap_ertm_init. l2cap_chan_del will not clean up the SREJ list
if l2cap_ertm_init returns a failure code.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
a8c5fb1afe0b2661a8be78e340f86e6a627f9b32 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in hci_core.c

Follow net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
5974e4c469658696e6e0ce8951a59a61b122415a 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in hci_conn.c

Follow net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
807deac275cfd5b1d1d634d6aff2f9f77a843c73 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in hci_event.c

Follow the net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
b80f021f706f3578a1e80069c8e0f73b9a0ca6a7 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in hci_sysfs.c

Follow the net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
3bb3c7551c2f1083263aee8312b3db1e751ca0fb 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in hci_sock.c

Follow the net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
be7c2b99e9cde90e398f61121f3f45d65d5644c7 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in sco.c

Follow the net subsystem rules.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
co.c
8ce8e2b56f36c737888d040016f103d91ecbfbad 17-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Bluetooth: Fix coding style in mgmt.c

Follow the coding style of the net subsystem.

Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
ddcd0f41471a1e0394c8840a119ec3986a78462c 01-Jun-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix checking the wrong flag when accepting a socket

Most probably a typo, the check should have been for BT_SK_DEFER_SETUP
instead of BT_DEFER_SETUP (which right now only represents a socket
option).

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
f_bluetooth.c
f309532bf3e1cc1b787403d84e3039812a7dbe50 03-Jun-2012 Linus Torvalds <torvalds@linux-foundation.org> tty: Revert the tty locking series, it needs more work

This reverts the tty layer change to use per-tty locking, because it's
not correct yet, and fixing it will require some more deep surgery.

The main revert is d29f3ef39be4 ("tty_lock: Localise the lock"), but
there are several smaller commits that built upon it, they also get
reverted here. The list of reverted commits is:

fde86d310886 - tty: add lockdep annotations
8f6576ad476b - tty: fix ldisc lock inversion trace
d3ca8b64b97e - pty: Fix lock inversion
b1d679afd766 - tty: drop the pty lock during hangup
abcefe5fc357 - tty/amiserial: Add missing argument for tty_unlock()
fd11b42e3598 - cris: fix missing tty arg in wait_event_interruptible_tty call
d29f3ef39be4 - tty_lock: Localise the lock

The revert had a trivial conflict in the 68360serial.c staging driver
that got removed in the meantime.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fcomm/tty.c
28f3d717618156c0dcd2f497d791b578a7931d87 24-May-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull more networking updates from David Miller:
"Ok, everything from here on out will be bug fixes."

1) One final sync of wireless and bluetooth stuff from John Linville.
These changes have all been in his tree for more than a week, and
therefore have had the necessary -next exposure. John was just away
on a trip and didn't have a change to send the pull request until a
day or two ago.

2) Put back some defines in user exposed header file areas that were
removed during the tokenring purge. From Stephen Hemminger and Paul
Gortmaker.

3) A bug fix for UDP hash table allocation got lost in the pile due to
one of those "you got it.. no I've got it.." situations. :-)

From Tim Bird.

4) SKB coalescing in TCP needs to have stricter checks, otherwise we'll
try to coalesce overlapping frags and crash. Fix from Eric Dumazet.

5) RCU routing table lookups can race with free_fib_info(), causing
crashes when we deref the device pointers in the route. Fix by
releasing the net device in the RCU callback. From Yanmin Zhang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (293 commits)
tcp: take care of overlaps in tcp_try_coalesce()
ipv4: fix the rcu race between free_fib_info and ip_route_output_slow
mm: add a low limit to alloc_large_system_hash
ipx: restore token ring define to include/linux/ipx.h
if: restore token ring ARP type to header
xen: do not disable netfront in dom0
phy/micrel: Fix ID of KSZ9021
mISDN: Add X-Tensions USB ISDN TA XC-525
gianfar:don't add FCB length to hard_header_len
Bluetooth: Report proper error number in disconnection
Bluetooth: Create flags for bt_sk()
Bluetooth: report the right security level in getsockopt
Bluetooth: Lock the L2CAP channel when sending
Bluetooth: Restore locking semantics when looking up L2CAP channels
Bluetooth: Fix a redundant and problematic incoming MTU check
Bluetooth: Add support for Foxconn/Hon Hai AR5BBU22 0489:E03C
Bluetooth: Fix EIR data generation for mgmt_device_found
Bluetooth: Fix Inquiry with RSSI event mask
Bluetooth: improve readability of l2cap_seq_list code
Bluetooth: Fix skb length calculation
...
3c2c4b73aa79e4a1b601710b59e092441175f4bb 23-May-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID subsystem updates from Jiri Kosina:
"Apart from various driver updates and added support for a number of
new devices (mostly multitouch ones, but not limited to), there is one
change that is worth pointing out explicitly: creation of HID device
groups and proper autoloading of hid-multitouch, implemented by Henrik
Rydberg."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (50 commits)
HID: wacom: fix build breakage without CONFIG_LEDS_CLASS
HID: waltop: Extend barrel button fix
HID: hyperv: Set the hid drvdata correctly
HID: wacom: Unify speed setting
HID: wacom: Add speed setting for Intuos4 WL
HID: wacom: Move Graphire raport header check.
HID: uclogic: Add support for UC-Logic TWHL850
HID: explain the signed/unsigned handling in hid_add_field()
HID: handle logical min/max signedness properly in parser
HID: logitech: read all 32 bits of report type bitfield
HID: wacom: Add LED selector control for Wacom Intuos4 WL
HID: hid-multitouch: fix wrong protocol detection
HID: wiimote: Fix IR data parser
HID: wacom: Add tilt reporting for Intuos4 WL
HID: multitouch: MT interface matching for Baanto
HID: hid-multitouch: Only match MT interfaces
HID: Create a common generic driver
HID: hid-multitouch: Switch to device groups
HID: Create a generic device group
HID: Allow bus wildcard matching
...
94b5aff4c6f72fee6b0f49d49e4fa8b204e8ded9 23-May-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge tag 'tty-3.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY updates from Greg Kroah-Hartman:
"Here's the big TTY/serial driver pull request for the 3.5-rc1 merge
window.

Nothing major in here, just lots of incremental changes from Alan and
Jiri reworking some tty core things to behave better and to get a more
solid grasp on some of the nasty tty locking issues.

There are a few tty and serial driver updates in here as well.

All of this has been in the linux-next releases for a while with no
problems.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'tty-3.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (115 commits)
serial: bfin_uart: Make MMR access compatible with 32 bits bf609 style controller.
serial: bfin_uart: RTS and CTS MMRs can be either 16-bit width or 32-bit width.
serial: bfin_uart: narrow the reboot condition in DMA tx interrupt
serial: bfin_uart: Adapt bf5xx serial driver to bf60x serial4 controller.
Revert "serial_core: Update buffer overrun statistics."
tty: hvc_xen: NULL dereference on allocation failure
tty: Fix LED error return
tty: Allow uart_register/unregister/register
tty: move global ldisc idle waitqueue to the individual ldisc
serial8250-em: Add DT support
serial8250-em: clk_get() IS_ERR() error handling fix
serial_core: Update buffer overrun statistics.
tty: drop the pty lock during hangup
cris: fix missing tty arg in wait_event_interruptible_tty call
tty/amiserial: Add missing argument for tty_unlock()
tty_lock: Localise the lock
pty: Lock the devpts bits privately
tty_lock: undo the old tty_lock use on the ctty
serial8250-em: Emma Mobile UART driver V2
Add missing call to uart_update_timeout()
...
a0d0d1685f9763ab26a394df3ab84026b39a06a7 22-May-2012 John W. Linville <linville@tuxdriver.com> Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next
028940342a906db8da014a7603a0deddc2c323dd 17-May-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
d839c81372d1f0caee47f87b26a68e91d4ff3847 16-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Report proper error number in disconnection

If encryption change fails we should disconnect with auth failure error
code.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
c5daa683f2d3315cd766f550ef7d88bfca1671f4 16-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Create flags for bt_sk()

defer_setup and suspended are now flags into bt_sk().

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
2cap_core.c
2cap_sock.c
fcomm/sock.c
c6585a4da0c709a7a9f59aab68869298b52ca1e1 07-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: report the right security level in getsockopt

During a security level elevation we need to keep track of the current
security level of a connection until the new one is not confirmed.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
a6a5568c03c4805d4d250f6bd9d468eeeb4ea059 04-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Lock the L2CAP channel when sending

The ERTM and streaming mode transmit queue must only be accessed while
the L2CAP channel lock is held. Locking the channel before calling
l2cap_chan_send ensures that multiple threads cannot simultaneously
manipulate the queue when sending and receiving concurrently.

L2CAP channel locking had previously moved to the l2cap_chan struct
instead of the associated socket, so some of the old socket locking
can also be removed in this patch.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_sock.c
ef191aded58c5e6860b01f463818584a420a4d6b 02-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Restore locking semantics when looking up L2CAP channels

As the comment for l2cap_get_chan_by_scid indicated, the function used
to return a locked socket. The lock for the socket was acquired while
the channel list was also locked.

When locking was moved over to the l2cap_chan structure, the channel
lock was no longer acquired with the channel list still locked. This
made it possible for the l2cap_chan to be deleted after
conn->chan_lock was released but before l2cap_chan_lock was called.
Making the call to l2cap_chan_lock before releasing conn->chan_lock
makes it impossible for the l2cap_chan to be deleted at the wrong
time.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
35c84d76ee52f49fe2635d8cd686b5b658e8d892 02-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix a redundant and problematic incoming MTU check

The L2CAP MTU for incoming data is verified differently depending on
the L2CAP mode, so the check is best performed in a mode-specific
context. Checking the incoming MTU before HCI fragment reassembly is
a layer violation and assumes all bytes after the standard L2CAP
header are L2CAP data.

This approach causes issues with unsegmented ERTM or streaming mode
frames, where there are additional enhanced or extended headers before
the data payload and possible FCS bytes after the data payload. A
valid frame could be as many as 10 bytes larger than the MTU.

Removing this code is the best fix, because the MTU is checked later
on for all L2CAP data frames (connectionless, basic, ERTM, and
streaming). This also gets rid of outdated locking (socket instead of
l2cap_chan) and an extra lookup of the channel ID.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
9d939d948469b49912a76e789f7d4059eb1f8bc7 26-Apr-2012 Vishal Agarwal <vishal.agarwal@stericsson.com> Bluetooth: Fix EIR data generation for mgmt_device_found

The mgmt_device_found function expects to receive only the significant
part of the EIR data so it needs to be removed before calling the
function. This patch adds a new eir_get_length() helper function to
calculate the length of the significant part.

Signed-off-by: Vishal Agarwal <vishal.agarwal@stericsson.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
a24299e6c82f624cd2c717c91f04f1d79113ada8 26-Apr-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix Inquiry with RSSI event mask

The right bit for "Inquiry with RSSI" is 0x02 and not 0x04 (which means
"Read Remote Extended Features Complete").

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
f522ae363d5f20de172ea6f9973ba4cc44801f2b 09-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: improve readability of l2cap_seq_list code

Removes one indentation level.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2d0ed3d5879edae4bf1c98eb3163466c30d41789 11-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Fix skb length calculation

When we add a fragment to a skb, len and data_len fields need to be
updated.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
087bfd99f75c5f7d5430e7e122c2f288f03d6c23 11-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Fix packet size provided to the controller

When building fragmented skb's skb->len keeps track of the size of head
plus all fragments combined, however when queueing the skb for sending we
need to report the head size instead of the total size, so we just set
skb->len to skb_headlen().

This bug appeared when implementing MSG_MORE support for L2CAP sockets, it
never showed up before because l2cap_skbuff_fromiovec() never accounted skb
size correctly. A following patch will fix this.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Reviewed-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
fbe0070092c3968927c63ab56c00b47c6aa3770f 15-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Fix wrong set of skb fragments

If alloc() fails we let the frags linked list with garbage value (the
err ptr value) in its last element.

Reported-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
08e6d907fe606b751adddce54ad8f51e0950bc3f 16-May-2012 Gustavo Padovan <gustavo.padovan@collabora.co.uk> Merge git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
d34c34fb2592bd5231a153ad1676c3ded175410a 14-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Initialize the transmit queue for L2CAP streaming mode

Commit 105bdf9ec19e729bacdb33861c74fcf3eb39eb37 introduced a
regression in L2CAP streaming mode due to rearranged initialization
code that is shared between ERTM and streaming mode. This change
makes sure the transmit queue is initialized in both modes.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
577cfaeb864874011386a05ab4f5580a6a2aeb11 14-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Update tx_send_head when sending ERTM data

Commit 94122bbe9c8c4ad7ba9f02f9a30bfc95672c404e introduced a problem
where tx_send_head was not set to point to the first skb in the ERTM
transmit queue, which stalled data transmission. This change sets
that pointer when transmission is not already in progress.

Reported-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
671267bf3aac3dae0555730b07ef29c042e325b2 12-May-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix device_connected sending order

The mgmt_ev_device_connected signal must be sent before any event
indications happen for sockets associated with the connection. Otherwise
e.g. device authorization for the sockets will fail with ENOTCONN as
user space things that there is no baseband link.

This patch fixes the issue by ensuring that the device_connected event
if sent (if it hasn't been so already) as soon as the first ACL data
packet arrives from the remote device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
ci_core.c
ci_event.c
a7d7723ae7c0178d715c06c5621e8fd8014ba92f 13-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: notify userspace of security level change

It fixes L2CAP socket based security level elevation during a
connection. The HID profile needs this (for keyboards) and it is the only
way to achieve the security level elevation when using the management
interface to talk to the kernel (hence the management enabling patch
being the one that exposes this issue).

It enables the userspace a security level change when the socket is
already connected and create a way to notify the socket the result of the
request. At the moment of the request the socket is made non writable, if
the request fails the connections closes, otherwise the socket is made
writable again, POLL_OUT is emmited.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
f_bluetooth.c
ci_event.c
2cap_core.c
2cap_sock.c
c47fc9814ca15cc075f1f09e8c069b041f2ea397 08-May-2012 Joe Perches <joe@perches.com> bluetooth: Convert compare_ether_addr to ether_addr_equal

Use the new bool function ether_addr_equal to add
some clarity and reduce the likelihood for misuse
of compare_ether_addr for sorting.

Done via cocci script:

$ cat compare_ether_addr.cocci
@@
expression a,b;
@@
- !compare_ether_addr(a, b)
+ ether_addr_equal(a, b)

@@
expression a,b;
@@
- compare_ether_addr(a, b)
+ !ether_addr_equal(a, b)

@@
expression a,b;
@@
- !ether_addr_equal(a, b) == 0
+ ether_addr_equal(a, b)

@@
expression a,b;
@@
- !ether_addr_equal(a, b) != 0
+ !ether_addr_equal(a, b)

@@
expression a,b;
@@
- ether_addr_equal(a, b) == 0
+ !ether_addr_equal(a, b)

@@
expression a,b;
@@
- ether_addr_equal(a, b) != 0
+ ether_addr_equal(a, b)

@@
expression a,b;
@@
- !!ether_addr_equal(a, b)
+ ether_addr_equal(a, b)

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
53168e5b3b40efffff8b9f2e6e0eaf5607daa884 09-May-2012 Cristian Chilipirea <cristian.chilipirea@gmail.com> Bluetooth: Fixed checkpatch warnings

Fixed some checkpatch warnings in mgmt.c.

Signed-off-by: Cristian Chilipirea <cristian.chilipirea@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
gmt.c
000092b0b4793caf831f6016fa69d25abba31e51 08-May-2012 Eldad Zack <eldad@fogrefinery.com> Bluetooth: bnep: use constant for ethertype

The dot1q ethertype number (0x8100) is embedded in the code, although
it is already defined in included headers.

Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
nep/core.c
94122bbe9c8c4ad7ba9f02f9a30bfc95672c404e 02-May-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Refactor L2CAP ERTM and streaming transmit segmentation

Use more common code for ERTM and streaming mode segmentation and
transmission, and begin using skb control block data for delaying
extended or enhanced header generation until just before the packet is
transmitted. This code is also better suited for resegmentation,
which is needed when L2CAP links are reconfigured after an AMP channel
move.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
daf6a78c161fccd058ca2f1b21e757ebaa2e9909 03-May-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded calculation and magic number

Remove magic number unneeded calculation since
hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
f2ba7fae044b578b068b40723dc3303b590abb78 03-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Remove hlen variable

hlen has a fixed size of L2CAP_HDR_SIZE, use this instead.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
9d42820f378e6372f154a3f0c8def5d4bba29191 03-May-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable Low Energy support by default

The Bluetooth Low Energy support so far was disabled by default via
a module parameter. With this change the module parameter will be removed
and Low Energy is enabled by default.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_event.c
gmt.c
2ee8ce35b1e8ba2523fa4c45fa19f9dbe321f008 20-Apr-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Remove unused hci_le_ltk_neg_reply()

No one is using hci_le_ltk_neg_reply() in bluetooth subsystem.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_conn.c
6ff9b5ef5e4e3f474689737640d0c01a96d0696d 02-May-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Remove unneeded elements from size calculation

hlen - L2CAP_HDR_SIZE = 0, so we don't need to add them in the
calculation.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
e10b9969f217c948c5523045f44eba4d3a758ff0 12-Apr-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: Remove unused hci_le_ltk_reply()

In this API, we were using sizeof operator for an array
given as function argument, which is invalid.
However this API is not used anywhere.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_conn.c
422e925b5b4201dc35bd6a647729ccd9440abb59 28-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add Code Aurora Forum copyright

Adding Code Aurora Forum copyright information due to significant
additions of code.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
61d6ef3e3408cdf7e622646fb90a9f7f9560b943 28-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Make better use of l2cap_chan reference counting

L2CAP sockets contain a pointer to l2cap_chan that needs to be
reference counted in order to prevent a possible dangling pointer when
the channel is freed.

There were a few other cases where an l2cap_chan pointer on the stack
was dereferenced after a call to l2cap_chan_del. Those pointers are
also now reference counted.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
2cap_sock.c
dbd89fddc1f1fc96085deb164b7b9b2361241dd3 28-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove unused function

l2cap_get_chan_by_ident was not used, but didn't generate a compiler
warning because it was an inline function.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
105bdf9ec19e729bacdb33861c74fcf3eb39eb37 28-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Initialize new l2cap_chan structure members

Structure members used by ERTM or streaming mode need to be
initialized when an ERTM or streaming mode link is configured. Some
duplicate code is also eliminated by moving in to the ERTM init
function.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
b5c6aaed183d6300b2cc5a107e5798aef427e5d9 26-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Move recently-added ERTM header packing functions

Moving these functions simplifies future patches by eliminating
forward declarations, makes future patches easier to review, and
better preserves 'git blame' information.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
3ce3514f5d0f90c7d856e8b0f26c6da393bbeba0 26-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove duplicate structure members from bt_skb_cb

These values are now in the nested l2cap_ctrl struct.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
479453d5fe3a5b911b7f56474764988100f9f650 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove advertising cache

User-space pass the remote device address type to kernel through
struct sockaddr_l2 what makes the advertising useless. This patch
removes all advertising cache code.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
8e9f98921c0718cda76bc53c2b51954657b60fa6 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use address type info from user-space

In order to establish a LE connection we need the address type
information. User-space already pass this information to kernel
through struct sockaddr_l2.

This patch adds the dst_type parameter to l2cap_chan_connect so we
are able to pass the address type info from user-space down to
hci_conn layer.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
2cap_sock.c
b12f62cfd9f46ac70013ce661640174b489efd39 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add dst_type parameter to hci_connect

This patch adds the dst_type parameter to hci_connect function.
Instead of searching the address type in advertising cache, we
use the dst_type parameter to establish LE connections.

The dst_type is ignored for BR/EDR connection establishment.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap_core.c
gmt.c
co.c
31f7956c6648fbae9c9550e91d1c348d28276309 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Move bdaddr_to_le to hci_core

This patch moves the helper function bdaddr_to_le to hci_core, so it
can be used in mgmt.c and hci_conn.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
378b5b7e8426f65a0ecb81b83a050c6a0c119e1f 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename mgmt_to_le to bdaddr_to_le

Since address type macros are not only related to Management
Interface anymore, it makes sense to rename the helper function
mgmt_to_le to bdaddr_to_le.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
57c1477c2c6b6c73ca40e4b23a80e3ecdfd9b684 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename link_to_mgmt to link_to_bdaddr

Since address type macros are not only related to Management
Interface anymore, it makes sense to rename the helper function
link_to_mgmt to link_to_bdaddr.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
591f47f31ba4e89fc0cce2ad90da80945ce8bf94 25-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Move address type macros to bluetooth.h

This patch moves address type macros to bluetooth.h since they will be
used by management interface and Bluetooth socket interface. It also
replaces the macro prefix MGMT_ADDR_ by BDADDR_.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b29050448a7efcedf5e8bec71c371169389a7a26 24-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove useless code in hci_connect

This patch removes unneeded variable assignments in hci_connect.
'sec_level' is already assigned to BT_SECURITY_LOW in hci_le_connect
and 'pending_sec_level' and 'auth_type' are assigned right after
if statement.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
9f0caeb1deafa9a894ee03134f6642c3a245b1af 20-Apr-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for reusing the same hci_conn for LE links

As most LE devices leave advertising mode when they enter the connected
state, we may want to "pass" that connection to other users.

The first user will be the pairing procedure, the connection is
established without an associated socket, after the pairing is
complete, userspace may want to discover via GATT what services the
newly bonded device has.

If userspace establishes the connection while the timeout still
hasn't expired, the connection will be re-used.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Tested-by: João Paulo Rechi Vita <jprvita@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_conn.c
2cap_core.c
c22876814ee9cc72f84996b78203b5530c61bee8 20-Apr-2012 Ido Yariv <ido@wizery.com> Bluetooth: Search global l2cap channels by src/dst addresses

The cid or psm and the source address might not be enough to uniquely
identify a global channel, especially when the source address is our
own.

For instance, when trying to communicate with two LE devices in master
mode, data received from the both devices is sent to the same socket.

Fix this by taking the destination address into account when choosing
the socket.

Signed-off-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Arik Nemtsov <arik@wizery.com>
Tested-by: João Paulo Rechi Vita <jprvita@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
d8ce9395252fa9a264c04e7ab9949f4f7ec96f5b 22-Apr-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Remove unneeded initialization in hci_alloc_dev()

We allocate memory with kzalloc() so there is no need to call
memset(..., 0, ...) or similar.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
b1b813d4777f4843af2acce9a1b62d486e1d3ffc 22-Apr-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Move device initialization to hci_alloc_dev()

We currently initialize locks, lists, works, etc. in hci_register_dev()
(hci_alloc_dev() was added later) which is bogus because an hdev is in an
invalid state if it is not registered.
This patch moves all memory initialization to hci_alloc_dev(). Device
registering and registration of sub-modules is still left in
hci_register_dev() as it belongs there.

The benefit is (despite cleaning up the code-base) we can now always be
sure that an hdev is a valid object and can be locked and worked on even
though it may not be registered.

This patch also reorders the initialization to be easier to understand.
First the memory is initialized, then all generic structures and as last
step the sub-init functions are called. This guarantees that all
dependencies are initialized in the right order and makes it also easier
to find a specific line. We previously initialized it in the same order as
the "struct hci_dev" is declared which seems pretty random.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
9be0dab793f52615274c357fce542b3cbf78f6d7 22-Apr-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Move hci_alloc/free_dev close to hci_register/unregister_dev

alloc() and register() (and free() and unregister()) are closely related
so move them more closely together. This will also allow to move
functionality from register() to alloc() without needing
forward-declarations.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
fb3340594bd6630c27e31ddeff25b7002fb4558e 19-Apr-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict to one SCO listening socket

The SCO sockets are only identified by its address. So only allow one
SCO socket in listening state per address or BDADDR_ANY.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
8ed21f7eece54bb80eea5e31c3d9c6c7b6517e49 19-Apr-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't check source address in SCO bind function

Checking the source address in SCO bind function will prevent from
having an incoming and outgoing SCO socket. However that might be
needed in case of multiple SCO connections on a single device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
fc50744c1e518adfb4ff2eda156f941e20aea36d 18-Apr-2012 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Fix registering hci with duplicate name

When adding HCI devices hci_register_dev assigns the same name
hci1 for subsequently added AMP devices.

...
[ 6958.381886] sysfs: cannot create duplicate filename
'/devices/virtual/bluetooth/hci1
...

We assume id starts with the number we'll try to add the new device
and keep iterating until we find the proper place. The only difference
is we start with 0 for BR/EDR device and 1 for AMP devices (thus AMP
devices will never receive register as index 0). Then every hdev->id in
the _ordered_ list <= to the id we want we increment id and move the
variable head. In the end we'll have id as the first available one and
head is where you need to add hdev after to keep the list ordered.

Reported-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
519e42b38ee47005aaa2243789cda54161e62dc8 19-Apr-2012 Lukasz Rymanowski <lukasz.rymanowski@tieto.com> Bluetooth: Remove not needed status parameter

Sco_conn_add is called from two places and always with status = 0.

Signed-off-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
7d5d775a55554183448b591a86b1d172ae993b94 19-Apr-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Split error handling for SCO listen sockets

Split the checks for sk->sk_state and sk->sk_type for SCO listen
sockets. This makes the code more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
6b3af7334bd3c403647606adfb04f6e6bcf1597e 19-Apr-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Split error handling for L2CAP listen sockets

Split the checks for sk->sk_state and sk->sk_type for L2CAP listen
sockets. This makes the code more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_sock.c
35d4adcca1707c551f4598f68fe83118dd82cd60 18-Apr-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Don't distribute keys in case of Encryption Failure

SMP Keys should only be distributeed when encryption is successful.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
2d8b3a11623cf5203bc063927b6fc742625f1ebf 16-Apr-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix debug printing unallocated name

It does make sense to print hdev name after allocation.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
4596fde5401679f062336c6dbad8d9e4043858c2 16-Apr-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: mgmt: Fix address type while loading Long Term Key

This patch fixes the address type while loading long term keys when BT is
switched on. Without this fix pairing is reinitated even though LTK
exists for remote device because of mismatch of address type.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
0c01bc486a6f5f397732f808ecbcd63665c605d8 12-Apr-2012 Syam Sidhardhan <s.syam@samsung.com> Bluetooth: mgmt: Remove unwanted goto statements

Remove goto statements that do nothing else than jump to the next line
of code.

Signed-off-by: Syam Sidhardhan <s.syam@samsung.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
5c94f379c11a7ecfdb7c0cadbb3bb5f749e20732 14-Apr-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: remove unneeded declaration of sco_conn_del()

By some reason this is not needed anymore.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
088ce088ec115ee4bc89549b07b182e65dce9235 11-Apr-2012 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Remove unnecessary check

The function already fails if the given size is greater than the MTU, so
there is no need to consider that case afterwards.

Signed-off-by: Mikel Astiz <mikel.astiz.oss@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
co.c
abc5de8f4e68ea785e32b91e456f467d2a2fb7db 11-Apr-2012 Mikel Astiz <mikel.astiz@bmw-carit.de> Bluetooth: Use unsigned int instead of signed int

The involved values are all unsigned and thus unsigned int should be
used instead of signed int. Assigning ~0 to a signed int results in -1,
which is confusing and error-prone, while the code is trying to set the
maximum value possible.

The code still works because the C standard defines that unsigned
comparison will be performed in these cases, when comparing an unsigned
int and a signed int.

Signed-off-by: Mikel Astiz <mikel.astiz.oss@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_core.c
b76bbd6657a2dd7545686ba9ad59625f44192146 11-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Functions for handling ERTM control fields

These functions encode or decode ERTM control fields (extended or
enhanced) to or from the new l2cap_ctrl structure.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
3c588192b5e5328cdfc8e299c55477004d397208 11-Apr-2012 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add the l2cap_seq_list structure for tracking frames

A sequence list is a data structure used to track frames that need to
be retransmitted, and frames that have been requested for
retransmission by the remote device. It can compactly represent a
list of sequence numbers within the ERTM transmit window. Memory for
the list is allocated once at connection time, and common operations
in ERTM are O(1).

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
9033894722ec595053c92bfa4359b37e7bc91b78 07-Apr-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Remove err parameter from alloc_skb()

Use ERR_PTR maginc instead.

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
bd4b165312bacbf1e732cbc22c141362cfb5fda3 28-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Adds set_default function in L2CAP setup

Some parameters in L2CAP chan are set to default similar way in
socket based channels and A2MP channels. Adds common function which
sets all defaults.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
2cap_sock.c
6bcbc4893fe8a6be3c3c5a83449d79dc9e9a51ac 28-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add Read Local AMP Info to init

AMP Info will be used in Discovery Response.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_core.c
328c9248bfa7f5e1490ee82e9027e14c3ecc0485 05-Apr-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: mgmt: Fix missing connect failed event for LE

This patch adds management connect failed event when LE Create Connection
Command fails to inform user space that LE Connection failed to get
established.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
b24c62471c276b7ac6105e832eb6fe3c41a654ef 05-Apr-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Fix clearing discovery type when stopping discovery

This patch prevents resetting of discovery type while stopping
discovery, since otherwise the wrong type might be send in case of
discovery failure. It also doesn't matter that we are "lazy" with
updating the type since it is anyway reset when starting discovery again
and it's not needed to know the current discovery state.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
0ed09148fa61e01cd27c92933ba275ea8078b34d 03-Apr-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove MGMT_ADDR_INVALID macro

This patch removes the MGMT_ADDR_INVALID macro. If the address type
isn't LE, we consider it is BR/EDR type.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
eb19aaacb3f88dbd69e1cd9a2b1f054d4dade678 30-Mar-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Send correct address type for LTK

This patch updates the address type sent from kernel to management
interface of BlueZ while sending the Long Term Key.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
3a602a00a4a9d531b4a71ceed487d84103e4b141 28-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded zero initialization

Remove zero initialization since channel is allocated with kzalloc
in l2cap_chan_create.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_sock.c
053262dce5a0cc503456d15e204cde205dcf927e 27-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update management interface revision

For each kernel release where commands or events are added to the
management interface, the revision field should be increment by one.

The increment should only happen once per kernel release and not
for every command/event that gets added. The revision value is for
informational purposes only, but this simple policy would make any
future debugging a lot simple.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
eef1d9b668c51dcae58d8bb41ce0c805f866dbbd 25-Mar-2012 Gustavo Padovan <gustavo@padovan.org> Bluetooth: Remove sk parameter from l2cap_chan_create()

Following the separation if core and sock code this change avoid
manipulation of sk inside l2cap_chan_create().

Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
2cap_sock.c
14a284918416e480bf49f8c05dfeefa02640d2d6 23-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Make L2CAP chan_add functions static

Remove sparse warnings below:

...
net/bluetooth/l2cap_core.c:302:6: warning: symbol '__l2cap_chan_add' was
not declared. Should it be static?
net/bluetooth/l2cap_core.c:351:6: warning: symbol 'l2cap_chan_add' was
not declared. Should it be static?
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
bcd11ff7c2f7bf3d18fc9053994466e09b2d42d3 21-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded timer clear

set_chan_timer clears timer itself

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
1519cc177a05b96d8715c3cda244c46d6457efbb 21-Mar-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Ignore inquiry results from periodic inquiry

This patch changes inquiry result function handlers so they ignore
inquiry result events if periodic inquiry is enabled.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_event.c
642be6c768bd686577ffe6ebcc5e6132a932537b 21-Mar-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Check HCI_PERIODIC_INQ in start_discovery

This patch adds a HCI_PERIODIC_INQ check to start_discovery.
If periodic inquiry is enabled, we fail MGMT Start Discovery
command with MGMT_STATUS_BUSY code.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
gmt.c
ae854a70df3e2183a8db7a98a0deceee111c4542 21-Mar-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Add HCI_PERIODIC_INQ to dev_flags

This patch adds the HCI_PERIODIC_INQ flag to dev_flags. This flag
tracks if periodic inquiry is enabled or not.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_event.c
4d93483b1c593a5ee5b3f917c26dbaad59dadde2 21-Mar-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Add Periodic Inquiry command complete handler

This patch adds a handler function to Periodic Inquiry command
complete event.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_event.c
e0d9727edb3b66865989a1f592c06606392146ca 20-Mar-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Refactor stop_discovery

This patch does a trivial code refactoring in stop_discovery
function by using a switch statement instead of an if-return-else
approach.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
gmt.c
7537e5c3064c5a5751a7b26aba82ad83c5e89190 20-Mar-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Replace EPERM by EALREADY in hci_cancel_inquiry

We should return -EALREADY in hci_cancel_inquiry since it is more
suitable than -EPERM error code.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_core.c
3e9fb6d87ee543b10bcf245d4a5c6aa1ab0ac2ab 20-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Silence sparse warning

Silence sparse warning shown below:
...
net/bluetooth/mgmt.c:448:15: warning: cast to restricted __le32
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
gmt.c
c72d4b8afa8002cd6f64225954bee78296321e7e 16-Mar-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: mgmt: Don't allow to set invalid value to DeviceID source

Reply with MGMT_STATUS_INVALID_PARAMS when userspace is trying to set
source with out-of-scope value.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
d97dcb66001222efa79e55f5260b9b660fd452a4 16-Mar-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: mgmt: Fix some code style and indentation issues

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
c9ecc48e2f3577a73dcd830d8b67ecc48e224465 15-Mar-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: LE support for MGMT stop discovery

This patch adds LE support to MGMT stop discovery command. So,
now we are able to cancel LE discovery procedures (LE-only and
interleaved).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
7dbfac1d720d3ea68e00e187bbd2f1147257528b 15-Mar-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add hci_cancel_le_scan() to hci_core

This patch adds to hci_core the hci_cancel_le_scan function which
should be used to cancel an ongoing LE scan.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2e3c35ead821498f5b0a5b6c62365fbb187420fc 14-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Remove sparse warnings

Fix sparse warnings related to incorrect type in assignment and static
symbol. Also use const keyword. Warnings are shown below:

...
net/bluetooth/mgmt.c:305:28: warning: incorrect type in assignment
(different base types)
net/bluetooth/mgmt.c:305:28: expected unsigned short [usertype] *opcode
net/bluetooth/mgmt.c:305:28: got restricted __le16 *<noident>
...
net/bluetooth/mgmt.c:2609:3: warning: symbol 'mgmt_handlers' was not declared.
Should it be static?
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
1f350c8724881fe6b1be9aa68d1e49508a6f8ab9 13-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix broken usage of get_unaligned_le16

In case the struct is already __packed, there is no need to use unaligned
access to the data. So just use __le16_to_cpu in these cases.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
1036b89042df96e71c0cb941be212f8053ecccc0 12-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix opcode access in hci_complete

opcode to be accessed is in le16 format so convert it
first to cpu byte order.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
035100c8a808e5484ca0848cebed91783e1868cf 12-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix type in cpu_to_le conversion

Use struct hci_cp_write_def_link_policy to overcome sparse
warnigs below:

...
net/bluetooth/hci_event.c:633:21: warning: incorrect type in assignment
(different base types)
net/bluetooth/hci_event.c:633:21: expected unsigned short [unsigned]
[assigned] [usertype] link_policy
net/bluetooth/hci_event.c:633:21: got restricted __le16 [usertype] <noident>
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
739f43e860748f0e86034512d65ca480581b1b35 12-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Correct types

Fix sparse warnigns below:
...
net/bluetooth/hci_sysfs.c:458:33: warning: cast to restricted __be32
net/bluetooth/hci_sysfs.c:458:47: warning: cast to restricted __be16
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
4fd21a88e311c03241f323f64aef643fcd5f149d 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Fix endian conversion mode

In L2CAP we use le16 format so change direction of conversion
from le16_to_cpu to cpu_to_le16.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
8ce0c498aa6f40db119d5eb60aa9e7de5e66880e 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Convert error codes to le16

Create Chan Rsp shall put result and status in le format.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
d9b887020eb54eeb78d222c862ef2dc65b8e0ebe 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct CID endian notation

L2CAP channel id is used in host format in internal L2CAP code.
Fix sparse warnings about wrong endian conversion.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
61386cba0fae4744b8e2f52c4911fe3af9ff6c54 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct length calc in L2CAP conf rsp

cmd->len is in le format so convert it to host format before use.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
58115373e74c7ee18d0f54f00831649a6471a899 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct ediv in SMP

ediv is already in little endian order.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
eb55ef07a211eea95088eb0e6cdbd53cd65d9755 14-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix broken usage of put_unaligned_le16

In case the struct is already __packed, there is no need to use
unaligned access to the data. So just use cpu_to_le16 or
__constant_cpu_to_le16 in these cases.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cdbaccca733c9dde3faf150150102dade311c91f 12-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add management command for setting Device ID

The Device ID details need to be programmed into the kernel for every
controller at least once. So provide management command for this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
2b9be137b70bef9ec7835d83e225d8b35ba9c7ae 12-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Handle EIR tags for Device ID

The Device ID information can be provided via Extended Inquiry Data
as well. If a valid source is present, then include it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
91c4e9b1ac595f83681c9a9de691e0f30eeafb44 12-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add TX power tag to EIR data

The Inquiry Response TX power tag should be added to the Extended
Inquiry Data (EIR) as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
6935e0f5181644201894f0b7fbe3d8910c18af05 09-Mar-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Remove redundant hdev->parent field

We initialize the "struct device" in hci_alloc_dev() for a long time now
so we can access hdev->dev.parent directly. Hence, we can drop the
temporary field hdev->parent which is used in no other place than
hci_add_sysfs().

SET_HCIDEV_DEV() is never called after registering a device by the
drivers so we do not overwrite internal device-state. Furthermore,
hdev->dev is initialized to 0 by kzalloc() inside hci_alloc_dev() so the
default behavior with dev.parent = NULL is kept.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
bc3dd33cef001e61da0f71b5d8f918b3dbaa4a94 06-Mar-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check FINDING state in interleaved discovery

In order to do interleaved discovery we should be in DISCOVERY_
FINDING state. Otherwise, discovery should be stopped.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
097db76cdccd8107784e2c845b838ab333be02dc 09-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct chan->psm endian conversions

chan->psm is kept in __le16 format which was not always taken
into account. Fix several bugs related to extra conversion.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
78e8098e7b8db6a7dc01406464329c37d3b4973d 09-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix extra conversion to __le32

Value to be converted is already in __le32 format.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
9a0066579270584108f1f2f97d98fe989d8117df 08-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct type for ediv to __le16

Correct type warnings reported by sparse to show that this
functions takes ediv argument in __le16 format.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
e46668819c1bd5930720a7e020e2a45291f9de4f 09-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Correct endian conversion

Correct endian conversion reported by sparse

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
d29f3ef39be4eec0362b985305fc526d9be318cf 03-May-2012 Alan Cox <alan@linux.intel.com> tty_lock: Localise the lock

In each remaining case the tty_lock is associated with a specific tty. This
means we can now lock on a per tty basis. We do need tty_lock_pair() for
the pty case. Uglier but still a step in the right direction.

[fixed up calls in 3 missing drivers - gregkh]

Signed-off-by: Alan Cox <alan@linux.intel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
8215d557e5f3a70e50e07c857d35c250fee62a73 23-Apr-2012 Henrik Rydberg <rydberg@euromail.se> HID: Create a common generic driver

Move the hid drivers of the bus drivers to a common generic hid
driver, and make it a proper module. This ought to simplify device
handling moving forward.

Cc: Gustavo Padovan <gustavo@padovan.org>
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
070748ed0b52399858a5967026a452bbb903a64c 23-Apr-2012 Henrik Rydberg <rydberg@euromail.se> HID: Create a generic device group

Devices that do not have a special driver are handled by the generic
driver. This patch does the same thing using device groups; Instead of
forcing a particular driver, the appropriate driver is picked up by
udev. As a consequence, one can now move a device from generic to
specific handling by a simple rebind. By adding a new device id to the
generic driver, the same thing can be done in reverse.

Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Acked-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
4dcc0637fc3c36c1f58ffdcaf2dc0dc7de72449f 27-Apr-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
16cde9931bcd8d8ca968ef1cded02684ea040374 13-Apr-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix missing break in hci_cmd_complete_evt

Command complete event for HCI_OP_USER_PASSKEY_NEG_REPLY would result
in calling handler function also for HCI_OP_LE_SET_SCAN_PARAM. This
could result in undefined behaviour.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
ci_event.c
665ab0f3c8b8f86bb77b25285ac93870c7054d63 19-Apr-2012 Greg Kroah-Hartman <gregkh@linuxfoundation.org> Merge 3.4-rc3 into tty-next

This allows us to pick up some changes needed for other serial patches.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
6ec5bcadc21e13ceba8c144e4731eccac01d04f7 16-Apr-2012 Vishal Agarwal <vishal.agarwal@stericsson.com> Bluetooth: Temporary keys should be retained during connection

If a key is non persistent then it should not be used in future
connections but it should be kept for current connection. And it
should be removed when connecion is removed.

Signed-off-by: Vishal Agarwal <vishal.agarwal@stericsson.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
745c0ce35f904aeff8e1ea325c259a14a00ff1b7 13-Apr-2012 Vishal Agarwal <vishal.agarwal@stericsson.com> Bluetooth: hci_persistent_key should return bool

This patch changes the return type of function hci_persistent_key
from int to bool because it makes more sense to return information
whether a key is persistent or not as a bool.

Signed-off-by: Vishal Agarwal <vishal.agarwal@stericsson.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
41833af713457fe92f432a7354bc690587652879 09-Apr-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
f997a01e3272f08cbbf77392b846878332dafc22 02-Apr-2012 Jiri Slaby <jslaby@suse.cz> TTY: rfcomm/tty, use count from tty_port

This means converting an atomic counter to a counter protected by
lock. This is the first step needed to convert the rest of the code to
the tty_port helpers.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
b2c4be398bf771a09f84eae6cf12cbd685384b8d 02-Apr-2012 Jiri Slaby <jslaby@suse.cz> TTY: rfcomm/tty, remove work for tty_wakeup

tty_wakeup is safe to be called from all contexts. No need to schedule
a work for that. Let us call it directly like in other drivers.

This allows us to kill another member of rfcomm_dev structure.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
67054019289ff11a7ffbc1a5d3c95aeb36e2f03e 02-Apr-2012 Jiri Slaby <jslaby@suse.cz> TTY: rfcomm/tty, use tty_port refcounting

Switch the refcounting from manual atomic plays with refcounter to the
one offered by tty_port.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
f60db8c4246ac7c33448fad173bed85354b7d75e 02-Apr-2012 Jiri Slaby <jslaby@suse.cz> TTY: rfcomm/tty, add tty_port

And use tty from there.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
a591afc01d9e48affbacb365558a31e53c85af45 30-Mar-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x32 support for x86-64 from Ingo Molnar:
"This tree introduces the X32 binary format and execution mode for x86:
32-bit data space binaries using 64-bit instructions and 64-bit kernel
syscalls.

This allows applications whose working set fits into a 32 bits address
space to make use of 64-bit instructions while using a 32-bit address
space with shorter pointers, more compressed data structures, etc."

Fix up trivial context conflicts in arch/x86/{Kconfig,vdso/vma.c}

* 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (71 commits)
x32: Fix alignment fail in struct compat_siginfo
x32: Fix stupid ia32/x32 inversion in the siginfo format
x32: Add ptrace for x32
x32: Switch to a 64-bit clock_t
x32: Provide separate is_ia32_task() and is_x32_task() predicates
x86, mtrr: Use explicit sizing and padding for the 64-bit ioctls
x86/x32: Fix the binutils auto-detect
x32: Warn and disable rather than error if binutils too old
x32: Only clear TIF_X32 flag once
x32: Make sure TS_COMPAT is cleared for x32 tasks
fs: Remove missed ->fds_bits from cessation use of fd_set structs internally
fs: Fix close_on_exec pointer in alloc_fdtable
x32: Drop non-__vdso weak symbols from the x32 VDSO
x32: Fix coding style violations in the x32 VDSO code
x32: Add x32 VDSO support
x32: Allow x32 to be configured
x32: If configured, add x32 system calls to system call tables
x32: Handle process creation
x32: Signal-related system calls
x86: Add #ifdef CONFIG_COMPAT to <asm/sys_ia32.h>
...
76ec9de843c3cff41b3b15b752e1d08d91f0ad18 11-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: mgmt: Add missing endian conversion

Add missing endian conversion for page scan interval and window.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
531563850b29726bf37a81e877277902881ab77e 09-Mar-2012 Brian Gix <bgix@codeaurora.org> Bluetooth: mgmt: Fix corruption of device_connected pkt

Incorrect pointer passed to eir_append_data made mgmt_device_connected
event unparsable by mgmt user space entity.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
9ffc93f203c18a70623f21950f1dd473c9ec48cd 28-Mar-2012 David Howells <dhowells@redhat.com> Remove all #inclusions of asm/system.h

Remove all #inclusions of asm/system.h preparatory to splitting and killing
it. Performed with the following command:

perl -p -i -e 's!^#\s*include\s*<asm/system[.]h>.*\n!!' `grep -Irl '^#\s*include\s*<asm/system[.]h>' *`

Signed-off-by: David Howells <dhowells@redhat.com>
nep/sock.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
2cap_core.c
fcomm/sock.c
co.c
8d7e1c7f7e5f9fe8f6279752fc33fcb77afd5001 23-Mar-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix memory leaks due to chan refcnt

When we queue delayed work we hold(chan) and delayed work
shall put(chan) after execution.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
2cap_core.c
94324962066231a938564bebad0f941cd2d06bb2 15-Mar-2012 Johan Hovold <jhovold@gmail.com> Bluetooth: hci_core: fix NULL-pointer dereference at unregister

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[ 79.627136] INFO: trying to register non-static key.
[ 79.632354] the code is fine but needs lockdep annotation.
[ 79.638122] turning off the locking correctness validator.
[ 79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
[ 79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
[ 79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
[ 79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ 79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ 79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ 79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ 79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ 79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ 79.723358] 1fa0: 0001e6a0 be8dab00 0001e698 00036698
[ 79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ 79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 79.756011] pgd = cf3b4000
[ 79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[ 79.765502] Internal error: Oops: 80000007 [#1]
[ 79.770294] Modules linked in:
[ 79.773529] CPU: 0 Tainted: G W (3.3.0-rc6-00002-gb5d5c87 #421)
[ 79.781066] PC is at 0x0
[ 79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[ 79.788787] pc : [<00000000>] lr : [<c0040aa4>] psr: 60000113
[ 79.788787] sp : cf281ee0 ip : 00000000 fp : cf280000
[ 79.800903] r10: 00000004 r9 : 00000100 r8 : b6f234d0
[ 79.806427] r7 : c0519c28 r6 : cf093488 r5 : c0561a00 r4 : 00000000
[ 79.813323] r3 : 00000000 r2 : c054eee0 r1 : 00000001 r0 : 00000000
[ 79.820190] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 79.827728] Control: 10c5387d Table: 8f3b4019 DAC: 00000015
[ 79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[ 79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[ 79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[ 79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[ 79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[ 79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[ 79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[ 79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[ 79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[ 79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[ 79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ 79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ 79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ 79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ 79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ 79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ 79.973083] 1fa0: 0001e6a0 be8dab00 0001e698 00036698
[ 79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ 79.997161] Code: bad PC value
[ 80.000396] ---[ end trace 6f6739840475f9ee ]---
[ 80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Cc: stable <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
6e4aff103774d6ee937a1dba9b1b4bf89100e7f6 01-Mar-2012 Santosh Nayak <santoshprasadnayak@gmail.com> Bluetooth: Fix Endian Bug.

Fix network to host endian conversion for L2CAP chan id.

Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
3b59bf081622b6446db77ad06c93fe23677bc533 21-Mar-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking merge from David Miller:
"1) Move ixgbe driver over to purely page based buffering on receive.
From Alexander Duyck.

2) Add receive packet steering support to e1000e, from Bruce Allan.

3) Convert TCP MD5 support over to RCU, from Eric Dumazet.

4) Reduce cpu usage in handling out-of-order TCP packets on modern
systems, also from Eric Dumazet.

5) Support the IP{,V6}_UNICAST_IF socket options, making the wine
folks happy, from Erich Hoover.

6) Support VLAN trunking from guests in hyperv driver, from Haiyang
Zhang.

7) Support byte-queue-limtis in r8169, from Igor Maravic.

8) Outline code intended for IP_RECVTOS in IP_PKTOPTIONS existed but
was never properly implemented, Jiri Benc fixed that.

9) 64-bit statistics support in r8169 and 8139too, from Junchang Wang.

10) Support kernel side dump filtering by ctmark in netfilter
ctnetlink, from Pablo Neira Ayuso.

11) Support byte-queue-limits in gianfar driver, from Paul Gortmaker.

12) Add new peek socket options to assist with socket migration, from
Pavel Emelyanov.

13) Add sch_plug packet scheduler whose queue is controlled by
userland daemons using explicit freeze and release commands. From
Shriram Rajagopalan.

14) Fix FCOE checksum offload handling on transmit, from Yi Zou."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1846 commits)
Fix pppol2tp getsockname()
Remove printk from rds_sendmsg
ipv6: fix incorrent ipv6 ipsec packet fragment
cpsw: Hook up default ndo_change_mtu.
net: qmi_wwan: fix build error due to cdc-wdm dependecy
netdev: driver: ethernet: Add TI CPSW driver
netdev: driver: ethernet: add cpsw address lookup engine support
phy: add am79c874 PHY support
mlx4_core: fix race on comm channel
bonding: send igmp report for its master
fs_enet: Add MPC5125 FEC support and PHY interface selection
net: bpf_jit: fix BPF_S_LDX_B_MSH compilation
net: update the usage of CHECKSUM_UNNECESSARY
fcoe: use CHECKSUM_UNNECESSARY instead of CHECKSUM_PARTIAL on tx
net: do not do gso for CHECKSUM_UNNECESSARY in netif_needs_gso
ixgbe: Fix issues with SR-IOV loopback when flow control is disabled
net/hyperv: Fix the code handling tx busy
ixgbe: fix namespace issues when FCoE/DCB is not enabled
rtlwifi: Remove unused ETH_ADDR_LEN defines
igbvf: Use ETH_ALEN
...

Fix up fairly trivial conflicts in drivers/isdn/gigaset/interface.c and
drivers/net/usb/{Kconfig,qmi_wwan.c} as per David.
843ec558f91b8e8fdb6efc908f2c0506407cc750 20-Mar-2012 Linus Torvalds <torvalds@linux-foundation.org> Merge tag 'tty-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull TTY/serial patches from Greg KH:
"tty and serial merge for 3.4-rc1

Here's the big serial and tty merge for the 3.4-rc1 tree.

There's loads of fixes and reworks in here from Jiri for the tty
layer, and a number of patches from Alan to help try to wrestle the vt
layer into a sane model.

Other than that, lots of driver updates and fixes, and other minor
stuff, all detailed in the shortlog."

* tag 'tty-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (132 commits)
serial: pxa: add clk_prepare/clk_unprepare calls
TTY: Wrong unicode value copied in con_set_unimap()
serial: PL011: clear pending interrupts
serial: bfin-uart: Don't access tty circular buffer in TX DMA interrupt after it is reset.
vt: NULL dereference in vt_do_kdsk_ioctl()
tty: serial: vt8500: fix annotations for probe/remove
serial: remove back and forth conversions in serial_out_sync
serial: use serial_port_in/out vs serial_in/out in 8250
serial: introduce generic port in/out helpers
serial: reduce number of indirections in 8250 code
serial: delete useless void casts in 8250.c
serial: make 8250's serial_in shareable to other drivers.
serial: delete last unused traces of pausing I/O in 8250
pch_uart: Add module parameter descriptions
pch_uart: Use existing default_baud in setup_console
pch_uart: Add user_uartclk parameter
pch_uart: Add Fish River Island II uart clock quirks
pch_uart: Use uartclk instead of base_baud
mpc5200b/uart: select more tolerant uart prescaler on low baudrates
tty: moxa: fix bit test in moxa_start()
...
2f16669d322e05171c9e1cfd94f402f7399bd2a3 05-Mar-2012 Jiri Slaby <jslaby@suse.cz> TTY: remove re-assignments to tty_driver members

All num, magic and owner are set by alloc_tty_driver. No need to
re-set them on each allocation site.

pti driver sets something different to what it passes to
alloc_tty_driver. It is not a bug, since we don't use the lines
parameter in any way. Anyway this is fixed, and now we do the right
thing.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fcomm/tty.c
fdde0a26a218d95e2ea38c0838ab6f24040af14c 05-Mar-2012 Ido Yariv <ido@wizery.com> Bluetooth: Set security level on incoming pairing request

If a master would like to raise the security level, it will send a
pairing request. While the pending security level is set on an incoming
security request (from a slave), it is not set on a pairing request. As
a result, the security level would not be raised on the slave in such
case.

Fix this by setting the pending security when receiving pairing
requests according to the requested authorization.

Signed-off-by: Ido Yariv <ido@wizery.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
b3ff53ff006b7906c88adf9d0fccc06a8877fae1 05-Mar-2012 Ido Yariv <ido@wizery.com> Bluetooth: Fix access to the STK generation methods matrix

The major index of the table is actually the remote I/O capabilities, not
the local ones. As a result, devices with different I/O capabilities
could have used wrong or even unsupported generation methods.

Signed-off-by: Ido Yariv <ido@wizery.com>
CC: Brian Gix <bgix@codeaurora.org>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
e57d758ae8e8f00e80f233c823aeeef34bd92796 07-Mar-2012 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: Fix using uninitialized variable

+ src/net/bluetooth/rfcomm/tty.c: warning: 'p' is used uninitialized in this
function: => 218
+ src/net/bluetooth/rfcomm/tty.c: warning: 'p' may be used uninitialized in
this function: => 218

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/tty.c
04124681f104c1980024ff249a34a77a249fd2bc 08-Mar-2012 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix conding style issues all over the tree

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
2cap_core.c
2cap_sock.c
gmt.c
mp.c
74fe619ef96466d562a1a13e7cbab783624ec2f3 01-Mar-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Don't force DISCOVERY_STOPPED state in inquiry_cache_flush

We are not supposed to force DISCOVERY_STOPPED in inquiry_cache_flush
because we may break the discovery state machine. For instance, during
interleaved discovery, when we are about to start inquiry, the state
machine forcibly goes to DISCOVERY_STOPPED while it should stay in
DISCOVERY_FINDING state.

This problem results in unexpected behaviors such as sending two
mgmt_discovering events to userspace (when only one event is expected)
and Stop Discovery failures.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
2b4bf3974249da74f4aef1e9180d4beaf6332515 02-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix updating local name when powering on

When powering on we need to apply whatever name has been set through
mgmt_set_local_name. The appropriate place for this is mgmt_powered()
and not hci_setup() since this needs to be applied also if the HCI init
sequence was already completed but the adapter was still "powered off"
from a mgmt perspective due the the HCI_AUTO_OFF still being set.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
4f87da80a5210e66fb47b0e839f4d05016986f78 02-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove HCI_PI_MGMT_INIT flag for sockets

This flag is of no use right now and is in fact harmful in that it
prevents the HCI_MGMT flag to be set for any controllers that may need
it after the first one that bluetoothd takes into use (the flag is
cleared for the first controller so any subsequent ones through the same
bluetoothd mgmt socket never get the HCI_MGMT flag set).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
gmt.c
5f15903279143eb640f9ba1c0e72b52fe9e9e2a6 02-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add new error code for invalid index

The index is part of the command header and not its parameters so it
makes sense to distinguish this from the invalid parameters error.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d4f68526e438dbb7d194b08499a96c733131ad72 02-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix command status error code values

Error codes in the command status should always be from the set of
values defined for mgmt and never e.g. POSIX error codes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
9f8ce967caed427f78d00bb6b07d79cb040a88bd 02-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing of HCI_PENDING_CLASS flag

When doing reset HCI_PENDING_CLASS is one of the flags that should be
cleared (since it's used for a pending HCI command and a reset clear all
pending commands).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
17b02e625662906f370a3eb5e7495cf06ed7d4a4 01-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update MGMT and SMP timeout constants to use msecs_to_jiffies

The MGMT and SMP timeout constants are always used in form of jiffies. So
just include the conversion from msecs in the define itself. This has the
advantage of making the code where the timeout is used more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
mp.c
ba13ccd9b911e043c0f11e60cbb72bd4de194205 01-Mar-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update L2CAP timeout constants to use msecs_to_jiffies

The L2CAP timeout constants are always used in form of jiffies. So just
include the conversion from msecs in the define itself. This has the
advantage of making the code where the timeout is used more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
be22b54e8711734f4cb93ac31723b955fe9dbbe0 01-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Centralize message length checks

This patch moves the command length information into the command handler
table allowing the removal of length checks from the handler functions
and doing the check in a single place before calling the handler
function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
0f4e68cf6e70fc219f219799c799a8a3e3c13100 28-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Move command handlers into a table

By moving the command handlers into a table (the index being equal to
the opcode) the lookup is made a bit more efficient. Having a struct to
describe each handler also paves the way to add more meta-data for each
handler, e.g. the minimum message size for the command and allow
handling of common tasks like this in a centralized place.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6a919082e9b82a0de20f1248a33f3b3f005cebaf 28-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Initialize HCI_MGMT flag for any command

The read_controller_info is typically the first command that user space
sends when taking a controller into use. This is also the reason why
this command has been used as the trigger to set the HCI_MGMT flag.
However, when not running the user-space daemon and using command line
tools it is possible that read_controller_info is not the first
controller specific command. This patch moves the HCI_MGMT
initialization to a generic place where it will be set for whatever
happens to be the first mgmt command targetting a specific controller.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
bdb6d97154b7b7e98867e9b71bae0f47ec70b1d7 28-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Refactor hci_dev lookup for commands

Almost all mgmt commands need to lookup a struct hci_dev based on the
index received within the mgmt headers. It makese therefore sense to
look this up in a single place and then just pass the hdev pointer to
each command handler function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
75fb0e324daa48ec458fb5c2960eb07b80cfad9d 01-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix init sequence for some CSR based controllers

Some CSR controllers will generate a spontaneous reset during init and
just eat up any pending command without sending a command complete for
it. This patch solves the issue by just resending whatever was the last
sent command. hci_send_cmd is not used since we need to bypass all other
commands in the send queue.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
8b90129cc5789a4c65547c91c9a7b1fd3a4d56a4 23-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check capabilities in BR/EDR and LE-Only discovery

This patch add an extra check for BR/EDR and LE-Only discovery.
This way, we are able to return error immediately if the discovery
type requested is not supported by the device.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
1de028ceb54ccd28cc96f1530a195ae1b6a6d5b5 01-Mar-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add missing hci_dev locking to set_le()

The set_le() function was missing hci_dev locking which is e.g. critical
for the mgmt pending command adding/removing.

Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
00abfe4442864144a77f70b6b411d691bcb796bf 01-Mar-2012 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix coding style with breaking lines

Our limit is 80 and broken lines should as right as possible.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
53bf2426b4122d933213bba78bf736e88f7dc929 29-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix Kconfig help description

SMP is not a kernel module, it is part of Bluetooth Core (as already
described in lines above).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
config
95b23582d796305c66952188de2f5159b28be766 12-Feb-2012 Szymon Janc <szymon@janc.net.pl> Bluetooth: Use NULL instead of integer for mgmt_device_connected param

Last param of mgmt_device_connected is of pointer type, so use NULL
instead of 0 for it. This fix following sparse warning:

CHECK net/bluetooth/hci_event.c
net/bluetooth/hci_event.c:3262:74: warning: Using plain integer as NULL pointer

Signed-off-by: Szymon Janc <szymon@janc.net.pl>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
426c189a1b34c0d36d5eddbe1c35bc961b1a1b68 24-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Change interleaved discovery behavior

According to last discussion on IRC, if an interleaved discovery is
issued, but the device is not dual mode, we should return error
instead of performing a regular BR/EDR or LE-only discovery.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
978c93b90fc4768e295b20492b5db76d5e026e5e 29-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Save remote L2CAP fixed channel mask

Fixed channel mask needs to be stored to decide whether to
use A2MP for example. So far save only one relevant byte which
keeps all information we need.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
89bb46d02046b59c1de3d2e92680f3a1062750d0 28-Feb-2012 Dan Carpenter <dan.carpenter@oracle.com> Bluetooth: change min_t() cast in hci_reassembly()

"count" is type int so the cast to __u16 truncates the high bits away
and triggers a Smatch static checker warning. It looks like a high
value of count could cause a forever loop, but I didn't follow it
through to see if count is capped somewhere.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
3379013bcfceb3c0365a3cf03543d6c67b84fc34 28-Feb-2012 Dan Carpenter <dan.carpenter@oracle.com> Bluetooth: use kfree_skb() instead of kfree()

sk_buffs should be freed using kfree_skb().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
02b7cc62b6176748dc5b55e0ca9c965f73a5c300 28-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use LMP_HOST_SSP define instead of magic values

This patch fixes the code to use the proper LMP_HOST_SSP define instead
of magic values and thereby makes the code more readable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
8f984dfaf0bfa1355548cfba00473c8fa8e22d6e 28-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant read_host_features commands

Previously the write_le_enable would trigger a read_host_features
command but since we have access to the value LE support was set to we
can simply just clear or set the bit in hdev->host_features. This also
removes a second unnecessary read_host_features command from the device
initialization procedure since LE is only enabled after the first
read_host_features command completes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0b60eba1b29740a606e6b7694d2dc98b6085a1bf 27-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Don't send unnecessary write_le_enable command

If the local host features indicate that LE is already in the state that
is desired there's no point in sending the HCI command to try to change
the setting.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
816a11d5ced501d368fabe09172f3d62744e8b53 26-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use kernel int types instead of ones from stdint.h

u8/__u8/u32/etc should be used in the kernel instead of stdint.h types.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
nep/sock.c
mtp/sock.c
idp/sock.c
gmt.c
9b27f350688c9399da10c2b888c4044c2c1bd923 24-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove duplicated code in l2cap conn req

The same sequence sending L2CAP Connection Request was used in several
places. Using subroutine makes those places easy to read.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
5b4cedaa14bd1fe3ca1d59c684203a6ae7747faa 24-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix double locking in LE and conless chan

Remove socket lock since chan->ops->recv locks socket itself.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
28b8df77449faa03b573638e089a855f8d25e0ed 23-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix init request completion with AMP controllers

Mark request status as done for Read Local Version HCI command. In AMP
initialization this HCI command is the last and needs to be completed.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
3159d3843aa628b0ee9e8ef4b4fe8c935500c03f 24-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix init request completion with old controllers

With Bluetooth 1.1 controllers the last command in the HCI init sequence
will be a write_local_name, however there was no callback to indicate
init request completion in this case. This patch fixes the issue by
adding the necessary callback to the write_local_name_complete handler.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
24b78d0f49b94f658e8bae707c158962535053dd 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix clear_uuids response

Since the clear_uuids operation doesn't send an immediate HCI command
but just sets off a timer to wait for subsequent add_uuid calls it
doesn't make sense to wait until the timer fires off to send the
response. Instead send the response immediately.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
90e704543d6702971ecfe3fe2325829d89b76f6b 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix dev_class related command response timing

All mgmt commands that may fire off a hci_write_class_of_device command
should wait for the completion of the HCI command before sending a
response to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
c95f0ba76f902bc8b540468b695bcfe8948e8e46 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Track pending class changes

This patch adds a flag to track pending changes to the class of device.
This is needed since we cannot cleanly handle multiple simultaneous
commands and need to return a "busy" error status in the mgmt commands
that might trigger a class change.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
08c79b6133b70a6e3d462d11a89c80259ac66ec7 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add flags parameter to device_connected

This patch updates the Device Connected events to match the latest API
by adding a flags parameter to them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
9246a8693e74b3480913cf6e0c2d472267169990 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix clear UUIDs response

We also need to send a proper response when clearing UUIDs. This patch
adds fixes the missing response for this use case.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
4004b6d96a14edbd157a62ae25bf61022d7caccc 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Move service cache setting to a more sensible place

Since we can now add UUIDs when powered off we don't really need to
always use the service cache to avoid large bursts of HCI commands.
Instead, the only important use case is when we're already powered and
user space starts to initialize itself. This can be easiest detected by
a "clear UUIDs" operation which is where this patch moves the service
cache setting.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
9997a5332320dbaaee64b5c0581ccaa6589a15c9 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix return value of add/remove_uuid

The Add/Remove UUID commands should return the device class instead of
an empty parameter list.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
504c8dcd6b0ec3cd36ab221695c5516e88cf3d79 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix update_eir/class with HCI_AUTO_OFF flag set

If we're powered but still have the HCI_AUTO_OFF flag set the
update_eir and update_class functions should not do anything.
Additionally these functions need to be called when the flag is finally
cleared through set_powered or when powering on for real.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
69775ff6d101ccf435bd26ae822c24bbb20e11cf 23-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Set DISCOVERY_STOPPED if controller resets

If controller is reset during the discovery procedure, Start Discovery
command stops working. This can be easily reproduced by running
"hciconfig hci0 reset" while discovering devices, for instance.

We should force discovery state to DISCOVERY_STOPPED in case we receive
a reset command complete event. Otherwise we may stuck in one of the
active discovery states (DISCOVERY_INQUIRY, DISCOVERY_LE_SCAN and
DISCOVERY_RESOLVING) and subsequent Start Discovery commands will simply
fail.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
60fc5fb66efa0bcbe028637206ed59df8cd4ac19 23-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix count parameter in get_connections reply

This patch fixes the count parameter in the Get Connections reply
message. We cannot know the right number until iterating through all
connections so set the parameter value only after the loop.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b3fb611ec7b76048cb14600e9a5a9b57e5d913da 22-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove socket lock check

Simplify code so that we do not need to check whether socket is locked.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
6be3655552ee49aa2b5fd20fa1b08f28d0feac86 22-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Change sk lock to chan lock in L2CAP core

Change sk lock to chan lock in l2cap core and move sk locks
to l2cap sock code. bh_locks were used because of being RCU
critical section. When needed use explicit socket locks.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
643162a8e2c15a1c1983a0063d9941240b3bde30 22-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add unlocked __l2cap_chan_add function

Add unlocked L2CAP channel add function. Unlocked version will
be used in later patches.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
388fc8faf200f80159353eb86cde4ab75d0a0bbd 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add legacy pairing info to dev_found events

This patch makes sure that legacy pairing vs SSP infomation gets
properly propageted to the device_found events in the form of the legacy
pairing flag.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
9a395a80dc6a2004787539dcc0c7d167ba87e89a 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix device_found parameters

According to the latest mgmt API there's a flags field instead of a
separate confirm_name paramter.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
86a8cfc6d0428f32d702ec59c1b3ef38541a6821 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix unpair_device responses

This patch adds an error return when not powered and cleans up/simpifies
the function logic in the same go.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5f97c1df5563349795f26ed249e2a8840237c569 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add missing powered checks to commands

This patch adds missing powered checks to pair_device,
cancel_pair_device, add_remote_oob_data and remove_remote_oob_data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
932f5ff5e32bf520eb9287b050c926faa6e76bcf 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Allow class of device changes while powered off

This patch makes it possible to set the class when powered off. When
powering on the right class of device value will be automatically
writen to the controller.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7770c4aacaf34fb69cb2acfb7469e9b4e34f1674 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Check for HCI_UP in update_eir() and update_class()

These functions should just silently fail when we're not powered on
instead of trying to send HCI commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8ec37034ef36b89cfb060bd9273db24e6acb1b3a 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix return value for set_class

The return parameters for Set Device Class should consist of the new
class value.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
09b3c3fbbee9aef8ac5d9148ae61aae35766b2a6 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing of dev_class when powering down

We should assume a value of 0 for the device class when powered off.
The appropriate place to do this is in hci_dev_do_close().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
27fcc362297b8e838a929c947b82eabb3f4b7591 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix missing short_name in read_info

The short name is part of the Read Controller Info response and should
be appropriately filled in based on the value of hdev->short_name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7bdaae4a4bc075cf73ab9c3a531b7229caa1f49e 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix name_changed event for short name changes

Since we can't reliably track the short name changes just assume that we
had a change whenever there's a pending mgmt command. In the worst case
we just get one unnecessary name_changed signal.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
28cc7bde5978cbc58c9026123fa5f33b62ad66b3 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Allow local name changes while powered off

This patch makes it possible to set the local name before powering on
the device. The name will be applied using the hci_write_local_name
command once the device gets powered on.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
db99b5fc77e6cec47d80703b471f1efe04527d2f 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix read_name updating when HCI_SETUP is not set

The local name should only be updated as a consequence of a
hci_read_local_name if we are in the HCI_SETUP state. In all other
scenarios it should only be updated through hci_write_local_name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
490c5baba7a5ad80782d5eb778638d1cfc8d70ce 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add hdev->short_name for EIR generation

It's possible to provide a short name through the mgmt interface and
this name can be used for EIR generation when the full name doesn't fit
there. This patch adds the preliminary tracking of the provided short
name.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7f9a903c57bb42b9f7ad8fb7867859d3252229ab 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Send management event for class of device changes

Currently there are no events to other management sockets if the class of
device got changed. So make sure they are sent.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
955638ecec9431788e291fc99f34c42124071abe 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix handling of discoverable setting with timeout

The current handling of the discoverable timeout was missing the proper
handling of the timeout when the mode was already set. Now the command
can be used to expire or retrigger the timeout.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
24c54a90527ca5b85e7feedde2c779dc056ffddb 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Disabling discoverable with timeout is invalid

Add one extra sanity check to ensure that the supplied timeout value is
actually valid in this context.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
f51d5b248981d05269e4f83ab8f8ed7ed494fe33 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix updating EIR when updating the name

Whenever we update the local device name the EIR data also needs to be
updated to reflect this. The update_eir() function in mgmt.c depends on
hdev->dev_name to be up to date so the patch also makes sure that the
mgmt function is called from hci_event.c after the update has happened.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
e59fda8dc14c173b74b5e9d5c8d72849d2ff6b5f 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix EIR data clearing when powering off

When powering off we should assume that the EIR data isn't valid
anymore. This patch makes sure it gets cleared in hci_dev_do_close and
thereby ensures that a correct new EIR is recreated when powering on
again.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
06199cf86a84206cfdc96b8dc02d5c27efa8c60f 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Implement Set LE command

This patch implements support for the Set LE mgmt command. Now, in
addition to the enable_le module parameter user space needs to send an
explicit Enable LE command to enable LE support.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
6c8f12c143fe83485afa530320e6f70dfc1aad54 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix Set SSP supported check

The test for SSP support needs to be earlier in the set_ssp function so
that we return an error when SSP is not supported even when the device
is powered off.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
97e0bdeb93cc9bd014c21d5400af4fa7f2fe2f91 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable timestamps for control channel

The control channel can be also monitored, so include timestamps here
as well. And make sure management events get their timestamp when they
are created.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
gmt.c
54d04dbbb933e8a49429d602b847e367782267e9 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Explicitly clear EIR data upon hci_dev setup

Some controllers preserve their EIR data even after a reset so we need
to explicitly clear this during the device setup procedure.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
c80da27e868f6ffbe1c6588937aa4e7aeab21dec 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix clearing of hdev->eir

The hdev->eir buffer needs to be cleared when clearing the EIR data.
Otherwise subsequent attempts at setting the EIR to something valid
again may fail because the code thinks that the EIR hasn't changed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5fc6ebb102fdf6f589242ebfe3a07d112d60c7d5 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix EIR toggling with SSP

This patch fixes setting the EIR properly when the SSP flag has been set
when powered off (in such a case there is no pending Set_SSP command).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6bf0e4699d1dd56f7f8c12cf332ebffaf1c5e83e 22-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Fix coding style issues in mgmt code

In this case we need to use braces in both branches.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
70c1f20b00495fd25b81be14b263d32648a3d629 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix two minor style issues in HCI code

WARNING: min() should probably be min_t(__u16, scb->expect, count)
+ len = min(scb->expect, (__u16)count);

WARNING: Statements terminations use 1 semicolon
+ INIT_LIST_HEAD(&conn->chan_list);;

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
e5f0e151426bd83e4852a7a150fc6ad8ee349e69 22-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix two minor style issues in management code

WARNING: Statements terminations use 1 semicolon
+ return err;;

WARNING: space prohibited between function name and open parenthesis '('
+ err = cmd_status (sk, index, MGMT_OP_CONFIRM_NAME,

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
c0ecddc2507da980af307aae40d6bcdea4c195dc 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Make Set SSP command callable while powered off

This patch makes it possible to enable SSP through mgmt even when
powered off. The setting will then get automatically actiated when
powering on.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
2e99b0afc7445769bb886dc14a31aaa0dc17c4b5 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unneeded hci_cc_read_ssp_mode function

The kernel has no need to track the hci_read_ssp_mode command since it
has the hci_sent_cmd_data function to check what value was set when
hci_write_ssp_mode completes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
47990ea09d393da8fb6cf284f4dba704c3661973 22-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Make Set Link Security callable while powered off

This patch makes it possible to change the Link Security setting while
powered off and have it automatically enabled when powering on a device.
To track the desired state once powered on a new HCI_LINK_SECURITY flag
is added.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
2e0052e4cf78e3e205e92d82ee572ed726e315d6 20-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add socket error function

Use locked and unlocked versions to help removing socket
locks from l2cap core functions.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
0e587be728a522fd8e522ad905b02f2892b61712 20-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add locked and unlocked state_change

Split to locked and unlocked versions of l2cap_state_change helping
to remove socket locks from l2cap code.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
c03b355ea2938495bbdf25a4645be545be8890f4 20-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add l2cap_chan_lock

Channel lock will be used to lock L2CAP channels which are locked
currently by socket locks.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
3df91ea20e744344100b10ae69a17211fcf5b207 20-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Revert to mutexes from RCU list

Usage of RCU list looks not reasonalbe for a number of reasons:
our code sleep and we had to use socket spinlocks. Most parts
of code are updaters thus there is little sense to use RCU.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
1b009c982482ee0e4cbabcd9bdae690a29119ede 20-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: Fix long line

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
ed9b5f2fa053adce8dac88a385d2225a8ac5f0b5 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix connectable/discoverable response values

The connectable/discoverable flags need to be changed before sending the
response since otherwise the settings value will be incorrect.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
a297e97cf7228467a8c5c76216945ccf029ae2a4 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing of persistent dev_flags

Now that most flags are persistent, only the LE_SCAN flag should be
cleared after a reset.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0224d2fafbbed4ac0cb05d08d3adab506a398451 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix New Settings event for connectable/discoverable

When powered off and doing changes to the Connectable or Discoverable
setting we should also send an appropriate New Settings event in
addition to the command response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
beadb2bddce5810dc668da156b4c2ca457940250 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add convenience function for sending New Settings

The New Settings event needs to be sent from quite many places so it
makes sense to have a convenience function for it to simplify the code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f1f0eb02213a3003ecb10b9c61694e588267b824 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix current settings values when powered off

We should not stop iterating through the various settings if powered off
since most may still be set even then.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
df2c6c5ed5c0bc13b78e855d3e5d9aa3472567ba 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix Removing discoverable timeout in set_connectable

When switching connectable mode off any pending discoverable timeout
must also be disabled to avoid duplicate write_scan_enable commands.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5e5282bbfde9ca6157dba913d90cbab859a837e2 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Allow connectable/discoverable changes in off state

This patch makes it possible to toggle the connectable & discoverable
settings when powered off. Two new hdev->dev_flags flags are added to
track what the scan mode should be when the device is finally powered
on.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
0cbf4ed6e6f43ac399afefdd14a1ee86db8de7d0 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix pairable setting upon initialization

When mgmt is not in use the HCI_PAIRABLE flag will get implicitly set so
that pairing still works with old user space versions. However, as soon
as mgmt comes into play we should clear this flag so that it can be
properly set through the set_pairable command by user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5400c044f3fac38f521362d76711e4c170f78b89 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix set_fast_connectable error return

This patch ensures that Set Fast Connectable fails apropriately if we
are not already in a connectable state (which is a pre-requisite for
fast connectable).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b5235a65ad19f47c5995f054d3dcce90570d1a1c 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix set_local_name and set_dev_class powered checks

Both the Set Local Name and the Set Device Class commands should fail if
the adapter is not powered on.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
4b34ee782164fbaf29b2e7c0e8cb3a898c0986ca 21-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix powered checks for commands

Having the HCI_AUTO_OFF flag set means that from a mgmt interface
perspective we're still not powered, so all tests for HCI_UP should also
include a test for HCI_AUTO_OFF. This patch adds a convenience macro for
it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
8ee5654034c85b3915d078147a9d1064cac1852e 21-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't send New Settings event during setup power down

When the controller gets brought up for initial setup, it will be brought
back down after a timeout. In that case, don't send a New Settings event.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
f0d4b78a68c4fe3b0d45de9a50e8d29419177b83 21-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Only keep controller up after init if powered on

When a new controller gets added to the system, it needs to be brought
up briefly to read basic information like features, BD_ADDR etc. and
after a timeout it will be brought back down.

The only command that should overwrite this timeout is the set power
command from the management interface. Just reading the controller
list or information is not a good reason to keep the controller up.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
cacaf52f51697f832a26e8fdaa7b8e85785085da 20-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Clear EIR data when disabling SSP

EIR shouldn't be enabled if SSP isn't enabled. This patch adds the
clearing of EIR data when disabling SSP and restores the data when SSP
is re-enabled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
1e16357480fdeaeff7c5572f1afba7835473fcb6 20-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix Set SSP check for supported feature

If the local controller doesn't support SSP we should always return an
error for the Set SSP command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6d80dfd094a7b286e95cdcac79efeb7bbb4e226f 20-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add basic support for Set High Speed command

This patch adds rudimentary support for the Set High Speed command in
the form of a new HCI dev flag (HCI_HS_ENABLED).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f963e8e9d3652f4a8065d969206707a1c21ff9b0 20-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add address type parameter to Discovering event

This patch adds an address type parameter to the Discovering event. The
value matches that given to Start/Stop Discovery.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
d930650b59be72342bc373ef52006ca99c1dd09e 20-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add address type parameter to Stop Discovery command

This patch adds an address type parameter to the Stop Discovery command
which should match the value given to Start Discovery.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
4b95a24ce12c4545fd7d2e3075841dc3119d1d71 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Always enable management interface

The management interface API has reached stable version 1.0 and thus
it can now be always enabled. All future changes will be made backwards
compatible.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
d7b7e79688c07b445bc52adfedf9a176be156f4b 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set supported settings based on enabled HS and/or LE

Since neither High Speed (HS) nor Low Energy (LE) are fully implemented
yet, only expose them in supported settings when enabled.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
gmt.c
801f13bd8ecc58f2cf42ec602a2b5db10fc5a132 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict access to management interface

The management interface on the HCI control channel should be restricted
to applications with CAP_NET_ADMIN permission.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
cd82e61c110a36e398323e422896fcfe05879fed 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for HCI monitor channel

The HCI monitor channel can be used to monitor all packets and events
from the Bluetooth subsystem. The monitor is not bound to any specific
HCI device and allows even capturing multiple devices at the same time.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_sock.c
da88cea1200b9df65a7811a3920aa5a4be7dab9f 10-Feb-2012 H. J. Lu <hjl.tools@gmail.com> compat: Use COMPAT_USE_64BIT_TIME in the Bluetooth subsystem

Enable the Bluetooth subsystem to be used with a compat ABI with
64-bit time.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo F. Padovan <padovan@profusion.mobi>
Cc: David S. Miller <davem@davemloft.net>
ci_sock.c
040030ef7d907107e6489b39da518bdf94136d68 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove HCI notifier handling

The HCI notifier handling was never used outside of Bluetooth core layer
and thus remove it and replace it with direct function calls. Also move
the stack internal event generation into the HCI socket layer.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
e0edf3733fb62f91bbb8ec3fab4a90b0ac2dd037 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issue with shared SKB between HCI raw socket and driver

Any HCI raw socket gets a copy of each SKB that is either received or
send via the Bluetooth subsystem. The raw socket uses SKB clones to
send out data, but the problem is that it needs to add an extra packet
type byte in front of it. And some drivers need to also add an extra
header before submitting the packet.

So far this all worked magically fine since all of the drivers and the
raw sockets are adding the same byte at the same location. But that is
by pure coincidence. Since the data of cloned SKBs is shared, this means
that the raw socket and driver kept writing into the shared data area.

To fix this the only safe way is if the HCI raw socket creates a copy of
the SKB before sending it out. To not always copy all SKBs around, the
copy is only created once and only after any of the HCI filter checks
succeeded.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
7cc2ade2cbc6f71090f0f8d0e11cb68886ddc65e 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Simplify HCI socket bind handling

The HCI socket bind handling checks a few too many times the channel
we are binding. So centralize this and make the function easier to read.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
3a208627f3ac83d3b749608770f7eb631db31a77 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add HCI CMSG details only to raw sockets

The HCI CMSG specific data is for raw sockets only. So only add them to
actual raw sockets.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
cedc5469778846ee18c653aaa6d70681961eed93 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Lock socket when reading HCI socket options

When reading the HCI raw socket option, the socket was never locked. So
lock the socket and in addition return EINVAL on non raw sockets.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
2f39cdb7a270da24532734dfdfd10c490be981c4 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Limit HCI raw socket options to actual raw sockets

Currently the socket options of HCI sockets can be set on raw and control
sockets, but on control sockets they make no sense. So just return EINVAL
in that case.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sock.c
a6fb08dfe8654e399c9bbca34be914e213560b5e 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unneeded bt_cb(skb)->channel variable

The bt_cb(skb)->channel was only needed to make hci_send_to_sock() be
used for HCI raw and control sockets. Since they have now separate sending
functions this is no longer needed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
470fe1b540fb50ba8ce01e0ac985602e8fbb108c 20-Feb-2012 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Split sending for HCI raw and control sockets

The sending functions for HCI raw and control sockets have nothing in
common except that they iterate over the socket list. Split them into
two so they can do their job more efficient. In addition the code becomes
more readable.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
ci_sock.c
gmt.c
48c7aba91f372251867d15efc9cf694ceee2de02 19-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix hci_connect error return values

The hci_connect function should either return a valid hci_conn pointer
or a ERR_PTR() but never NULL. This patch fixes the two places where
hci_conn_add failures would have caused a NULL return. The only reason
for failure with hci_conn_add is memory allocation so ENOMEM seems to be
a good choice here.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2da9c55c5a4a0b8f0348b7acd70d8b08a6ae4573 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Bump mgmt version

This patch bumps the mgmt version to 1 and resets the revision to 0.
This is in order to indicate API stability to user space. The mgmt API
has reached a point where no major backwards incompatible changes are
expected so it makes sense to do this version bump now.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
bf1e3541f75a395e1e21b144fe1c387cc71baff1 19-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix OOB command response parameters

The response to the Add/Remove Out Of Band Data commands should include
the same address as was given in the command itself.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f0eeea8b61d6e8316f6137b372eb3f3ac180508c 18-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix (Un)Block Device return parameters

The same address as was passed to the (Un)Block Device command should
also be returned in the command response message.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
f808e166e7c529a7e706cda916c8c99589d2d95b 18-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix Start Discovery return parameters

The same address type that was passed to the Start Discovery command
should also be returned in the response message.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
e211326c0b064e8fe2a8cb51427c3f2044ad84be 18-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Fix Pair Device response status values

This patch fixes the status in Pair Device responses to follow proper
mgmt status values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
aee9b218036476b8b659de5bbfada3a4633f635b 18-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Move status parameters into the cmd_complete header

Instead of having status paramters part of each individual command
response it's simpler to just have the status as part of the command
complete header. This patch updates the code to follow this convention
and thereby also ensures compliance with the latest mgmt API
specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
5e0452c00a2e4b04ec1482248c897dacf106f1df 18-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Interleaved discovery support

This patch adds interleaved discovery support to MGMT Start
Discovery command.

In case interleaved discovery is not supported (not a dual mode
device), we perform BR/EDR or LE-only discovery according to the
device capabilities.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
343f935bfa44189c68527102c409286b0cfc4526 18-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Merge INQUIRY and LE_SCAN discovery states

This patch merges DISCOVERY_INQUIRY and DISCOVERY_LE_SCAN states
into a new state called DISCOVERY_FINDING.

From the discovery perspective, we are pretty much worried about
to know just if we are finding devices than what exactly phase of
"finding devices" (inquiry or LE scan) we are currently running.
Besides, to know if the controller is performing inquiry or LE scan
we should check HCI_INQUIRY or HCI_LE_SCAN bits in hdev flags.

Moreover, merging this two states will simplify the discovery state
machine and will keep interleaved discovery implementation simpler.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
gmt.c
4aab14e5504e84c42534378f91e836e6f55d0886 18-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Track discovery type

This patch adds to struct discovery_state the field 'type' so that
we can track the discovery type the device is performing.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
gmt.c
f39799f5047c4827b200acbf33cd0ba076afd7ed 18-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Prepare start_discovery

This patch does some code refactoring in start_discovery function
in order to prepare it for interleaved discovery support.

MGMT_ADDR_* macros were moved to hci_core.h since they are now used
to define discovery type macros.

Discovery type macros were defined according to mgmt-api.txt
specification:

Possible values for the Type parameter are a bit-wise or of the
following bits:

1 BR/EDR
2 LE Public
3 LE Random

By combining these e.g. the following values are possible:

1 BR/EDR
6 LE (public & random)
7 BR/EDR/LE (interleaved discovery)

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
ea585ab51d3fe2eb2d738c91f83e7c309e76b4fe 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add Intel copyright to mgmt files

This patch adds the appropriate Intel copyright to mgmt files.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
a198e7b100b26dd6ac0240487ca37bad0f53e3e6 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add address type to confirm name command

The latest mgmt API includes an address type for all messages containing
an address. This patch updates the confirm name command to match this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d8457698e7f23a05055396a15ec72ba663282867 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add address type to PIN code messages

The latest mgmt API includes address types for all messages containing
an address. This patch updates the PIN code messages to match this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
d753fdc40f60da2eef03b4816392081a552fea5a 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add address type to link key messages

The latest mgmt API includes an address type wherever there's an address
present. This patch updates the link key messages to match it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
42d2d87cfe837e987802588f8d8b119a76714a74 17-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Prefix hex numbers with object name

Several hex numbers were printed without object name which
complicates debugging.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
2cap_core.c
e05dcc3291dcfe9ab1b456f38ccb3041ebbda59c 17-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use symbolic names for state in debug

Use state_to_string function in debug statements.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
2cap_core.c
2cap_sock.c
20d1803a70ddafc8410b461caaa397e49da246ac 17-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Move scope of state_to_string

Function state_to_string will be used in other files in debug
statements.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
3ed7003e724a04482e0ef1e794eece8c1c177b37 17-Feb-2012 Joe Perches <joe@perches.com> Bluetooth: Add logging functions bt_info and bt_err

Use specific logging functions instead of a generic
bt_printk function can save some text.

Remove now unused bt_printk function.
Add compatibility BT_INFO and BT_ERR macros.

(compiled x86 and defconfig with bluetooth and all bluetooth drivers)

$ size net/bluetooth/built-in.o*
text data bss dec hex filename
381662 20072 100416 502150 7a986 net/bluetooth/built-in.o.allyesconfig.new
382463 20072 100400 502935 7ac97 net/bluetooth/built-in.o.allyesconfig.old
126635 1388 132 128155 1f49b net/bluetooth/built-in.o.defconfig.new
127175 1388 132 128695 1f6b7 net/bluetooth/built-in.o.defconfig.old

$ size drivers/bluetooth/built-in.o*
127575 8976 29476 166027 2888b drivers/bluetooth/built-in.o.allyesconfig.new
129512 8976 29516 168004 29044 drivers/bluetooth/built-in.o.allyesconfig.old
52998 3292 156 56446 dc7e drivers/bluetooth/built-in.o.defconfig.new
54358 3292 156 57806 e1ce drivers/bluetooth/built-in.o.defconfig.old

Signed-off-by: Joe Perches <joe@perches.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ib.c
ed2c4ee360709ca838efa0ea4d6295590aff3d24 16-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add support for Set SSP command

The Set SSP mgmt command can be used for enabling and disabling Secure
Simple Pairing support for controllers that support it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
33ef95ed30283eb17c686a815caf1d33e966fe4a 16-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Add support for Set Link Security command

The Set Link Security mgmt command is used to enable or disable link
level security, also known as Security Mode 3. This is rarely enabled in
modern systems but the command needs to be available for completeness,
qualification purposes and those few systems that actually want to
enable it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
7bb895d68e0c18b730bd89f2ed7e58de0e3a591a 17-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Use more consistent error variable names

For simple integer errors the variable name "err" is more consistent
with the existing code base than "ret".

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
76a7f3a40c2bfbdb5f2b23ac780fa4e4f22e8659 16-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unused member from cmd_lookup struct

The val member of cmd_lookup isn't used anywhere so it can be removed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
7ddb6e0f3f7aa265c905b947e9ac4ab9562e52f2 14-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Do not dereference zero sk

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
7b99b659d90c5d421cb1867295c78a4c0c030734 13-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix event sending with DISCOVERY_STOPPED state

We are not supposed to send mgmt_discovering events if we are transiting
from DISCOVERY_STARTING to DISCOVERY_STOPPED state. It doesn't make
sense to send mgmt_discovering event once discovery procedure has not
been even started.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
203159d486006a18fa1ccf787a10d15d3128cdac 13-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix discovery state machine

In case of Start Discovery command failure, we should set the discovery
state to DISCOVERY_STOPPED. Otherwise, we stuck at DISCOVERY_STARTING
state and subsequent Start Discovery commands will simply fail.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
e70bb2e89959983aebcfce28f645a1104ffa9ab2 13-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Implement Read Supported Commands commands for mgmt

This patch implements the Read Supported Commands mgmt command which was
recently added to the API specification. It returns a list of supported
commands and events to user space.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
24d2b8c0ac5c8ec41c26ed432238b0e027184882 30-Jan-2012 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Fix possible use after free in delete path

We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
6de32750822d00bfa92c341166132b0714c5b559 30-Jan-2012 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Remove usage of __cancel_delayed_work()

__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
ca0d6c7ece0e78268cd7c5c378d6b1b610625085 03-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing QUIRK_NO_RESET test to hci_dev_do_close

We should only perform a reset in hci_dev_do_close if the
HCI_QUIRK_NO_RESET flag is set (since in such a case a reset will not be
performed when initializing the device).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
cf33e77b76d7439f21a23a94eab4ab3b405a6a7d 27-Jan-2012 Octavian Purdila <octavian.purdila@intel.com> Bluetooth: Fix RFCOMM session reference counting issue

There is an imbalance in the rfcomm_session_hold / rfcomm_session_put
operations which causes the following crash:

[ 685.010159] BUG: unable to handle kernel paging request at 6b6b6b6b
[ 685.010169] IP: [<c149d76d>] rfcomm_process_dlcs+0x1b/0x15e
[ 685.010181] *pdpt = 000000002d665001 *pde = 0000000000000000
[ 685.010191] Oops: 0000 [#1] PREEMPT SMP
[ 685.010247]
[ 685.010255] Pid: 947, comm: krfcommd Tainted: G C 3.0.16-mid8-dirty #44
[ 685.010266] EIP: 0060:[<c149d76d>] EFLAGS: 00010246 CPU: 1
[ 685.010274] EIP is at rfcomm_process_dlcs+0x1b/0x15e
[ 685.010281] EAX: e79f551c EBX: 6b6b6b6b ECX: 00000007 EDX: e79f40b4
[ 685.010288] ESI: e79f4060 EDI: ed4e1f70 EBP: ed4e1f68 ESP: ed4e1f50
[ 685.010295] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 685.010303] Process krfcommd (pid: 947, ti=ed4e0000 task=ed43e5e0 task.ti=ed4e0000)
[ 685.010308] Stack:
[ 685.010312] ed4e1f68 c149eb53 e5925150 e79f4060 ed500000 ed4e1f70 ed4e1f80 c149ec10
[ 685.010331] 00000000 ed43e5e0 00000000 ed4e1f90 ed4e1f9c c149ec87 0000bf54 00000000
[ 685.010348] 00000000 ee03bf54 c149ec37 ed4e1fe4 c104fe01 00000000 00000000 00000000
[ 685.010367] Call Trace:
[ 685.010376] [<c149eb53>] ? rfcomm_process_rx+0x6e/0x74
[ 685.010387] [<c149ec10>] rfcomm_process_sessions+0xb7/0xde
[ 685.010398] [<c149ec87>] rfcomm_run+0x50/0x6d
[ 685.010409] [<c149ec37>] ? rfcomm_process_sessions+0xde/0xde
[ 685.010419] [<c104fe01>] kthread+0x63/0x68
[ 685.010431] [<c104fd9e>] ? __init_kthread_worker+0x42/0x42
[ 685.010442] [<c14dae82>] kernel_thread_helper+0x6/0xd

This issue has been brought up earlier here:

https://lkml.org/lkml/2011/5/21/127

The issue appears to be the rfcomm_session_put in rfcomm_recv_ua. This
operation doesn't seem be to required as for the non-initiator case we
have the rfcomm_process_rx doing an explicit put and in the initiator
case the last dlc_unlink will drive the reference counter to 0.

There have been several attempts to fix these issue:

6c2718d Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket
683d949 Bluetooth: Never deallocate a session when some DLC points to it

but AFAICS they do not fix the issue just make it harder to reproduce.

Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Gopala Krishna Murala <gopala.krishna.murala@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/core.c
b5a30dda6598af216c070165ece6068f9f00f33a 21-Jan-2012 Octavian Purdila <tavi.purdila@gmail.com> Bluetooth: silence lockdep warning

Since bluetooth uses multiple protocols types, to avoid lockdep
warnings, we need to use different lockdep classes (one for each
protocol type).

This is already done in bt_sock_create but it misses a couple of cases
when new connections are created. This patch corrects that to fix the
following warning:

<4>[ 1864.732366] =======================================================
<4>[ 1864.733030] [ INFO: possible circular locking dependency detected ]
<4>[ 1864.733544] 3.0.16-mid3-00007-gc9a0f62 #3
<4>[ 1864.733883] -------------------------------------------------------
<4>[ 1864.734408] t.android.btclc/4204 is trying to acquire lock:
<4>[ 1864.734869] (rfcomm_mutex){+.+.+.}, at: [<c14970ea>] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.735541]
<4>[ 1864.735549] but task is already holding lock:
<4>[ 1864.736045] (sk_lock-AF_BLUETOOTH){+.+.+.}, at: [<c1498bf7>] lock_sock+0xa/0xc
<4>[ 1864.736732]
<4>[ 1864.736740] which lock already depends on the new lock.
<4>[ 1864.736750]
<4>[ 1864.737428]
<4>[ 1864.737437] the existing dependency chain (in reverse order) is:
<4>[ 1864.738016]
<4>[ 1864.738023] -> #1 (sk_lock-AF_BLUETOOTH){+.+.+.}:
<4>[ 1864.738549] [<c1062273>] lock_acquire+0x104/0x140
<4>[ 1864.738977] [<c13d35c1>] lock_sock_nested+0x58/0x68
<4>[ 1864.739411] [<c1493c33>] l2cap_sock_sendmsg+0x3e/0x76
<4>[ 1864.739858] [<c13d06c3>] __sock_sendmsg+0x50/0x59
<4>[ 1864.740279] [<c13d0ea2>] sock_sendmsg+0x94/0xa8
<4>[ 1864.740687] [<c13d0ede>] kernel_sendmsg+0x28/0x37
<4>[ 1864.741106] [<c14969ca>] rfcomm_send_frame+0x30/0x38
<4>[ 1864.741542] [<c1496a2a>] rfcomm_send_ua+0x58/0x5a
<4>[ 1864.741959] [<c1498447>] rfcomm_run+0x441/0xb52
<4>[ 1864.742365] [<c104f095>] kthread+0x63/0x68
<4>[ 1864.742742] [<c14d5182>] kernel_thread_helper+0x6/0xd
<4>[ 1864.743187]
<4>[ 1864.743193] -> #0 (rfcomm_mutex){+.+.+.}:
<4>[ 1864.743667] [<c1061ada>] __lock_acquire+0x988/0xc00
<4>[ 1864.744100] [<c1062273>] lock_acquire+0x104/0x140
<4>[ 1864.744519] [<c14d2c70>] __mutex_lock_common+0x3b/0x33f
<4>[ 1864.744975] [<c14d303e>] mutex_lock_nested+0x2d/0x36
<4>[ 1864.745412] [<c14970ea>] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.745842] [<c14990d9>] __rfcomm_sock_close+0x5f/0x6b
<4>[ 1864.746288] [<c1499114>] rfcomm_sock_shutdown+0x2f/0x62
<4>[ 1864.746737] [<c13d275d>] sys_socketcall+0x1db/0x422
<4>[ 1864.747165] [<c14d42f0>] syscall_call+0x7/0xb

Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
2cap_sock.c
fcomm/sock.c
6e1da683f79a22fafaada62d547138daaa9e3456 04-Jan-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: l2cap_set_timer needs jiffies as timeout value

After moving L2CAP timers to workqueues l2cap_set_timer expects timeout
value to be specified in jiffies but constants defined in miliseconds
are used. This makes timeouts unreliable when CONFIG_HZ is not set to
1000.

__set_chan_timer macro still uses jiffies as input to avoid multiple
conversions from/to jiffies for sk_sndtimeo value which is already
specified in jiffies.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Ackec-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
a63752552b95624a9f1dfa3d763870f72f964ad0 04-Jan-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Fix sk_sndtimeo initialization for L2CAP socket

sk_sndtime value should be specified in jiffies thus initial value
needs to be converted from miliseconds. Otherwise this timeout is
unreliable when CONFIG_HZ is not set to 1000.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
4aa832c27edf902130f8bace1d42cf22468823fa 08-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove bogus inline declaration from l2cap_chan_connect

As reported by Dan Carpenter this function causes a Sparse warning and
shouldn't be declared inline:

include/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a
definition"

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
18daf1644e634bae951a6e3d4d19d89170209762 13-Jan-2012 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix l2cap conn failures for ssp devices

Commit 330605423c fixed l2cap conn establishment for non-ssp remote
devices by not setting HCI_CONN_ENCRYPT_PEND every time conn security
is tested (which was always returning failure on any subsequent
security checks).

However, this broke l2cap conn establishment for ssp remote devices
when an ACL link was already established at SDP-level security. This
fix ensures that encryption must be pending whenever authentication
is also pending.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
2dd106887d6503819f2cedc408497023547439bb 09-Feb-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Use proper datatypes in release-callbacks

This enhances code readability a lot and avoids using void* even though
we know the type of the variable.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
3dc07322b1ce3c8477690d54ebbf15a165f43066 09-Feb-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Introduce to_hci_conn

This avoids using the dev_set/get_drvdata() functions to retrieve a
pointer to our own structure. We can use simple pointer arithmetic here.
The drvdata field is actually not needed by any other code-path but this
makes the code more consistent with hci_dev.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
aa2b86d761a95068354511de755695ef6b53afc7 09-Feb-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Introduce to_hci_dev()

We currently use dev_set_drvdata to keep a pointer to ourself. This
doesn't make sense as we are the bus and not a driver. Therefore,
introduce to_hci_dev() so we can get a struct hci_dev pointer from a
struct device pointer.

dev_set/get_drvdata() is reserved for drivers that provide a device and
not for the bus using the device. The bus can use simple pointer
arithmetic to retrieve its private data.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
b1078ad0be344e7bec6e7991f33df17565d24e08 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add Device Unpaired mgmt event

This patch add a new Device Unpaired mgmt event. This will be sent to
all mgmt sockets except the one that requested unpairing (that socket
will get a command complete instead). The event is also reserved for
future SMP updates where a remote device will be able to request pairing
revocation from us.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
82eb703efc2ad2ac52cada85a5119bb9dfcea942 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt_unpair_device command status

The default response status to unpair_device should be set as 0 instead
of a generic failure value. When disconnection is not needed (i.e. we
can reply imediately) we should return success and not failure.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
bab73cb68435232ba78a4bd1ac1a85862e3be0bb 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type to mgmt_ev_auth_failed

This patch updates the Authentication Failed mgmt event to match the
latest API specification by adding an address type to it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
mp.c
88c1fe4ba55c7245ad2f3c81689f854287875121 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type to mgmt blacklist messages

This patch updates the implmentation for mgmt_block_device and
mgmt_unblock_device and their corresponding events to match the latest
API specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sock.c
gmt.c
664ce4cc293cd6c76236617f78689d0e03e69287 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type to Out Of Band mgmt messages

This patch updates the implementation for these mgmt to be up to date
with the latest API specification. Right now the address type isn't
actually used for anything but that might change in the future.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
272d90df2d4d065e782cafb08358bd8918bf703a 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type to user_confirm and user_passkey messages

This patch upadate the user confirm and user passkey mgmt messages to
match the latest API specification by adding an address type parameter
to them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
mp.c
88c3df13ca06718e5a8f509ae9cbb1228c10d537 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update mgmt_disconnect to match latest API

This patch adds an address type parameter to the disconnect command and
response in order to match the latest mgmt API specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
124f6e35286c9d8dc96f147a9026081256136615 09-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update and rename mgmt_remove_keys to mgmt_unpair_device

This patch renames the mgmt_remove_keys command to mgmt_unpair_device
and updates its parameters to match the latest API (specifically, it
adds an address type parameter to the command and its response).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
930fa4aee934ad59ed82163cdbee4922b883ef79 07-Feb-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix double acking I-Frames when sending pending I-Frames

Pending I-Frame(s) are considered as acknowledgement. To void double
acking (via I-Frame and later via RR) clear ack timer when sending
first pending I-Frame.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
8ed7a0ae7834cbefb82ed15a92e36983924efa23 07-Feb-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix possible missing I-Frame acknowledgement

Make l2cap_ertm_send return number of pending I-Frames transmitted
instead of all (pending + retransmitted) I-Frames transmitted.

As only pending I-Frames are considered as acknowledgement, this could
lead to situation when no ACK was sent in __l2cap_send_ack (if only
already transmitted I-Frames were retransmitted).

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
6d5922b01b5e8d684dae5baaea596a4a749738e3 06-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove unneeded sk variable

In debug use chan %p instead of sk.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
5491120e75afe2a7f5b6f3a207de6d99934e5475 06-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Clean up l2cap_chan_add

Change elseif to switch. This make sense even more with following
patches which otherwise have to add more elseifs statements.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
cf4cd00915c659dc7b496c454bee36bb6b833fd1 06-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Change chan_ready param from sk to chan

Change is needed to remove dependency on sk when possible
before introducing l2cap channel lock.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
343fb14549a736b348b08e702057487a7ec44d5d 22-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add BT_DBG to mgmt_discovering()

This is helpful for device discovery implementation & debuging.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
053c7e0c4a40e2bb44e3c1e61e263be00688a136 03-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix device_found event length for remote name resolving

The correct length of the event is the size of the ev struct (not size
of the pointer like the code was previously using) plus the length of
the variable-sized EIR data at the end of the struct.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
e87775250f322b8f1612cf9918fcde827948f087 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix indentation

This patch fixes a #define indentation in mgmt.c.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
3fd2415363629b779549705f341e0645e32c1ad5 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: MGMT start discovery LE-Only support

This patch adds LE-Only discovery procedure support to MGMT Start
Discovery command.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
28b75a89480df99a17c8facd5c33985847d06bb6 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add hci_le_scan()

We are not supposed to block in start_discovery() because
start_discovery code is running in write() syscall context
and this would block the write operation on the mgmt socket.
This way, we cannot directly call hci_do_le_scan() to scan
LE devices in start_discovery(). To overcome this issue a
derefered work (hdev->le_scan) was created so we can properly
call hci_do_le_scan().

The helper function hci_le_scan() simply set LE scan parameters
and queue hdev->le_scan work. The work is queued on system_long_wq
since it can sleep for a few seconds in the worst case (timeout).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
7ba8b4be38e7c83b2b13333a82a0ecde921a7390 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add hci_do_le_scan()

This patch adds to hci_core the hci_do_le_scan function which
should be used to scan LE devices.

In order to enable LE scan, hci_do_le_scan() sends commands (Set
LE Scan Parameters and Set LE Scan Enable) to the controller and
waits for its results. If commands were executed successfully a
delayed work is scheduled to disable the ongoing scanning after
some amount of time. This function blocks.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
6fbe195dc41c4fae1fa7aca1a38c888de1d24e2d 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Minor code refactoring

This patch does a trivial code refacting in hci_discovery_active.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
c599008f8f999dab8cb4a6404be99bdc4716ba15 03-Feb-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: LE scan should send Discovering events

Send MGMT Discovering events once LE scan starts/stops so the
userspace can track when local adapters are discovering LE devices.

This way, we also keep the same behavior of inquiry which sends MGMT
Discovering events once inquiry starts/stops even if it is triggered
by an external tool (e.g. hcitool).

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
8af59467412b4b61850d3ccb3737c09ecc6dc100 03-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing QUIRK_NO_RESET test to hci_dev_do_close

We should only perform a reset in hci_dev_do_close if the
HCI_QUIRK_NO_RESET flag is set (since in such a case a reset will not be
performed when initializing the device).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
63d2bc1b9a4d77f90b9719c3ff2570a274a7a22f 03-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Helper removes duplicated code

Use __check_timout helper to remove duplicated code

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
b71d385a18cd4516c62d0198c9ec37e658112f75 03-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Recalculate sched HCI blk/pkt flow ctrl

Split HCI scheduling for block and packet flow control.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
261cc5aa9e54aac633dcc3b6469739cb6e23e21a 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for notifying userspace of new LTK's

If we want to have proper pairing support over LE we need to
inform userspace that a new LTK is available, so userspace
can store that key permanently.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
b0dbfb46ba0c0d2fe4c90e2046f7b36275763a7e 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for removing LTK's when pairing is removed

Instead of having a separated command for removing SMP keys, we use the
Remove Keys command to remove *all* keys.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
346af67b8d116f01ef696fd47959a55deb2db8b6 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add MGMT handlers for dealing with SMP LTK's

This adds a method to notify that a new LTK is available and
a handler to store keys coming from userspace into the kernel LTK
list.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
c9839a11c0e460a2457e7cac76650d07773e6c3b 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Use the updated key structures for handling LTKs

This updates all the users of the older way, that was using the
link_keys list to store the SMP keys, to use the new way.

This includes defining new types for the keys, we have a type for each
combination of STK/LTK and Master/Slave.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
ci_event.c
mp.c
b899efaf9b26cadb084752862490b4fc44bc3169 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add new structures for handling SMP Long Term Keys

This includes a new list for storing the keys and a new structure used
to represent each key.

Some notes: authenticated is used to identify that the key may be used
to setup a HIGH security link. As the same list is used to store both
the STK's and the LTK's the type field is used so we can separate
between those two types of keys and if the key should be used when
in the master or slave role.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
650f726d16a3f25153d785b531516f6e90d2014f 03-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix doing some useless casts when receiving MGMT commands

Every command handler of mgmt does a cast to the command structure
so it can properly interpreted. So we can avoid that cast if we
make those functions receive a void * directly.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
gmt.c
2a5a5ec620a29d4ba07743c3151cdf0a417c8f8c 02-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use list _safe deleting from conn chan_list

Fixes possible bug when deleting element from the list in
function hci_chan_list_flush. list_for_each_entry_rcu is used
and after deleting element from the list we also free pointer
and then list_entry_rcu is taken from freed pointer.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
3c4e0df028935618d052235ba85bc7079be13394 02-Feb-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use list _safe deleting from conn_hash_list

Use list_for_each_entry_safe which is safe version against removal
of list entry. Otherwise we remove hci_conn element and reference
next element which result in accessing LIST_POISON.

[ 95.571834] Bluetooth: unknown link type 127
[ 95.578349] BUG: unable to handle kernel paging request at 20002000
[ 95.580236] IP: [<20002000>] 0x20001fff
[ 95.580763] *pde = 00000000
[ 95.581196] Oops: 0000 [#1] SMP
...
[ 95.582298] Pid: 3355, comm: hciconfig Tainted: G O 3.2.0-VirttualBox
[ 95.582298] EIP: 0060:[<20002000>] EFLAGS: 00210206 CPU: 0
[ 95.582298] EIP is at 0x20002000
...
[ 95.582298] Call Trace:
[ 95.582298] [<f8231ab6>] ? hci_conn_hash_flush+0x76/0xf0 [bluetooth]
[ 95.582298] [<f822bcb1>] hci_dev_do_close+0xc1/0x2e0 [bluetooth]
[ 95.582298] [<f822d679>] ? hci_dev_get+0x69/0xb0 [bluetooth]
[ 95.582298] [<f822e1da>] hci_dev_close+0x2a/0x50 [bluetooth]
[ 95.582298] [<f824102f>] hci_sock_ioctl+0x1af/0x3f0 [bluetooth]
[ 95.582298] [<c11153ea>] ? handle_pte_fault+0x8a/0x8f0
[ 95.582298] [<c146becf>] sock_ioctl+0x5f/0x260
[ 95.582298] [<c146be70>] ? sock_fasync+0x90/0x90
[ 95.582298] [<c1152b33>] do_vfs_ioctl+0x83/0x5b0
[ 95.582298] [<c1563f87>] ? do_page_fault+0x297/0x500
[ 95.582298] [<c1563cf0>] ? spurious_fault+0xd0/0xd0
[ 95.582298] [<c107165b>] ? up_read+0x1b/0x30
[ 95.582298] [<c1563f87>] ? do_page_fault+0x297/0x500
[ 95.582298] [<c100aa9f>] ? init_fpu+0xef/0x160
[ 95.582298] [<c15617c0>] ? do_debug+0x180/0x180
[ 95.582298] [<c100a958>] ? fpu_finit+0x28/0x80
[ 95.582298] [<c11530e7>] sys_ioctl+0x87/0x90
[ 95.582298] [<c156795f>] sysenter_do_call+0x12/0x38
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
28424707a2e4ad38ab546d2ed5e3d6b035a84258 02-Feb-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: mgmt: Implement Cancel Pair Device command

This patch implements the Cancel Pair Device command for mgmt. It's used
by user space to cancel an ongoing pairing attempt which was triggered
by the Pair Device command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
95947a391ebe685b9870cd25cac1433aedf5d49c 23-Jan-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Fix clearing of debug and linkkey flags

This patch fixes clearing of HCI_LINK_KEYS and HCI_DEBUG_KEYS
dev_flags while resetting. Without this patch pairing does
not work over management interface for BR-EDR devices.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
7a7f1e7c857959f5298020969741e389f21edbae 16-Jan-2012 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Send correct response to IO Capability Request

This patch sends correct IO Capability response to remote device
in case Local Device supports KeyBoardDisplay IO Capability as
this capability is not valid as per BT spec for IO capability
Request Reply Command.
This capability is mapped to DisplayYesNo which is in accordance
with BT spec.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
b7d05bad1c10a363b6b99f66ac1fa76b6892e618 13-Jan-2012 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix l2cap conn failures for ssp devices

Commit 330605423c fixed l2cap conn establishment for non-ssp remote
devices by not setting HCI_CONN_ENCRYPT_PEND every time conn security
is tested (which was always returning failure on any subsequent
security checks).

However, this broke l2cap conn establishment for ssp remote devices
when an ACL link was already established at SDP-level security. This
fix ensures that encryption must be pending whenever authentication
is also pending.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-by: Daniel Wagner <daniel.wagner@bmw-carit.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
f1c09c07cd1a6c1676c4df6450d2b28875e184c1 01-Feb-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix invalid memory access when there's no SMP channel

We only should try to free the SMP channel that was created if there
is a pending SMP session.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
66f01296962dfebf032c18ffe61c53a199b4a7bd 27-Jan-2012 Octavian Purdila <octavian.purdila@intel.com> Bluetooth: Fix RFCOMM session reference counting issue

There is an imbalance in the rfcomm_session_hold / rfcomm_session_put
operations which causes the following crash:

[ 685.010159] BUG: unable to handle kernel paging request at 6b6b6b6b
[ 685.010169] IP: [<c149d76d>] rfcomm_process_dlcs+0x1b/0x15e
[ 685.010181] *pdpt = 000000002d665001 *pde = 0000000000000000
[ 685.010191] Oops: 0000 [#1] PREEMPT SMP
[ 685.010247]
[ 685.010255] Pid: 947, comm: krfcommd Tainted: G C 3.0.16-mid8-dirty #44
[ 685.010266] EIP: 0060:[<c149d76d>] EFLAGS: 00010246 CPU: 1
[ 685.010274] EIP is at rfcomm_process_dlcs+0x1b/0x15e
[ 685.010281] EAX: e79f551c EBX: 6b6b6b6b ECX: 00000007 EDX: e79f40b4
[ 685.010288] ESI: e79f4060 EDI: ed4e1f70 EBP: ed4e1f68 ESP: ed4e1f50
[ 685.010295] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 685.010303] Process krfcommd (pid: 947, ti=ed4e0000 task=ed43e5e0 task.ti=ed4e0000)
[ 685.010308] Stack:
[ 685.010312] ed4e1f68 c149eb53 e5925150 e79f4060 ed500000 ed4e1f70 ed4e1f80 c149ec10
[ 685.010331] 00000000 ed43e5e0 00000000 ed4e1f90 ed4e1f9c c149ec87 0000bf54 00000000
[ 685.010348] 00000000 ee03bf54 c149ec37 ed4e1fe4 c104fe01 00000000 00000000 00000000
[ 685.010367] Call Trace:
[ 685.010376] [<c149eb53>] ? rfcomm_process_rx+0x6e/0x74
[ 685.010387] [<c149ec10>] rfcomm_process_sessions+0xb7/0xde
[ 685.010398] [<c149ec87>] rfcomm_run+0x50/0x6d
[ 685.010409] [<c149ec37>] ? rfcomm_process_sessions+0xde/0xde
[ 685.010419] [<c104fe01>] kthread+0x63/0x68
[ 685.010431] [<c104fd9e>] ? __init_kthread_worker+0x42/0x42
[ 685.010442] [<c14dae82>] kernel_thread_helper+0x6/0xd

This issue has been brought up earlier here:

https://lkml.org/lkml/2011/5/21/127

The issue appears to be the rfcomm_session_put in rfcomm_recv_ua. This
operation doesn't seem be to required as for the non-initiator case we
have the rfcomm_process_rx doing an explicit put and in the initiator
case the last dlc_unlink will drive the reference counter to 0.

There have been several attempts to fix these issue:

6c2718d Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket
683d949 Bluetooth: Never deallocate a session when some DLC points to it

but AFAICS they do not fix the issue just make it harder to reproduce.

Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Gopala Krishna Murala <gopala.krishna.murala@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
fcomm/core.c
4777bfdebbddc1f58d9148de5a3e00375d063768 31-Jan-2012 Andre Guedes <aguedespe@gmail.com> Bluetooth: Use GFP_KERNEL in hci_add_adv_entry()

This function is not called in interrupt context anymore, so it
should use GFP_KERNEL to allocate memory.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
f7aa611a0ecf1d22f21e26279e1a3baf1db6b973 30-Jan-2012 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Rename smp_key_size to enc_key_size

This makes clear that this is the size of the key used to
encrypt the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
mp.c
127074bfa3c11c12e0160437e31b08c6b27412a4 30-Jan-2012 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Fix possible use after free in delete path

We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
17cd3f374be6648bd46c86ff8f2a2511d3f416ee 30-Jan-2012 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Remove usage of __cancel_delayed_work()

__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
e72acc13c770a82b4ce4a07e9716f29320eae0f8 27-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove unneeded locking

We don't need locking hdev in hci_conn_timeout() since it doesn't
access any hdev's shared resources, it basically queues HCI commands.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
75d7735c7a3ddc3842473219460285748d10db11 30-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use GFP_KERNEL in hci_chan_create()

This function is called in process context only, so it should use
GFP_KERNEL to allocate memory.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
cb601d7e65f497a2a172d65b2ef1d738ac6fe4f4 30-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Use GFP_KERNEL in hci_conn_add()

This function is called in process context only, so it should use
GFP_KERNEL to allocate memory.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_conn.c
cad8f1d072375a550ca81419799ba381118c14bb 23-Jan-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Make l2cap_ertm_data_rcv static

It is not used outside of l2cap_core.c. Also l2cap_ertm_data_rcv is
only used after it is defined so there is no need for forward declaration.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2f7719ce54bf6e877987f6ef578b580a51d8c2e3 20-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add alloc_skb chan operator

Add channel-specific skb allocation method

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
2cap_sock.c
d22015aad40b4316f0f74c8e410debca44c3e6e2 21-Jan-2012 Octavian Purdila <tavi.purdila@gmail.com> Bluetooth: silence lockdep warning

Since bluetooth uses multiple protocols types, to avoid lockdep
warnings, we need to use different lockdep classes (one for each
protocol type).

This is already done in bt_sock_create but it misses a couple of cases
when new connections are created. This patch corrects that to fix the
following warning:

<4>[ 1864.732366] =======================================================
<4>[ 1864.733030] [ INFO: possible circular locking dependency detected ]
<4>[ 1864.733544] 3.0.16-mid3-00007-gc9a0f62 #3
<4>[ 1864.733883] -------------------------------------------------------
<4>[ 1864.734408] t.android.btclc/4204 is trying to acquire lock:
<4>[ 1864.734869] (rfcomm_mutex){+.+.+.}, at: [<c14970ea>] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.735541]
<4>[ 1864.735549] but task is already holding lock:
<4>[ 1864.736045] (sk_lock-AF_BLUETOOTH){+.+.+.}, at: [<c1498bf7>] lock_sock+0xa/0xc
<4>[ 1864.736732]
<4>[ 1864.736740] which lock already depends on the new lock.
<4>[ 1864.736750]
<4>[ 1864.737428]
<4>[ 1864.737437] the existing dependency chain (in reverse order) is:
<4>[ 1864.738016]
<4>[ 1864.738023] -> #1 (sk_lock-AF_BLUETOOTH){+.+.+.}:
<4>[ 1864.738549] [<c1062273>] lock_acquire+0x104/0x140
<4>[ 1864.738977] [<c13d35c1>] lock_sock_nested+0x58/0x68
<4>[ 1864.739411] [<c1493c33>] l2cap_sock_sendmsg+0x3e/0x76
<4>[ 1864.739858] [<c13d06c3>] __sock_sendmsg+0x50/0x59
<4>[ 1864.740279] [<c13d0ea2>] sock_sendmsg+0x94/0xa8
<4>[ 1864.740687] [<c13d0ede>] kernel_sendmsg+0x28/0x37
<4>[ 1864.741106] [<c14969ca>] rfcomm_send_frame+0x30/0x38
<4>[ 1864.741542] [<c1496a2a>] rfcomm_send_ua+0x58/0x5a
<4>[ 1864.741959] [<c1498447>] rfcomm_run+0x441/0xb52
<4>[ 1864.742365] [<c104f095>] kthread+0x63/0x68
<4>[ 1864.742742] [<c14d5182>] kernel_thread_helper+0x6/0xd
<4>[ 1864.743187]
<4>[ 1864.743193] -> #0 (rfcomm_mutex){+.+.+.}:
<4>[ 1864.743667] [<c1061ada>] __lock_acquire+0x988/0xc00
<4>[ 1864.744100] [<c1062273>] lock_acquire+0x104/0x140
<4>[ 1864.744519] [<c14d2c70>] __mutex_lock_common+0x3b/0x33f
<4>[ 1864.744975] [<c14d303e>] mutex_lock_nested+0x2d/0x36
<4>[ 1864.745412] [<c14970ea>] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.745842] [<c14990d9>] __rfcomm_sock_close+0x5f/0x6b
<4>[ 1864.746288] [<c1499114>] rfcomm_sock_shutdown+0x2f/0x62
<4>[ 1864.746737] [<c13d275d>] sys_socketcall+0x1db/0x422
<4>[ 1864.747165] [<c14d42f0>] syscall_call+0x7/0xb

Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
f_bluetooth.c
2cap_sock.c
fcomm/sock.c
61e1b4b7de5c7e3b671e069f8bf7ee94dedbfde0 19-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: space correction

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
aa64a8b500e61c33c17f1d5e7de0cc154489c59e 18-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add a convenience function to check for SSP enabled

It's a very common test to see if both the local and the remote device
have SSP enabled. By creating a simple function to test this we can
shorten many if-statements in the code.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
84bde9d6c0e6830f4a8685a5d237965053118bf9 25-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert hdev->ssp_mode to a flag

The ssp_mode is essentially just a boolean so it's more appropriate to
have it simply as a flag in hdev->dev_flags.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
gmt.c
58a681ef1455aef9caad1d41073868fb399373f6 16-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Merge boolean members of struct hci_conn into flags

Now that the flags member of struct hci_conn is supposed to accommodate
any boolean type values we can easily merge all boolean members into it.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
b644ba33699711630099efc58a4efc225560aceb 17-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update device_connected and device_found events to latest API

This patch updates mgmt_ev_device_connected and mgmt_ev_device found to
include an EIR-encoded remote name and class whenever possible. With
this addition the mgmt_ev_remote_name event becomes unnecessary and can
be removed. Since the connected event doesn't map to hci_conn_complete
anymore a HCI_CONN_MGMT_CONNECTED flag is added to track when mgmt has
been notified about a connection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
a0c808b373e89aecc3ecae4cbdcdeff68aa12e3e 16-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert hdev->out to a bool type

The hdev->out variable is essentially a boolean so the type 'bool' makes
more sense than u8.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
51a8efd7d02c13cb1c6fdd1cd66788792a3fcc7c 16-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename conn->pend to conn->flags

These flags can and will be used for more general purpose values than
just pending state transitions so the more common name "flags" makes
more sense than "pend".

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap_core.c
mp.c
1dc06093a9f353ef19b7b5180602884d0ce065c5 15-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Merge device class into the EIR data in mgmt_ev_device_found

There's no need to have a separate device class field since the same
information can be encoded into the EIR data.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
6759a67579a927f2a92f398cf67555e6cc92d0ff 15-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move eir_has_data_field to hci_core.h

This makes the function accessible from all places it's needed (e.g.
mgmt.c and hci_event.c).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
4ddb1930f91b7395a760cd4a8cf1b2a87011571c 15-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename eir_has_complete_name to eir_has_data_type

This allows for other uses such as checking for an embedded class of
device value in order to decide whether to append the class or not.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e319d2e74378660c5e09a1b8703663ba97f0f62a 15-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add eir_len parameter to mgmt_ev_device_found

This patch add a two byte eir_len parameter mgmt_ev_device_found. Since
it's unlikely that the data will in the short term be much bigger than
conventional EIR lengths just use a small stack based buffer for now to
avoid dynamic memory allocation & freeing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
afc747a600ff2e3a4eef8f312fc766608a1360e2 15-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename mgmt connected events to match user space

User space uses device_(dis)connected instead of just (dis)connected so
rename the defines and functions to match this.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
gmt.c
7005ff1780ca7ad5ed2ec710ad35affc48362ebf 18-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix clearing persistent flags

There are several other dev_flags besided HCI_MGMT that should not be
cleared upon reset.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
3c9e919511f87f10491628c6b44bc4675822f307 10-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Report LE devices

Devices found during LE scan should be reported to userspace through
mgmt_device_found events.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
7d262f86f6b73efb500be9d9242ef0673221493d 10-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add 'eir_len' param to mgmt_device_found()

This patch adds a new parameter to mgmt_device_found() to inform
the length of 'eir' pointer.

EIR data from LE advertising report event doesn't have a fixed length
as EIR data from extended inquiry result event does. We needed to
change mgmt_device_found() so it copies 'eir_len' bytes instead of
HCI_MAX_EIR_LENGTH.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
gmt.c
0952a57a25ee9854e1bf21e333b9fd3de211760e 13-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Change sk to l2cap_chan

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
5ef8cb9e5b5012a373f48e1e336339864b4c1303 13-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use chan instead of sk

Remove unneeded conversion from sk to chan.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
09bfb2ee52a66845bbefad0b6eaeae1b5adea949 11-Jan-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired

Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
77f918bc7babb8473933ca0a6deefc64fe24b06c 11-Jan-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Don't send RNR immediately when entering local busy

There is no need to send RNR immediately when entring local busy.
Also upper layer might clear local busy condition before ack timer
expires saving few cycles for sending RNR.

This also prevents sending two RNRs in some cases where sending one
would be enough i.e received N I-frame can trigger local busy
(sending RNR acking up to N-1 I-frame) and later sending ack (RNR
acking up to N I-frame).

This was affecting TC_ERM_BV_07_C and TC_ERM_BV_22_C with some non
default channel parameters (tx window and receiving buffer sizes).

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
b17e73bb4269f47e1ea2d64a834f1cfc8644fabb 11-Jan-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Clear ack_timer when sending ack

ack_timer should be cleared when sending ACK to avoid acking I-frames
twice.

This commit introduces helper function (only send ack, not clearing
timer) which is used by l2cap_send_ack and l2cap_ack_timeout. This is
to avoid clearing ack timer in timer function.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
0ef3ef0f676e3c7aaab4a936635f503770fd38b2 11-Jan-2012 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Set P-bit for SREJ frame only if there are I-frames to ack

SREJ frame with P-bit set acknowledges I-frames numbered up to
(ReqSeq - 1). With this patch P-bit in SREJ is set only when there are
some I-frames to ack.

This fixes ambiguous situation when lost of I-frame with TxSeq=0 would
result in sending SREJ acking all previous I-frames.
Consider following scenario:
TxWindow=3

HostA: sent I-frame TxSeq=0
HostA: sent I-frame TxSeq=1
HostA: sent I-frame TxSeq=2
HostB: missed I-frame TxSeq=0
HostB: received I-frame TxSeq=1
HostB: sent SREJ ReqSeq=0 Pbit=1
HostA: received SREJ ReqSeq=0 Pbit=1 <- All I-frames acked or not?
...

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
8b281b9c7820b054d15cf471c418fd884cbbec78 10-Jan-2012 Fabio Estevam <festevam@gmail.com> Bluetooth: Fix 'enable_hs' type

Fix the following build warning:

CC [M] net/bluetooth/hci_core.o
net/bluetooth/hci_core.c: In function ‘__check_enable_hs’:
net/bluetooth/hci_core.c:2587: warning: return from incompatible pointer type

module_param in hci_core.c passes 'enable_hs' as bool format, so fix
this variable definition type.

Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
a3d4e20a88f54571d794cca365f232bfed0669bb 08-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Sort to-be-resolved devices by RSSI during discovery

This patch makes sure that devices with stronger signal (RSSI closer to
0) are sorted first in the resolve list and will therefore get their
names resolved first during device discovery. Since it's more likely
that the device the user is trying to discover has a strong signal due
to its proximity this ensures that the user gets the "device found"
event for it more quickly.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
gmt.c
44b5f7d0cb1939497a0858d9f43d89f039f85887 08-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix resetting HCI_MGMT flag

The HCI_MGMT flag should not be cleared when resetting a HCI device.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a8b2d5c2cfe1c6398e3fdd4372c4ae7f74fb4493 08-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move mgmt related flags from hdev->flags to hdev->dev_flags

There's no point in exposing these to user-space (which is what happens
to everything in hdev->flags) so move them to dev_flags instead.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
mp.c
cbe8fed490601862310f035b9973509b8634998e 08-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove bogus inline declaration from l2cap_chan_connect

As reported by Dan Carpenter this function causes a Sparse warning and
shouldn't be declared inline:

include/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a
definition"

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
2cap_core.c
dc946bd86f725c42c3ab1caf9966d29f5b364fea 07-Jan-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Remove __hci_dev_put/hold

Since we remove the owner field of hci_dev hci_dev_put and __hci_dev_put
do the same so we can merge them into one function. Same for
hci_dev_hold and __hci_dev_hold.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
4c724c7135ca2b407bd318b4267456a7b5723825 07-Jan-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Correctly take hci_dev->dev refcount

The hci_dev->dev device structure has an internal refcount. This
refcount is used to protect the whole hci_dev object. However, we
currently do not use it. Therefore, if someone calls hci_free_dev() we
currently immediately destroy the hci_dev object because we never took
the device refcount.

This even happens if the hci_dev->refcnt is not 0. In fact, the
hci_dev->refcnt is totally useless in its current state. Therefore, we
simply remove hci_dev->refcnt and instead use hci_dev->dev refcnt.

This fixes all the symptoms and also correctly integrates the device
structure into our bluetooth bus system.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
e9b9cfa1575e37cb2dbb5534aeaaa16814228887 07-Jan-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Remove HCI-owner field

After unregistering an hci_dev object a bluetooth driver does not have
any callbacks in the hci_dev structure left over. Therefore, there is no
need to keep a reference to the module.

Previously, we needed this to protect the hci-destruct callback.
However, this callback is no longer available so we do not need this
owner field, anymore. Drivers now call hci_unregister_dev() and they
are done with the object.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
46e06531a5ae13c66f774d3cb1ad78385618a5a2 07-Jan-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Correctly acquire module ref

We provide a device-object to other subsystems and we provide our own
release-function. Therefore, the device-object must own a reference to
our module, otherwise the release-function may get deleted before the
device-object does.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_sysfs.c
010666a126fce7b9ecdda7209c558db21d771c56 07-Jan-2012 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Make hci-destruct callback optional

Several drivers already provide an empty callback so we can actually
make this optional and then remove all those empty callbacks in the
drivers.

This callback isn't needed at all by most drivers as they can remove
their allocated structures on device disconnect and not on hci
destruction.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
cc48dc0a996af6ae20e91c551d71e7f72768860f 04-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove magic number from ACL TO

Adds HCI_ACL_TX_TIMEOUT and clear conversion from msec to jiffies

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_core.c
b83ddfe2ac670392c27a799371bb1a7e14a7e3d3 04-Jan-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: l2cap_set_timer needs jiffies as timeout value

After moving L2CAP timers to workqueues l2cap_set_timer expects timeout
value to be specified in jiffies but constants defined in miliseconds
are used. This makes timeouts unreliable when CONFIG_HZ is not set to
1000.

__set_chan_timer macro still uses jiffies as input to avoid multiple
conversions from/to jiffies for sk_sndtimeo value which is already
specified in jiffies.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Ackec-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_core.c
6423cf3a1862d5b162aaa13543bf69216a9f6ac0 04-Jan-2012 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Fix sk_sndtimeo initialization for L2CAP socket

sk_sndtime value should be specified in jiffies thus initial value
needs to be converted from miliseconds. Otherwise this timeout is
unreliable when CONFIG_HZ is not set to 1000.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
2cap_sock.c
25e89e99b4a54a2cb6e27b4675cd71a3d8a9b3fc 03-Jan-2012 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Process num completed data blocks event

Adds support for Number Of Completed Data Blocks Event.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
ci_event.c
30dc78e1a2bcbe2a0fca7aa44dfded4bb0db6148 04-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add name resolving support for mgmt based discovery

This patch adds the necessary logic to perform name lookups after
inquiry completes. This is done by checking for entries in the resolve
list after each inquiry complete and remote name complete HCI event.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
ff9ef5787046c3fd20cf9f7ca1cd70260c1eedb9 04-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add discovery state tracking

This patch adds proper state tracking to the device discovery process.
This makes it possible to return appropriate errors when trying to stop
a non-active discovery or start discovery when it is already ongoing.
Once name resolving is implemented this also makes it possible to know
what the right action to do is when a remote name lookup is cancelled.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
gmt.c
30883512be0839349d29c7b0bc31016e0498cf8c 04-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Rename hdev->inq_cache to hdev->discovery

This struct is used for not just inquiry caching but also for general
device discovery state tracking so it's better to rename it to something
more appropriate.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
gmt.c
4663262c294c71aa1139616ae7f24dd345a69c15 02-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Flush inquiry cache when starting mgmt triggered inquiry

For the remote name state tracking for the management interface to work
the cache needs to be flushed whenever inquiry is started. The
hci_do_inquiry function is only used by the management interface so by
having the flushing done from it ensures that old ioctl based
functionality isn't affected.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
3175405b906a85ed2bad21e09c444266e4a05a8e 04-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Return updated name state with hci_inquiry_cache_update

If user-space has already confirmed the name for a remote device we
shouldn't request confirmation again. The simplest way to do this is to
return the name state from hci_inquiry_cache_update (if it is anything
else than unknown then we do not need confirmation from user-space).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
561aafbcb2e3f8fee11d3781f866c7b4c4f93a28 04-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add initial mgmt_confirm_name support

This patch adds initial support for mgmt_confirm_name. It adds the
necessary tracking of the name state by extending the inquiry cache. The
actual name resolving operation (to be done once inquiry is finished) is
not yet part of this patch.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ci_sysfs.c
gmt.c
32748db00228b67a5315a91e1a6dd2c54864d87b 30-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move Extended Inquiry Response defines to hci.h

The EIR defines are needed also outside of mgmt.c (e.g. in hci_event.c
to check if EIR data has the complete name) so it's better to have them
in a single public place, i.e. hci.h.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
gmt.c
b57c1a5646739bfc273245dc738f2f12a2d4d3ec 03-Jan-2012 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert inquiry cache to use standard list types

This makes it possible to use the convenience functions provided for
standard kernel list types and it also makes it easier to extend the use
of the cache for the management interface where e.g. name resolving
control will be needed.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
b1cc16b8e643096adb92bbcb76c6c4c564141c40 22-Jan-2012 David S. Miller <davem@davemloft.net> bluetooth: hci: Fix type of "enable_hs" to bool.

Fixes:

net/bluetooth/hci_core.c: In function ‘__check_enable_hs’:
net/bluetooth/hci_core.c:2587:1: warning: return from incompatible pointer type [enabled by default]

Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
874c60bad92564358e87d58f505fceb0b09ec1aa 10-Jan-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next
117ff42fd43e92d24c6aa6f3e4f0f1e1edada140 05-Jan-2012 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
d8f46ff11081f03b09efe82245a3257bab6bf60e 04-Jan-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
57adc1fcbae2c13104ce291b40f23e40a414fa87 03-Jan-2012 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
drivers/net/wireless/b43/dma.c
drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
c5993de864d96b3656e9fca38c377b130105d97a 29-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct packet len calculation

Remove unneeded skb_pull and correct packet length calculation
removing magic number. Move BT_DBG after len check otherwise
it could possibly access wrong memory.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
3542b854bc26e5f8e42e0eab4d7f7453b74a362d 28-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Keep chan->state and sk->sk_state in sync

Those vars need to be in sync, otherwise l2cap_core.c can get the wrong
state.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
333055f2aaabadb951b5ecd90f6a20a9aee38c29 22-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't use *_bh locks anymore

Those locks are not shared between interrupt and process context anymore,
so remove the part that disable interrupts. We are still safe because
preemption is disabled.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e75a8b0c332875b2a2d22acdc331fc2b83788cac 02-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix mgmt_stop_discovery_failed()

Stop Discovery Command Status Event should use mgmt status code.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
d084329e2862922bbc9a2de04a5c8e7219bfceb9 02-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Queue adv_work on system workqueue

This patch queues hdev->adv_work on the system-wide workqueue
instead of on hdev->workqueue. This way we keep only tx/rx works
on hdev->workqueue.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
c1b9b4f45f014093231c568be9b5c2e392943696 02-Jan-2012 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix adv_work delay

This patch fixes the adv_work delay. It should be set to ADV_
CLEAR_TIMEOUT instead of (jiffies + ADV_CLEAR_TIMEOUT) since
queue_delayed_work() receives the number of jiffies to wait
before queueing. It also removes the unnecessary cancel_delayed_
work_sync() call in case LE scan has been disabled.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
b5b32b653dedb29eb95e57cbbaefc4abf7141cb2 30-Dec-2011 Andre Guedes <aguedespe@gmail.com> Bluetooth: Fix hci_cc_read_local_ext_features()

Copy the Features value according to the Page number.

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
59e294065ddee7074af91e4f5e12e6095eb1135b 30-Dec-2011 Andre Guedes <aguedespe@gmail.com> Bluetooth: Rename extfeatures

This patch renames hdev->extfeatures to hdev->host_features since it
holds the extended features Page 1 (aka host features).

Signed-off-by: Andre Guedes <aguedespe@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
94f5bfb8c1641080c3c4325714b8fe7d2839a906 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove *_bh from socket list lock.

We don't need it anymore.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
4b5dd696f81b210c1511ca7a969525126266c933 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove local_bh_disable() from hci_sock.c

Everything is in process context now, we do not need such a call.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sock.c
ee65d19e25c7ace7792bcd289776b2e24f4bf059 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove *_bh locks from SCO

Those locks are not shared between interrupt and process context anymore,
so remove the part that disable interrupts. We are still safe because
preemption is disabled.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
393432cd8dc02b88a00decd495913643aa5ff705 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix context in RFCOMM tty

We now run in process context, no need to disable interrupts.
Calls from the tty layer also run in process context.

rw_lock was converted to spinlock, we have more writers than readers in
this case.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/tty.c
95ca83f42fb5f5bf789b514635f79242afe555d1 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix context in rfcomm_sock_lock

Code now run in process context, does not need to disable interrupt
anymore.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
9219b2a08c8a1ca9935b85ec4ab119bb55b0cb15 02-Jan-2012 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bacpy in l2cap_core.c

It should be the dst in the copy not src. 03a001948 introduced this bug.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
4ae1652ef1bf38e07caa5d1d86ffd3b31103b55a 27-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix a compile warning in RFCOMM

sock and sk were leftover from another change.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
abb434cb0539fb355c1c921f8fd761efbbac3462 23-Dec-2011 David S. Miller <davem@davemloft.net> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
net/bluetooth/l2cap_core.c

Just two overlapping changes, one added an initialization of
a local variable, and another change added a new local variable.

Signed-off-by: David S. Miller <davem@davemloft.net>
cad44c2bf6165e46e309d4db0ffd286a9259aa2a 23-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Revert "Bluetooth: Increase HCI reset timeout in hci_dev_do_close"

This reverts commit e1b6eb3ccb0c2a34302a9fd87dd15d7b86337f23.

This was causing a delay of 10 seconds in the resume process of a Thinkpad
laptop. I'm afraid this could affect more devices once 3.2 is released.

Reported-by: Tomáš Janoušek <tomi@nomi.cz>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
3573b80c42e88c2a43c068c86bcd1a753cf6e1a0 23-Dec-2011 Hemant Gupta <hemant.gupta@stericsson.com> Bluetooth: Incorrect address while storing LTK.

This patch fixes incorrect address storage while storing
Long Term Key for LE Devices using SMP (Security Manager Protocol).
The address stored should be of remote device and not of source device.

Signed-off-by: Hemant Gupta <hemant.gupta@stericsson.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
af3e6359a2b52970c63c3c9f73d52be281a162ad 22-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't disable interrupt when locking the queue

We run everything in process context now.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
f20d09d5f7093e5dc5f231c65835e2d04739bd5e 22-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: remove *_bh usage from hci_dev_list and hci_cb_list

They don't need to disable interrupts anymore, we only run in process
context now.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
2fb9b3d4e5d720d4033461519af0d3f789924015 22-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: add debug output to l2cap_ack_timeout()

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
5436538fb5f2a12e5328dcaa2e3a1742be25c2e0 20-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove l2cap priority from inside RFCOMM.

RFCOMM needs a proper priority mechanism inside itself and not try to use
l2cap priority to fix its own problem.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
5fe57d9e9edb9182d1fa941b94902444c3174ccd 22-Dec-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Add SMP to User Passkey and Confirm

Low Energy pairing is performed through the SMP (Security Manager Protocol)
mechanism rather than HCI.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
2b64d153a0cc9d2b60e47be013cde8490f16e0a5 22-Dec-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Add MITM mechanism to LE-SMP

To achive Man-In-The-Middle (MITM) level security with Low Energy,
we have to enable User Passkey Comparison. This commit modifies the
hard-coded JUST-WORKS pairing mechanism to support query via the MGMT
interface of Passkey comparison and User Confirmation.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Acked-by: Marcel Holtmann<marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
371fd83563252f550ce59476a7366d0b5171d316 21-Dec-2011 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Fix deadlocks with sock lock and L2CAP timers locks

When cancelling a delayed work (timer) in L2CAP we can not sleep holding
the sock mutex otherwise we might deadlock with an L2CAP timer handler.
This is possible because RX/TX and L2CAP timers run in different workqueues.
The scenario below illustrates the problem. Thus we are now avoiding to
sleep on the timers locks.

======================================================
[ INFO: possible circular locking dependency detected ]
3.1.0-05270-ga978dc7-dirty #239
-------------------------------------------------------
kworker/1:1/873 is trying to acquire lock:
(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+...}, at: [<ffffffffa002ceac>] l2cap_chan_timeout+0x3c/0xe0 [bluetooth]

but task is already holding lock:
((&(&chan->chan_timer)->work)){+.+...}, at: [<ffffffff81051a86>] process_one_work+0x126/0x450

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #1 ((&(&chan->chan_timer)->work)){+.+...}:
[<ffffffff8106b276>] check_prevs_add+0xf6/0x170
[<ffffffff8106b903>] validate_chain+0x613/0x790
[<ffffffff8106dfee>] __lock_acquire+0x4be/0xac0
[<ffffffff8106ec2d>] lock_acquire+0x8d/0xb0
[<ffffffff81052a6f>] wait_on_work+0x4f/0x160
[<ffffffff81052ca3>] __cancel_work_timer+0x73/0x80
[<ffffffff81052cbd>] cancel_delayed_work_sync+0xd/0x10
[<ffffffffa002f2ed>] l2cap_chan_connect+0x22d/0x470 [bluetooth]
[<ffffffffa002fb51>] l2cap_sock_connect+0xb1/0x140 [bluetooth]
[<ffffffff8130811b>] kernel_connect+0xb/0x10
[<ffffffffa00cf98a>] rfcomm_session_create+0x12a/0x1c0 [rfcomm]
[<ffffffffa00cfbe7>] __rfcomm_dlc_open+0x1c7/0x240 [rfcomm]
[<ffffffffa00d07c2>] rfcomm_dlc_open+0x42/0x70 [rfcomm]
[<ffffffffa00d3b03>] rfcomm_sock_connect+0x103/0x150 [rfcomm]
[<ffffffff8130bd7e>] sys_connect+0xae/0xc0
[<ffffffff813368d2>] compat_sys_socketcall+0xb2/0x220
[<ffffffff813b2089>] sysenter_dispatch+0x7/0x30

-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+...}:
[<ffffffff8106b16d>] check_prev_add+0x6cd/0x6e0
[<ffffffff8106b276>] check_prevs_add+0xf6/0x170
[<ffffffff8106b903>] validate_chain+0x613/0x790
[<ffffffff8106dfee>] __lock_acquire+0x4be/0xac0
[<ffffffff8106ec2d>] lock_acquire+0x8d/0xb0
[<ffffffff8130d91a>] lock_sock_nested+0x8a/0xa0
[<ffffffffa002ceac>] l2cap_chan_timeout+0x3c/0xe0 [bluetooth]
[<ffffffff81051ae4>] process_one_work+0x184/0x450
[<ffffffff8105276e>] worker_thread+0x15e/0x340
[<ffffffff81057bb6>] kthread+0x96/0xa0
[<ffffffff813b1ef4>] kernel_thread_helper+0x4/0x10

other info that might help us debug this:

Possible unsafe locking scenario:

CPU0 CPU1
---- ----
lock((&(&chan->chan_timer)->work));
lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);
lock((&(&chan->chan_timer)->work));
lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);

*** DEADLOCK ***

2 locks held by kworker/1:1/873:
#0: (events){.+.+.+}, at: [<ffffffff81051a86>] process_one_work+0x126/0x450
#1: ((&(&chan->chan_timer)->work)){+.+...}, at: [<ffffffff81051a86>] process_one_work+0x126/0x450

stack backtrace:
Pid: 873, comm: kworker/1:1 Not tainted 3.1.0-05270-ga978dc7-dirty #239
Call Trace:
[<ffffffff813a0f6e>] print_circular_bug+0xd2/0xe3
[<ffffffff8106b16d>] check_prev_add+0x6cd/0x6e0
[<ffffffff8106b276>] check_prevs_add+0xf6/0x170
[<ffffffff8106b903>] validate_chain+0x613/0x790
[<ffffffff8106dfee>] __lock_acquire+0x4be/0xac0
[<ffffffff8130d8f6>] ? lock_sock_nested+0x66/0xa0
[<ffffffff8106ea30>] ? lock_release_nested+0x100/0x110
[<ffffffff8130d8f6>] ? lock_sock_nested+0x66/0xa0
[<ffffffff8106ec2d>] lock_acquire+0x8d/0xb0
[<ffffffffa002ceac>] ? l2cap_chan_timeout+0x3c/0xe0 [bluetooth]
[<ffffffff8130d91a>] lock_sock_nested+0x8a/0xa0
[<ffffffffa002ceac>] ? l2cap_chan_timeout+0x3c/0xe0 [bluetooth]
[<ffffffff81051a86>] ? process_one_work+0x126/0x450
[<ffffffffa002ceac>] l2cap_chan_timeout+0x3c/0xe0 [bluetooth]
[<ffffffff81051ae4>] process_one_work+0x184/0x450
[<ffffffff81051a86>] ? process_one_work+0x126/0x450
[<ffffffffa002ce70>] ? l2cap_security_cfm+0x4e0/0x4e0 [bluetooth]
[<ffffffff8105276e>] worker_thread+0x15e/0x340
[<ffffffff81052610>] ? manage_workers+0x110/0x110
[<ffffffff81057bb6>] kthread+0x96/0xa0
[<ffffffff813b1ef4>] kernel_thread_helper+0x4/0x10
[<ffffffff813af69d>] ? retint_restore_args+0xe/0xe
[<ffffffff81057b20>] ? __init_kthread_worker+0x70/0x70
[<ffffffff813b1ef0>] ? gs_change+0xb/0xb

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
686ebf283ba19f82abd8aaec023cd124749be9ec 21-Dec-2011 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Make HCI call directly into SCO and L2CAP event functions

The struct hci_proto and all related register/unregister and dispatching
code was removed. HCI core code now call directly the SCO and L2CAP
event functions.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap_core.c
co.c
68a8aea45973c8d0bc05f58389ce9e82e04bb5f6 19-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove magic numbers from le scan cmd

Make code readable by removing magic numbers.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
8a154a8feb805394d1fd46281becaf876e18860a 20-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix bt_accept_dequeue() to work in process context

No local_bh_disable is needed there once we run everything in process
context. The same goes for the replacement of bh_lock_sock() by
lock_sock().

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
b4949b84567f3ae1227d076fc95bbd8efea06506 21-Dec-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
f1e91e1640d808d332498a6b09b2bcd01462eff9 21-Dec-2011 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Always compile SCO and L2CAP in Bluetooth Core

The handling of SCO audio links and the L2CAP protocol are essential to
any system with Bluetooth thus are always compiled in from now on.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
config
akefile
nep/Kconfig
mtp/Kconfig
idp/Kconfig
fcomm/Kconfig
f2d64f6aa6c681ca00a71c2b3304ed80dc317752 20-Dec-2011 Ulisses Furquim <ulisses@profusion.mobi> Bluetooth: Remove global mutex hci_task_lock

The hci_task_lock mutex (previously a lock) was supposed to protect the
register/unregister of HCI protocols against RX/TX tasks. This will not
be needed anymore because SCO and L2CAP will always be compiled.

Moreover, with the recent move of RX/TX to workqueues per device the
global hci_task_lock was causing starvation between different HCI
devices.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
030013d8585bfc9479bb367bf771d96ef8e289a4 20-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename info_work to info_timer

It makes more sense this way, since info_timer is a timer using delayed
work API.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
6c9d42a1615c6dc19c4a57a77d9c4b3d779bb741 20-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: convert security timer to delayed_work

This one also needs to run in process context

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
mp.c
c2ec9c1bbd17cdd1fc962f000b4ecb98c1dad830 20-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move l2cap_{set,clear}_timer to l2cap.h

It is the only place where it is used.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
613a1c0c595fe2f2d9148a705f140a53bc9f56e1 19-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Clean up magic pointers

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
32ac5b9b57ef521470f930fd00849be4705bc134 19-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Check for flow control mode

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
2455a3ea0c0235fe3c32b67649ff7db3fb892d90 19-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Initialize default flow control mode

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
e61ef49966777defa84b04159ea23cdeb2c7cd4c 19-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Split ctrl init to BREDR and AMP parts

Current controller initialization is moved tp bredr_init and new
function added amp_init to handle later AMP init sequence. Current
AMP init sequence include Reset and Read Local Version.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
eb93992207dadb946a3b5cf4544957dc924a6f58 19-Dec-2011 Rusty Russell <rusty@rustcorp.com.au> module_param: make bool parameters really bool (net & drivers/net)

module_param(bool) used to counter-intuitively take an int. In
fddd5201 (mid-2009) we allowed bool or int/unsigned int using a messy
trick.

It's time to remove the int/unsigned int option. For this version
it'll simply give a warning, but it'll break next kernel version.

(Thanks to Joe Perches for suggesting coccinelle for 0/1 -> true/false).

Cc: "David S. Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
ci_event.c
ci_sock.c
2cap_core.c
fcomm/core.c
co.c
9662cbc712babe3f7a792af2bdd47fa0c631f27f 19-Dec-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next
4b0b2f088f12e2ada1297502d7bebde182cf65b0 19-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth

Conflicts:
net/bluetooth/l2cap_core.c
d7660918fce210f421cc58c060ca3de71e4ffd37 19-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Revert "Bluetooth: Revert: Fix L2CAP connection establishment"

This reverts commit 4dff523a913197e3314c7b0d08734ab037709093.

It was reported that this patch cause issues when trying to connect to
legacy devices so reverting it.

Reported-by: David Fries <david@fries.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
79e654787c67f6b05f73366ff8ccac72ba7249e6 07-Dec-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Clear RFCOMM session timer when disconnecting last channel

When the last RFCOMM data channel is closed, a timer is normally set
up to disconnect the control channel at a later time. If the control
channel disconnect command is sent with the timer pending, the timer
needs to be cancelled.

If the timer is not cancelled in this situation, the reference
counting logic for the RFCOMM session does not work correctly when the
remote device closes the L2CAP connection. The session is freed at
the wrong time, leading to a kernel panic.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
36e999a83a4a4badd389901eb6d23a30e199b8db 09-Dec-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Prevent uninitialized data access in L2CAP configuration

When configuring an ERTM or streaming mode connection, remote devices
are expected to send an RFC option in a successful config response. A
misbehaving remote device might not send an RFC option, and the L2CAP
code should not access uninitialized data in this case.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
65983fc7bb8df655706cb6e8353b6561b633ee4d 14-Dec-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Incoming ACL packets do not force active mode

Incoming sk_buffs always have bt_cb(skb)->force_active set to 0, so
it's misleading to use that value from the control block when calling
hci_conn_enter_active_mode() for incoming data. The destination socket
is not known in the HCI layer, so the force_active setting for each
socket isn't known either. Hard-coding the force_active parameter does
not change any behavior, but makes it obvious that incoming ACL data
never exits sniff mode.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
f42809185896296d5662778e4ec63e084cfa5f2b 07-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Simplify num_comp_pkts_evt function

Simplify function and remove fourth level of indentation.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
350ee4cfc0ea620bd1126ad4daa295586d6aa3a9 07-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add HCI Read Data Block Size function

Implement block size read function. Use different variables for
packet-based and block-based flow control.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
c9c2659f1ea84f860af82cac504cc58f17067523 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Use correct struct for user_confirm_neg_reply

This patch fixes user_confirm_neg_reply to use the appropriate struct
for accessing the call parameters.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
7d78525dcf5c6fe5e6e73d22776ed5f960e3153e 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add timer for automatically disabling the service cache

We do not want the service cache to be enabled indefinitely after
mgmt_read_info is called. To solve this a timer is added which will
automatically disable the cache if mgmt_set_dev_class isn't called
within 5 seconds of calling mgmt_read_info.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
ef5803729c2323204f7372617ad97e55e94153b9 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move EIR and CoD update functions to a better position

Due to the upcoming addition of a service cache timer the functions to
update the EIR and CoD need to be higher up in mgmt.c in order to avoid
unnecessary forward-declarations. This patch simply moves code around
without any other changes in order to make subsequent patches more
readable.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
14c0b60829751135346d71e7d11649c4f72dc9af 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove mgmt_set_service_cache

Instead of having an explicit service cache command we can make the mgmt
API simpler by implicitly enabling the cache when mgmt_read_info is
called for the first time and disabling it when mgmt_set_dev_class is
called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sock.c
gmt.c
f7c6869cebe631582fdc2ac57459ee217ce9b015 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move mgmt_set_fast_connectable to the right location

Fast connectable is logically after the connectable property so that's
where it should show up in the code as well (it's also after connectable
in the settings bitfield).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
69ab39ea5da03e632a51b31534da713aff8d1e3b 14-Dec-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update mgmt_read_info and related mgmt messages

This patch updates the mgmt_read_info and related messages to the latest
management API which uses a bitfield of settings instead of individual
boolean values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
590051de5ce54f7ae02997ed0a2532f08c7b7866 18-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add ProFUSION's copyright

Add ProFUSION's copyright to some files I've been touching recently.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap_core.c
2cap_sock.c
7f971041cf591d8cf3b289c9d78739638ca7e629 18-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use system workqueue to schedule power_on

hdev->workqueue should be only for rx/tx, so move this one out.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
6d438e335ce83ff0528415a58632dc6508e4fde1 17-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove work_add and work_del from hci_sysfs

As we run in process context now we don't need worqueue to add e del from
sysfs.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
32845eb1242e4c862de8d27c19ae9b3011f89291 17-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use new alloc_workqueue()

Update hdev workqueue API usage to use the new interface, this new
interface also allow us to mark this workqueue as WQ_HIGHPRI, so now rx
and tx work gets higher priority when running.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
80b7ab33414beeb3c17600af9b69d903f5cf8a7d 17-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move power_off to system workqueue

hdev->workqueue will be only for for rx/tx/cmd processing, all other small
works should go to the system workqueue for now.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
3d57dc6806599ca7d389fc9410eefbc1a7dc32bc 17-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Change l2cap chan_list to use RCU

This list has much more reads than writes, so RCU makes senses here, also
it avoid deadlock against the socket lock.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
03a001948166d966d0d580cddb8ae3a23f8b795b 09-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: invert locking order in connect path

This move some checking code that was in l2cap_sock_connect() to
l2cap_chan_connect(). Thus we can invert the lock calls, i.e., call
lock_sock() before hci_dev_lock() to avoid a deadlock scenario.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
f878fcad1760247c054a9c80964d0b7450d2379b 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: convert info timer to delayed_work

Another step of remove interrupt context from Bluetooth Core.
Use the system workqueue.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
3eff45eaf81780dad25c167bbaafa7d25ae407da 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: convert tx_task to workqueue

This should simplify Bluetooth core processing a lot.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
ci_sock.c
c347b765fe70d718c721cd6d0b979cfbaed83125 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move command task to workqueue

As part of the moving on all the Bluetooth processing to Process context.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
ci_sock.c
3c54711c4fd103edf2044ab60726939f1de02b0c 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't disable tasklets to call hdev->notify()

It's pointless, we aren't protecting anything since btusb_notify()
schedules a work to run, then all it operation happens without protection.
If protection is really needed here, we will fix it further.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
bf4c63252490ba78fb833cc7acf1a5b1900c970f 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: convert conn hash to RCU

Handling hci_conn_hash with RCU make us avoid some locking and disable
tasklets.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
8192edef03f9b47f1cc1120724db525e63e218f3 14-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use RCU to manipulate chan_list

Instead of using tasklet_disable() to prevent acess to the channel use, we
can use RCU and improve the performance of our code.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
d01b2ff4e6496bc48a1917b6340e13263f871a15 09-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: convert chan_lock to mutex

spin lock doesn't fit ok anymore on the new code based on workqueues.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
67d0dfb5ec781e9fe030e4e61359ee6eed66ff92 09-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move hci_task_lock to mutex

Now we can sleep in any path inside Bluetooth core, so mutex can make
sense here.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
eb403a1b7eea9d736c55f78407dccb42b72757a4 24-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove sk_backlog usage from L2CAP

We run everything in the same lock now. The backlog queue is useless now

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
aa2ac881ba1e4e9f878be2ece80001ae8563955c 24-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't use spin_lock socket lock anymore

We now run everything in process context, so the mutex lock is the best
option. But in some places we still need the bh_lock_sock()

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
721c41812daf7b38759942563773a7832e3c990d 24-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move L2CAP timers to workqueue

L2CAP timers also need to run in process context. As the works in l2cap
are small we are using the system worqueue.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
b9cc553f12d14b692d0fcb607d28db783da68139 17-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: hci_conn_auto_accept() doesn't need locking

It doesn't really touch any sensitive information about hdev. So no need
to lock here.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
db323f2fff0ded058f033df6235e8c2be4146bfd 20-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use delayed work for advertisiment cache timeout

As HCI rx path is now done in process context it makes sense to do all the
timer in process context as well.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
19c40e3bcaf2d969f5d4ee85bbe1330b54d36d9c 17-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use delayed_work for connection timeout

Bluetooth rx task runs now in a workqueue, so it a good approach run any
timer that share locking with process context code also in a workqueue.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
09fd0de5bd8f8ef3317e5365f92f1a13dcd89aa9 17-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Replace spin_lock by mutex in hci_dev

Now we run everything in HCI in process context, so it's a better idea use
mutex instead spin_lock. The macro remains hci_dev_lock() (and I got rid
of hci_dev_lock_bh()), of course.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
ci_sock.c
ci_sysfs.c
idp/core.c
2cap_core.c
gmt.c
co.c
b78752cc71d86998d3b77d873c61d6ffdb7a2142 09-Aug-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Process recv path in a workqueue instead of a tasklet

Run recv process in workqueue helps a lot with our processing as the recv
path will also be in the process context, i.e., now all our tx and rx are
in process context.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
416dc94baa4a0de6904707d17522f7eae7778c8e 07-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: make hci_conn_enter_sniff_mode static

It isn't used outside hci_conn.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
3e9c40a6f72a4ee7a978204cac00f91ad08bbe9b 15-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use list_for_each_entry in hci_conn_hash_flush()

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
f9c3123b5a7c9585902927b14983e6635aca00c6 09-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use chan instead of l2cap_pi macro

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
2c33c06a8fd2f784ca763ad150d5d63c3c49946e 14-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: remove struct hci_chan_hash

Only the list member of the struct was used, so we now fold it into
hci_conn.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
e7ab5f1c323e137120561daeec75e91a1bd9ec8b 09-Dec-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem
5f779bbd472cdb2046ff8b672ad8c5b62b61cd19 06-Dec-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next
5a13b09531420d230616bd524b68a5b0c23cd487 01-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: trivial: correct check for LMP version

Make sure that code match exactly what comment says about pre 1.2
bluetooth version. Since this is HCI detail lmp_ver changed to hci_ver.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
d095c1ebd43a43c1d78055ff111f464b04f8624e 01-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Remove magic bluetooth version numbers

Use bluetooth names instead of BT SIG assigned numbers

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
5c69b0ada634bca4111fcc332df5fad2447ec90f 03-Dec-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth
33cb722c22f28964a501a56cc76397834c221c7a 23-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Correct version check in hci_setup

Check for hci_ver instead of lmp_ver

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
ce7e4ad1436a0139c16225f2376134cff3ad24fe 01-Dec-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: remove old code

Remove old code not touched for several years.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
07f7fa5db1e65a27066c8ebf9fc676a4168e07f4 02-Dec-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: LE Set Scan Parameter Command

This patch adds the parameter struct and the command complete event
handler to the LE Set Scan Parameter HCI command.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
d23264a896a931c4b355c102d8e9d46649195ba4 26-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add dev_flags to struct hci_dev

This patch adds the dev_flags field to struct hci_dev. This new
flags variable should be used to define flags related to BR/EDR
and/or LE controller itself. It should be used to define flags
which represents states from the controller. The dev_flags is
cleared in case the controller sends a Reset Command Complete
Event to the host.

Also, this patch adds the HCI_LE_SCAN flag which was created to
track if the controller is performing LE scan or not. The flag
is set/cleared when the controller starts/stops scanning.

This is an initial effort to stop using hdev->flags to define
internal flags since it is exported to userspace by an ioctl.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
1e89cffb44a94e1937e5ec16125ae866dbba7b2e 24-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Add HCI Read Flow Control Mode function

Upstream Code Aurora function with minor trivial fixes.
Origin: git://codeaurora.org/kernel/msm.git

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
4f957a76014fb63d193cd6c141bdd94aaff3a25e 23-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Centralize SMP pairing failure handling

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
c8eb969071032defb1dc493ae28cf2e2a31193a5 23-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Cleanup blkcipher on SMP termination

The blkcipher must be freed to avoid memory leak.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
1143d45846f190465382dd667c7f893b9d1fd131 23-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Add HCI User Passkey Req Evt handling

Some MITM scenarios require handling of the User Passkey Request event,
by querying the user, and passing the response back.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
604086b73b9b342414a53c0f34dd23aecb005ff8 23-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Add User Passkey Response handling

For some MITM protection pairing scenarios, the user is
required to enter or accept a 6 digit passkey.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
badaaa00f2122bab4bc2d46c26d6fad6af50f97c 23-Nov-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add user readable debug for state changes

I did this as a part of a testing course at university, but it might be
useful upstream as well.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
515db09338704a6ad7d27b5f1e33820d3052edd2 22-Nov-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux

Conflicts:
drivers/net/wireless/iwlegacy/iwl-debugfs.c
drivers/net/wireless/iwlegacy/iwl-rx.c
drivers/net/wireless/iwlegacy/iwl-scan.c
drivers/net/wireless/iwlegacy/iwl-tx.c
include/net/bluetooth/bluetooth.h
c6feeb28aed51831c27c9f42e5c15129b1562a5b 16-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Use queue in the device list

Use queue instead of stack discipline for device list. When processing
dev_list with list_for_each* devices will be prosessed in order they
were added (Usually BR/EDR first and AMP later).

Also output from hciconfig looks nicer :-)

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
47c15e2b332dd51048170915ad8c4ab4b47e3bf2 16-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: Differentiate LE User Pairing Responses

Low Energy (LE) pairing responses must be recognized and handled
differently from BR/EDR pairing responses. BR/EDR responses are
handled via HCI commands by the LMP layer, and LE responses are
handled by the Host.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
0df4c185ed84d914fa2671fa5f4cec2f8dee2d2e 16-Nov-2011 Brian Gix <bgix@codeaurora.org> Bluetooth: User Pairing Response restructuring

There are 4 possible User Responses to pairing requests,
and they all share the same checks and handling. This
restructures the handling of the two Confirm responses
in preperation for the second two.

Signed-off-by: Brian Gix <bgix@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
7784d78f184a80ca576f87b5a663b7b40e7a9b25 18-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: making enable_hs independent from L2CAP

Fixes bluetooth compiling when CONFIG_BT_L2CAP is not enabled

net/built-in.o: In function `hci_dev_open':
(.text+0xdce9a): undefined reference to `enable_hs'

Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap_core.c
9b338c3dd12918f7f7df2b882f63f71e9efbcb41 19-Nov-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: bnep: Fix module reference

We cannot call module_put(THIS_MODULE) if this is our last reference. Otherwise,
this call may cleanup our module before it returns.

Gladly, the kthread API provides a simple wrapper for us. So lets use
module_put_and_exit() to avoid a race condition with the module cleanup code.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
48b28b8db9a74cc5c43e76485dc397e22bea2984 19-Nov-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: cmtp: Fix module reference

We cannot call module_put(THIS_MODULE) if this is our last reference. Otherwise,
this call may cleanup our module before it returns.

Gladly, the kthread API provides a simple wrapper for us. So lets use
module_put_and_exit() to avoid a race condition with the module cleanup code.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
1ec918cef5ced016edb95c357e45e656e4e156b1 16-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix some checkpatch.pl errors and warnings

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap_core.c
250938cb370351fb603e1d47292377421bb029b2 16-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Simplify __l2cap_global_chan_by_addr

Make __l2cap_global_chan_by_addr similar to other find functions.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
d1726b6dc95b5ed0914e969f6765a9e2cf7baf04 16-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Refactor loop in l2cap_retransmit_one_frame

This make it easier to see what is the real reason for loop to exit.
skb_queue_next return valid skb or garbage, not NULL.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
039d9572f11ef46ff2743798f2170a888d393ec6 16-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Simplify l2cap_add_to_srej_queue

Make it easier to see what is loop break condition.
skb_queue_next return valid skb or garbage, not NULL.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
aef89f214e4306153c7913b9854456595153f5d8 16-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix possible NULL pointer derefence in l2cap code

Due to ERTM reliability L2CAP channel needs to be disconnected if
adding to srej list failed.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
07e3b94ac385cc9d5fd31d6dcd233da0958b9984 11-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Do not set HCI_RAW when HS enabled

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
450dfdafbcfbf19e39481d0e4737a832b991333a 12-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass all message parameters to mgmt_start_discovery

The mgmt_start_discovery command contains the type of discovery that
should be started so this should be passed to the start_discovery
function. This patch doesn't yet add any action depending on the type of
the requested discovery.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
0e5f875a8f4fa78edf5762d6d0a9843e1d9ae85e 11-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing cmd_complete for mgmt_load_link_keys

The command complete event was completely missing for this command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
ca69b7957bf2e3bc0acc882b837a42617498ece1 11-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Create a unique mgmt error code hierarchy

The management protocol uses a single byte for error codes (aka command
status). In some places this value is directly copied from HCI and in
other a POSIX error number is used. This makes it impossible for
user-space to uniquily decipher the meaning of an error.

To solve this issue a new mgmt-specific set of error codes is added
along with a conversion table for HCI status values.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
8680570b0cae8f66ad28c8de227aab1894428ee5 11-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Return success instead of EALREADY for mgmt commands

When the adapter state is already what is requested it's more friendly
to user-space to simply report success than to send a EALREADY error
message.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
1425acb74b6d58690d78027021ce1d8f3068c66f 10-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt_pair_device imediate error responses

When possible cmd_complete should be returned instead of cmd_status
since it contains the remote address (this helps user-space track what
exactly failed).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
ba4e564f60064689661882c84fa2ee63e39b457e 10-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type to mgmt_pair_device

The kernel needs to know whether it should connect to a device over
BR/EDR or over LE. This is particularly important in the future when
dual-mode device may be connectable also over LE. It is also important
if/when we decide to move the LE advertisement cache from the kernel
into user-space. Adding the type to the mgmt command also ensures
conformance with the latest mgmt API spec.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e6d465cb482935c26cb4065a6ab9ce987c067da3 09-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: mgmt_stop_discovery_failed()

This patches creates mgmt_stop_discovery_failed() which removes
pending MGMT_OP_STOP_DISCOVERY commands and sends proper command
status events.

This patch also fixes the MGMT_OP_STOP_DISCOVERY command leak in
case cancel inquiry fails.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
7a13510902c81ad865f6d02aed2f4e053a46050e 09-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Rename mgmt_inquiry_failed()

This patch renames the function mgmt_inquiry_failed() to
mgmt_start_discovery_failed(). This function is more related
to MGMT_OP_START_DISCOVERY command handling than to inquiry.
Besides, this functions will be reused by LE based discovery
procedures in case of failure.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
4d611e4d3dc78efcba514d235b5f0a6df0828372 24-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Only set ack_timer if we didn't send and ack

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0bee1d60cbad24288c75573511356d450c1fd45a 05-Nov-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Allow L2CAP to increase the security level

Some incomming connections needs to increase the security level by
requesting encryption for example (HID keyboard case). This change allows
the userspace to change it through setsockopt with defer_setup enabled.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
d45fc42323b7909829b8f27f26676c675f26551f 05-Nov-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename l2cap_check_security()

rename to l2cap_chan_check_security() to make it consistent with other
l2cap_exported functions. This function will be exported in a later
commit.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
37d9ef76c26092098e8fbd3fd540b7ac2181e6bf 10-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add status parameter to mgmt_disconnect response

Since disconnecting may fail the status needs to be communicated to user
space. This also updates the implementation to match the latest mgmt API
specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
a8a1d19e9d00e2ec6f28b89133137390b1d293bd 10-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add proper response to mgmt_remove_keys command

Since the command can fail we need to have a proper response with the
remote address and a failure status for it. This also updates it to
conform to the latest mgmt API spec.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
c3f06755ca4279597cd58befd6c076ae2e3db480 10-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix deadlock with mgmt_pair_device

The hci_conn callbacks are called with the hci_dev lock already held so
no locking should be attempted in them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
48264f06943e2db2c971b752949606f070d9d292 09-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add public/random LE address information to mgmt messages

It's necessary to know the distinction between public and random LE
addresses so the mgmt interface also needs to distinguish between them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
3b971a7ceb2e39e0cab95c079c738b2052b3e02f 09-Nov-2011 David S. Miller <davem@davemloft.net> Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
312fef7d18adda2be822d31916547f84ed6af28b 09-Nov-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next

Conflicts:
net/bluetooth/l2cap_sock.c
net/bluetooth/mgmt.c
2aeabcbedd51aef94b61d05b57246d1db4984453 09-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant hci_dev comparisons in mgmt lookups

Now that pending commands are hci_dev specific there's no need to check
whether a command matches hci_dev when iterating through them.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
fc2f4b13d8c91713efb972be42566f7f3625f5ed 09-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix consistency with u16 integer type in mgmt pending_cmd

For consistency the integer type should be u16 and not __u16.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e0f9309f371096b82ad35aa2c27d7f848f37e696 09-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix cancel_delayed_work_sync usage with locks

The cancel_delayed_work_sync function should not be used if we hold any
locks. Luckily all places where this is the case it is also safe to use
the non-sync version.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
56e5cb86eb377970825486a5861f5926d65e64c1 08-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add missing hci_dev locking when calling mgmt functions

Now that the pending commands are within struct hci_dev we can properly
control access to them throught the hci_dev locking mechanism.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
2e58ef3e11d0775795345a20185b5a7c4bdae194 08-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Move pending management command list into struct hci_dev

This patch moves the pending management command list (previously global
to mgmt.c) into struct hci_dev. This makes it possible to do proper
locking when accessing it (through the existing hci_dev locks) and
thereby avoid race conditions.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
744cf19eadcf4de914394e0eb227f94f4318f5e4 08-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Pass full hci_dev struct to mgmt callbacks

The current global pending command list in mgmt.c is racy. Possibly the
simplest way to fix it is to have per-hci dev lists instead of a global
one (all commands that need a pending struct are hci_dev specific).
This way the list can be protected using the already existing per-hci
dev lock. To enable this refactoring the first thing that needs to be
done is to ensure that the mgmt functions have access to the hci_dev
struct (instead of just the dev id).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
4c659c3976e81f9def48993cd00988d53d7379f2 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add address type fields to mgmt messages that need them

This patch adds address type info (typically BR/EDR vs LE) to management
messages that need this. This also ensures conformance to the latest
management API specification.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
86742e1eca319069490f6f20c2892baafc2a6922 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Update link key mgmt APIs to match latest spec.

BR/EDR link keys have their own commands and events (separate from SMP)
and the remove_keys command (previously remove_key) removes keys of any
kind for the specified remote address.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
bd2d1334e1dd64765b29f9e1b592777c410ed121 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix response for mgmt_start_discovery when powered off

We should return a ENETDOWN status response if the adapter is powered
off (i.e. the HCI_UP flag isn't set).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
889d07ee57e950790cbec81df7b4f9d8691ee0b4 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove redundant code from mgmt_block & mgmt_unblock

There's no need to deal with mgmt_pending_cmd when blocking and
unblocking devices since these actions are synchronous.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
3243553fdc108a0ef49b9e25bdea9c87b341413e 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Convert power off mechanism to use delayed_work

The power off code doesn't need to use its own custom timer since the
delayed_work API provides the exact same functionality.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
2d7cee5836d6d466829b255b1290c9386d4e884f 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt response when HCI_Write_Scan_Enable fails

A proper mgmt_command_status should be returned to user-space if either
discoverable or connectable enabling fails.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
16ab91ab48287aa4fc757f3618820f728ee4412f 07-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Add timeout field to mgmt_set_discoverable

Based on the revised mgmt API set_discoverable has a timeout parameter
to specify how long the adapter will remain discoverable. A value of 0
means "indefinitively".

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
89352e7d3ab372ffad8efe2aa070e0b63df42b85 04-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Periodic Inquiry and Discovery

By using periodic inquiry command we're not able to detect correctly
when the controller has started inquiry.

Today we have this workaround in inquiry result event handler
to set the HCI_INQUIRY flag when it sees the first inquiry result
event. This workaround isn't enough because the device may be
performing an inquiry but the HCI_INQUIRY flag is not set. For
instance, if there is no device in range, no inquiry result event
is generated, consequently, the HCI_INQUIRY flags isn't set when
it should so.

We rely on HCI_INQUIRY flag to implement the discovery procedure
properly. So, as we aren't able to clear/set the HCI_INQUIRY flag
in a reliable manner, periodic inquiry events shouldn't change
the HCI_INQUIRY flag.

Thus, due to that issue and in order to keep compatibility with
userspace, periodic inquiry events shouldn't send mgmt discovering
events.

In future, we might track if periodic inquiry is enabled or not.
By tracking this state we'll be able to do some improvements in
Discovery such as failing MGMT_OP_START_DISCOVERY command in case
periodic inquiry is on. We can also send no mgmt_device_found
event if periodic inquiry is on.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
023d50498d04c77b73eed11d849e436ef5639ed2 04-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Create hci_cancel_inquiry()

This patch adds a function to hci_core to cancel an ongoing inquiry.

According to the Bluetooth spec, the inquiry cancel command should
only be issued after the inquiry command has been issued, a command
status event has been received for the inquiry command, and before
the inquiry complete event occurs.

As HCI_INQUIRY flag is only set just after an inquiry command status
event occurs and it is cleared just after an inquiry complete event
occurs, the inquiry cancel command should be issued only if HCI_INQUIRY
flag is set.

Additionally, cancel inquiry related code from stop_discovery() were
replaced by a hci_cancel_inquiry() call.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
2519a1fc82490eb13d69610f81fe84930f3b0e3f 07-Nov-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Create hci_do_inquiry()

This patch adds a function to hci_core to carry out inquiry.

All inquiry code from start_discovery() were replaced by a
hci_do_inquiry() call.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
66af7aaf9edff55b7995bbe1ff508513666d0671 07-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: parse L2CAP config response

Add parsing Extended Flow Specification in L2CAP Config Response.
Based upon haijun.liu <haijun.liu@atheros.com> series of patches
(sent Sun, 22 Aug 2010)

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
9f5a0d7bf079e9e26771ad13ff1c2cb3adf80963 07-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Define HCI reasons instead of magic number

Use HCI error reasons instead of magic numbers.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
2cap_core.c
36f7fc7e9ac72507ab7bf6caf77ad252c12ab37e 03-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Clean up logic in hci_cc_write_scan_enable

This patch adds a new label to hci_cc_write_scan_enable to avoid
unnecessary indentation. This will be convenient especially when new
code for the discoverable timeout gets added.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
abc545b8efe3d50d649590df4b88cc652fd057f1 03-Nov-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Add debug print to l2cap_chan_create

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
b24752fe655e9427240a5fe840914b94e5f9c2bc 03-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix mgmt response when adapter goes down or is removed

When an adapter gets powered off or is removed any pending commands
should receive a ENETDOWN or ENODEV status response.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
08add513caa8930b8f7b9d5837a7dda624741745 03-Nov-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Guarantee BR-EDR device will be registered as hci0

It's convenient to use the HCI device index the AMP controller id, but
the spec requires that an AMP controller never has id 0.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
8d5a04a130e3493c17eae7a881102ab1a4283736 03-Nov-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add signal handlers for channel moves

AMP channels can be moved between BR/EDR and AMP controllers using a
sequence of signals. Every attempted channel move involves a series of
four signals:

Move Initiator Move Responder
| |
| Move Channel Request |
| ----------------------------> |
| |
| Move Channel Response |
| <---------------------------- |
| |
| Move Channel Confirm |
| ----------------------------> |
| |
| Move Channel Confirm Response |
| <---------------------------- |

All four signals are sent even if the move fails.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
50a147cd9c7523d1b11d0284a0be7891631517dd 03-Nov-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use symbolic values for the fixed channel map

The A2MP fixed channel bit is only set when high-speed mode is enabled.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
f94ff6fff7b8b5896a173d165e9ec579c83067f2 03-Nov-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add signal handlers for channel creation

Handle both "create channel request" and "create channel response".

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2ea664822af6705574dfbbf8c77fc7d75a94e9b3 03-Nov-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add channel policy to getsockopt/setsockopt

Each channel has a policy to require BR/EDR (the default),
prefer BR/EDR, or prefer AMP.

Check for valid policy value and L2CAP mode.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
6b3c7104677a731cf6d3638e09d9d6c530b9bc25 02-Nov-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: Initialize tx_win_max for fixed channel

tx_win_max is initialized during L2CAP configuration phase. For fixed
channels (e.g. A2MP) we want to have it initialized when channel is
created.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
02b20f0bb661829cbd431e5deb2474e909e65cec 02-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: recalculate priorities when channels are starving

To avoid starvation the priority is recalculated so that the starving
channels are promoted to HCI_PRIO_MAX - 1 (6).

HCI_PRIO_MAX (7) is considered special, because it requires CAP_NET_ADMIN
capability which can be used to provide more guaranties, so it is not used
when promoting.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ec1cce24d5950e797f10650abf7890ead67c6e64 02-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: handle priority change within quote

The quote is calculated based on the first buffer in the queue so if the
priority changes to something lower than the priority of the first skb
the quote needs to be recalculated.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
73d80deb7bdf0171f22e76dc2429c1f99eff90e2 02-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: prioritizing data over HCI

This implement priority based scheduler using skbuffer priority set via
SO_PRIORITY socket option.

It introduces hci_chan_hash (list of HCI Channel/hci_chan) per connection,
each item in this list refer to a L2CAP connection and it is used to
queue the data for transmission.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
2cap_core.c
mp.c
3c32fa93e5a54cd54e52541892857b0c7164a61e 20-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix hidp_get_connection()

This functions needs crtl_sock and intr_sock to be set first.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
25df0845e054f70a8735ee0184739472d8a573c9 01-Nov-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: hidp: Fix module reference cleanup

Calling module_put(THIS_MODULE) is *never* safe when we cannot go sure that we
own at least two references. This is because the call may unload our module
before it returns and then the "return" will jump into invalid memory.

Gladly, module.h provides a wrapper for kthread-users: module_put_and_exit().
This puts our module and then exits the kthread without returning to the module.

This patch fixes the hidp kthread to use this wrapper instead of manually
freeing its own reference. See nfsd or lockd for other kthreads using this.

Calling __module_get() inside the kthread is safe as the hidp module will always
wait until the kthread sets "waiting_for_startup" to 0.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
df164df9a77979d1774ede353988c1a62584594b 24-Oct-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set HCI_MGMT flag only in read_controller_info

The HCI_MGMT flag should only be set when user space requests the full
controller information. This way we avoid potential issues with setting
change events ariving before the actual read_controller_info command
finishes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
43611a7b16038753e0510dfb0c038c80a10c80c3 17-Oct-2011 Szymon Janc <szymon@janc.net.pl> Bluetooth: Increase HCI reset timeout in hci_dev_do_close

I've noticed that my CSR usb dongle was not working if it was plugged in when
PC was booting. It looks like I get two HCI reset command complete events (see
hcidump logs below).
The root cause is reset called from off_timer. Timeout for this reset to
complete is set to 250ms and my bt dongle requires more time for replying with
command complete event. After that, chip seems to reply with reset command
complete event for next non-reset command.

Attached patch increase mentioned timeout to HCI_INIT_TIMEOUT, this value is
already used for timeouting hci_reset_req in hci_dev_reset().

This might also be related to BT not working after suspend that was reported
here some time ago.

Hcidump log:

2011-09-12 23:13:27.379465 < HCI Command: Reset (0x03|0x0003) plen 0
2011-09-12 23:13:27.380797 > HCI Event: Command Complete (0x0e) plen 4
Reset (0x03|0x0003) ncmd 1
status 0x00
2011-09-12 23:13:27.380859 < HCI Command: Read Local Supported Features (0x04|0x000
3) plen 0
2011-09-12 23:13:27.760789 > HCI Event: Command Complete (0x0e) plen 4
Reset (0x03|0x0003) ncmd 1
status 0x00
2011-09-12 23:13:27.760831 < HCI Command: Read Local Version Information (0x04|0x00
01) plen 0
2011-09-12 23:13:27.764780 > HCI Event: Command Complete (0x0e) plen 12
Read Local Version Information (0x04|0x0001) ncmd 1
status 0x00
HCI Version: 1.1 (0x1) HCI Revision: 0x36f
LMP Version: 1.1 (0x1) LMP Subversion: 0x36f
Manufacturer: Cambridge Silicon Radio (10)

Signed-off-by: Szymon Janc <szymon@janc.net.pl>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
db54467a89266c02f9ce6c6db1d193365cff62a4 26-Sep-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: rfcomm: Fix sleep in invalid context in rfcomm_security_cfm

This was triggered by turning off encryption on ACL link when rfcomm
was using high security. rfcomm_security_cfm (which is called from rx
task) was closing DLC and this involves sending disconnect message
(and locking socket).

Move closing DLC to rfcomm_process_dlcs and only flag DLC for closure
in rfcomm_security_cfm.

BUG: sleeping function called from invalid context at net/core/sock.c:2032
in_atomic(): 1, irqs_disabled(): 0, pid: 1788, name: kworker/0:3
[<c0068a08>] (unwind_backtrace+0x0/0x108) from [<c05e25dc>] (dump_stack+0x20/0x24)
[<c05e25dc>] (dump_stack+0x20/0x24) from [<c0087ba8>] (__might_sleep+0x110/0x12c)
[<c0087ba8>] (__might_sleep+0x110/0x12c) from [<c04801d8>] (lock_sock_nested+0x2c/0x64)
[<c04801d8>] (lock_sock_nested+0x2c/0x64) from [<c05670c8>] (l2cap_sock_sendmsg+0x58/0xcc)
[<c05670c8>] (l2cap_sock_sendmsg+0x58/0xcc) from [<c047cf6c>] (sock_sendmsg+0xb0/0xd0)
[<c047cf6c>] (sock_sendmsg+0xb0/0xd0) from [<c047cfc8>] (kernel_sendmsg+0x3c/0x44)
[<c047cfc8>] (kernel_sendmsg+0x3c/0x44) from [<c056b0e8>] (rfcomm_send_frame+0x50/0x58)
[<c056b0e8>] (rfcomm_send_frame+0x50/0x58) from [<c056b168>] (rfcomm_send_disc+0x78/0x80)
[<c056b168>] (rfcomm_send_disc+0x78/0x80) from [<c056b9f4>] (__rfcomm_dlc_close+0x2d0/0x2fc)
[<c056b9f4>] (__rfcomm_dlc_close+0x2d0/0x2fc) from [<c056bbac>] (rfcomm_security_cfm+0x140/0x1e0)
[<c056bbac>] (rfcomm_security_cfm+0x140/0x1e0) from [<c0555ec0>] (hci_event_packet+0x1ce8/0x4d84)
[<c0555ec0>] (hci_event_packet+0x1ce8/0x4d84) from [<c0550380>] (hci_rx_task+0x1d0/0x2d0)
[<c0550380>] (hci_rx_task+0x1d0/0x2d0) from [<c009ee04>] (tasklet_action+0x138/0x1e4)
[<c009ee04>] (tasklet_action+0x138/0x1e4) from [<c009f21c>] (__do_softirq+0xcc/0x274)
[<c009f21c>] (__do_softirq+0xcc/0x274) from [<c009f6c0>] (do_softirq+0x60/0x6c)
[<c009f6c0>] (do_softirq+0x60/0x6c) from [<c009f794>] (local_bh_enable_ip+0xc8/0xd4)
[<c009f794>] (local_bh_enable_ip+0xc8/0xd4) from [<c05e5804>] (_raw_spin_unlock_bh+0x48/0x4c)
[<c05e5804>] (_raw_spin_unlock_bh+0x48/0x4c) from [<c040d470>] (data_from_chip+0xf4/0xaec)
[<c040d470>] (data_from_chip+0xf4/0xaec) from [<c04136c0>] (send_skb_to_core+0x40/0x178)
[<c04136c0>] (send_skb_to_core+0x40/0x178) from [<c04139f4>] (cg2900_hu_receive+0x15c/0x2d0)
[<c04139f4>] (cg2900_hu_receive+0x15c/0x2d0) from [<c0414cb8>] (hci_uart_tty_receive+0x74/0xa0)
[<c0414cb8>] (hci_uart_tty_receive+0x74/0xa0) from [<c02cbd9c>] (flush_to_ldisc+0x188/0x198)
[<c02cbd9c>] (flush_to_ldisc+0x188/0x198) from [<c00b2774>] (process_one_work+0x144/0x4b8)
[<c00b2774>] (process_one_work+0x144/0x4b8) from [<c00b2e8c>] (worker_thread+0x198/0x468)
[<c00b2e8c>] (worker_thread+0x198/0x468) from [<c00b9bc8>] (kthread+0x98/0xa0)
[<c00b9bc8>] (kthread+0x98/0xa0) from [<c0061744>] (kernel_thread_exit+0x0/0x8)

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
164a6e78990f6201dc3105ff88335ca91392a427 01-Nov-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix command complete/status for discovery commands

This patch adds the necessary code to send proper command status or
command complete events to the start/stop discovery management commands.
Before this patch these events were completely missing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
262038fcb2a50e9b5553243452918fda08cdf83d 01-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: make use sk_priority to priritize RFCOMM packets

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
fcomm/sock.c
5e59b791c3561e2fbb4aee17df3505ad25c16b7a 01-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: set skbuffer priority based on L2CAP socket priority

This uses SO_PRIORITY to set the skbuffer priority field

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
8035ded466049ca2fe8c04564a0fa00f222abe3f 01-Nov-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: replace list_for_each with list_for_each_entry whenever possible

When all items in the list have the same type there is no much of a point
to use list_for_each except if you want to use the list pointer itself.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
mtp/core.c
ci_conn.c
ci_core.c
ci_sysfs.c
idp/core.c
gmt.c
fcomm/core.c
fcomm/tty.c
457f48507deb0e8c8dd299c7d8dce7c2c0e291e8 31-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: correct debug output

l2cap_set_timer function prints sk instead of chan pointer.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
c6337ea6e5771a3c51c1ac7295a16f390220abe1 20-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: remove magic offset and size

make code readable by removing magic numbers

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
3e6b3b95f26e1253cd429cf949b9c41598ba3033 01-Nov-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: small styles clean ups to l2cap_core.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0e8b207e8a4442f1a662e1a3827e61e40279630a 17-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: implement L2CAP config pending state

Add L2CAP Config Pending state for EFS. Currently after receiving
Config Response Pending respond with Config Response Success.

...
> ACL data: handle 1 flags 0x02 dlen 16
L2CAP(s): Connect rsp: dcid 0x0040 scid 0x0040 result 0 status 0
Connection successful
> ACL data: handle 1 flags 0x02 dlen 45
L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 33
RFC 0x03 (Enhanced Retransmission, TxWin 63, MaxTx 3, RTo 0, MTo 0, MPS 1009)
EFS (Id 0x01, SerType Best Effort, MaxSDU 0xffff, SDUitime 0xffffffff,
AccLat 0xffffffff, FlushTO 0x0000ffff)
< ACL data: handle 1 flags 0x00 dlen 45
L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 33
RFC 0x03 (Enhanced Retransmission, TxWin 63, MaxTx 3, RTo 0, MTo 0, MPS 498)
EFS (Id 0x01, SerType Best Effort, MaxSDU 0xffff, SDUitime 0xffffffff,
AccLat 0xffffffff, FlushTO 0x0000ffff)
< ACL data: handle 1 flags 0x00 dlen 47
L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 4 clen 33
Pending
MTU 672
RFC 0x03 (Enhanced Retransmission, TxWin 63, MaxTx 3, RTo 2000, MTo 12000, MPS 498)
EFS (Id 0x01, SerType Best Effort, MaxSDU 0xffff, SDUitime 0xffffffff,
AccLat 0xffffffff, FlushTO 0x0000ffff)
> ACL data: handle 1 flags 0x02 dlen 47
L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 4 clen 33
Pending
MTU 672
RFC 0x03 (Enhanced Retransmission, TxWin 63, MaxTx 3, RTo 2000, MTo 12000, MPS 498)
EFS (Id 0x01, SerType Best Effort, MaxSDU 0xffff, SDUitime 0xffffffff,
AccLat 0xffffffff, FlushTO 0x0000ffff)
> ACL data: handle 1 flags 0x02 dlen 14
L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 0 clen 0
Success
< ACL data: handle 1 flags 0x00 dlen 14
L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 0 clen 0
Success
< ACL data: handle 1 flags 0x00 dlen 510
L2CAP(d): cid 0x0040 len 506 ext_ctrl 0x00010000 fcs 0xebe0 [psm 4113]
I-frame: Start (len 672) TxSeq 0 ReqSeq 0
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
59735631d24e3463f139a21255e0db94bc59081e 26-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Make hci_unregister_dev return void

hci_unregister_dev cannot fail and always returns 0. The drivers already ignore
the return value so we can safely make it return void.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
96af7391b752cf3d2de3aef8f03c45ba76d3ac5e 24-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Replace rfcomm tty tasklet by workqueue

Remove old tasklets and replace by workqueue. To avoid reentrancy (which
tasklets always avoid) we use the system_nrt_wq.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/tty.c
5ada9913630d48438f2e07551af43cbf297372d4 24-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Return proper error codes on rfcomm tty init

Forward error codes from tty core to the rfcomm_init caller instead of using
generic -1 errors.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/tty.c
f3f668b0ef4399b67e60e4c10a30099d630a6206 07-Nov-2011 Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com> Bluetooth: Use miliseconds for L2CAP channel timeouts

Timers set by __set_chan_timer() should use miliseconds instead of
jiffies. Commit 942ecc9c4643db5ce071562e0a23f99464d6b461 updated
l2cap_set_timer() so it expects timeout to be specified in msecs
instead of jiffies. This makes timeouts unreliable when CONFIG_HZ
is not set to 1000.

Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
94956eed14b4b16d401c8ad36d68df0608f968cb 07-Nov-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (47 commits)
forcedeth: fix a few sparse warnings (variable shadowing)
forcedeth: Improve stats counters
forcedeth: remove unneeded stats updates
forcedeth: Acknowledge only interrupts that are being processed
forcedeth: fix race when unloading module
MAINTAINERS/rds: update maintainer
wanrouter: Remove kernel_lock annotations
usbnet: fix oops in usbnet_start_xmit
ixgbe: Fix compile for kernel without CONFIG_PCI_IOV defined
etherh: Add MAINTAINERS entry for etherh
bonding: comparing a u8 with -1 is always false
sky2: fix regression on Yukon Optima
netlink: clarify attribute length check documentation
netlink: validate NLA_MSECS length
i825xx:xscale:8390:freescale: Fix Kconfig dependancies
macvlan: receive multicast with local address
tg3: Update version to 3.121
tg3: Eliminate timer race with reset_task
tg3: Schedule at most one tg3_reset_task run
tg3: Obtain PCI function number from device
...
4dff523a913197e3314c7b0d08734ab037709093 26-Oct-2011 Arek Lichwa <arkadiusz.lichwa@tieto.com> Bluetooth: Revert: Fix L2CAP connection establishment

This reverts commit 330605423ca6eafafb8dcc27502bce1c585d1b06.
The commit introduces regression when two 2.1 devices attempt
establish rfcomm channel. Such connection is refused since there's
a security block issue on l2cap. It means the link is unencrypted.

2011-09-16 18:08:46.567616 < ACL data: handle 1 flags 0x00 dlen 24
0000: 14 00 40 00 06 00 02 00 0f 35 03 19 12 00 ff ff
..@......5....˙˙
0010: 35 05 0a 00 00 ff ff 00 5....˙˙.
2011-09-16 18:08:46.572377 > HCI Event: Number of Completed Packets
(0x13) plen 5
handle 1 packets 1
2011-09-16 18:08:46.577931 > ACL data: handle 1 flags 0x02 dlen 88
L2CAP(d): cid 0x0040 len 84 [psm 0]
0000: 07 00 02 00 4f 00 4c 35 4a 35 48 09 00 00 0a 00
....O.L5J5H.....
0010: 01 00 00 09 00 01 35 03 19 12 00 09 00 05 35 03
......5.......5.
0020: 19 10 02 09 00 09 35 08 35 06 19 12 00 09 01 02
......5.5.......
0030: 09 02 00 09 01 02 09 02 01 09 00 0a 09 02 02 09
................
0040: 00 00 09 02 03 09 00 00 09 02 04 28 01 09 02 05
...........(....
0050: 09 00 02 00 ....
2011-09-16 18:08:46.626057 < HCI Command: Authentication Requested
(0x01|0x0011) plen 2
handle 1
2011-09-16 18:08:46.627614 > HCI Event: Command Status (0x0f) plen 4
Authentication Requested (0x01|0x0011) status 0x00 ncmd 1
2011-09-16 18:08:46.627675 > HCI Event: Link Key Request (0x17) plen 6
bdaddr 00:00:F2:6A:29:69
2011-09-16 18:08:46.634999 < HCI Command: Link Key Request Reply
(0x01|0x000b) plen 22
bdaddr 00:00:F2:6A:29:69 key 58CD393179FC902E5E8F512A855EE532
2011-09-16 18:08:46.683278 > HCI Event: Command Complete (0x0e) plen 10
Link Key Request Reply (0x01|0x000b) ncmd 1
status 0x00 bdaddr 00:00:F2:6A:29:69
2011-09-16 18:08:46.764729 > HCI Event: Auth Complete (0x06) plen 3
status 0x00 handle 1
2011-09-16 18:08:46.764821 < ACL data: handle 1 flags 0x00 dlen 12
0000: 08 00 01 00 02 05 04 00 03 00 41 00 ..........A.
2011-09-16 18:08:46.764851 > HCI Event: Command Status (0x0f) plen 4
Unknown (0x00|0x0000) status 0x00 ncmd 2
2011-09-16 18:08:46.768117 > HCI Event: Number of Completed Packets
(0x13) plen 5
handle 1 packets 1
2011-09-16 18:08:46.770894 > ACL data: handle 1 flags 0x02 dlen 16
L2CAP(s): Connect rsp: dcid 0x0000 scid 0x0041 result 3 status 0
Connection refused - security block
2011-09-16 18:08:49.000691 < ACL data: handle 1 flags 0x00 dlen 12
0000: 08 00 01 00 06 06 04 00 40 00 40 00 ........@.@.
2011-09-16 18:08:49.015675 > HCI Event: Number of Completed Packets
(0x13) plen 5
handle 1 packets 1
2011-09-16 18:08:49.016927 > ACL data: handle 1 flags 0x02 dlen 12
L2CAP(s): Disconn rsp: dcid 0x0040 scid 0x0040
2011-09-16 18:08:51.009480 < HCI Command: Disconnect (0x01|0x0006) plen
3
handle 1 reason 0x13
Reason: Remote User Terminated Connection
2011-09-16 18:08:51.011525 > HCI Event: Command Status (0x0f) plen 4
Disconnect (0x01|0x0006) status 0x00 ncmd 1
2011-09-16 18:08:51.123494 > HCI Event: Disconn Complete (0x05) plen 4
status 0x00 handle 1 reason 0x16
Reason: Connection Terminated by Local Host

Signed-off-by: Arek Lichwa <arkadiusz.lichwa@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
c125d5e846894043361c0c89c1140be8fd6600b7 02-Nov-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth
bc3b2d7fb9b014d75ebb79ba371a763dbab5e8cf 15-Jul-2011 Paul Gortmaker <paul.gortmaker@windriver.com> net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules

These files are non modular, but need to export symbols using
the macros now living in export.h -- call out the include so
that things won't break when we remove the implicit presence
of module.h from everywhere.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2cap_sock.c
3a9a231d977222eea36eae091df2c358e03ac839 27-May-2011 Paul Gortmaker <paul.gortmaker@windriver.com> net: Fix files explicitly needing to include module.h

With calls to modular infrastructure, these files really
needs the full module.h header. Call it out so some of the
cleanups of implicit and unrequired includes elsewhere can be
cleaned up.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
ci_sysfs.c
gmt.c
dafbde395ed560ddc3695df40f61d91c47433228 24-Oct-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Set HCI_MGMT flag only in read_controller_info

The HCI_MGMT flag should only be set when user space requests the full
controller information. This way we avoid potential issues with setting
change events ariving before the actual read_controller_info command
finishes.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e1b6eb3ccb0c2a34302a9fd87dd15d7b86337f23 17-Oct-2011 Szymon Janc <szymon@janc.net.pl> Bluetooth: Increase HCI reset timeout in hci_dev_do_close

I've noticed that my CSR usb dongle was not working if it was plugged in when
PC was booting. It looks like I get two HCI reset command complete events (see
hcidump logs below).
The root cause is reset called from off_timer. Timeout for this reset to
complete is set to 250ms and my bt dongle requires more time for replying with
command complete event. After that, chip seems to reply with reset command
complete event for next non-reset command.

Attached patch increase mentioned timeout to HCI_INIT_TIMEOUT, this value is
already used for timeouting hci_reset_req in hci_dev_reset().

This might also be related to BT not working after suspend that was reported
here some time ago.

Hcidump log:

2011-09-12 23:13:27.379465 < HCI Command: Reset (0x03|0x0003) plen 0
2011-09-12 23:13:27.380797 > HCI Event: Command Complete (0x0e) plen 4
Reset (0x03|0x0003) ncmd 1
status 0x00
2011-09-12 23:13:27.380859 < HCI Command: Read Local Supported Features (0x04|0x000
3) plen 0
2011-09-12 23:13:27.760789 > HCI Event: Command Complete (0x0e) plen 4
Reset (0x03|0x0003) ncmd 1
status 0x00
2011-09-12 23:13:27.760831 < HCI Command: Read Local Version Information (0x04|0x00
01) plen 0
2011-09-12 23:13:27.764780 > HCI Event: Command Complete (0x0e) plen 12
Read Local Version Information (0x04|0x0001) ncmd 1
status 0x00
HCI Version: 1.1 (0x1) HCI Revision: 0x36f
LMP Version: 1.1 (0x1) LMP Subversion: 0x36f
Manufacturer: Cambridge Silicon Radio (10)

Signed-off-by: Szymon Janc <szymon@janc.net.pl>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
1805b2f04855f07afe3a71d620a68f483b0ed74f 25-Oct-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of ra.kernel.org:/pub/scm/linux/kernel/git/davem/net
6230c9b4f8957c8938ee4cf2d03166d3c2dc89de 07-Oct-2011 Paul Moore <pmoore@redhat.com> bluetooth: Properly clone LSM attributes to newly created child connections

The Bluetooth stack has internal connection handlers for all of the various
Bluetooth protocols, and unfortunately, they are currently lacking the LSM
hooks found in the core network stack's connection handlers. I say
unfortunately, because this can cause problems for users who have have an
LSM enabled and are using certain Bluetooth devices. See one problem
report below:

* http://bugzilla.redhat.com/show_bug.cgi?id=741703

In order to keep things simple at this point in time, this patch fixes the
problem by cloning the parent socket's LSM attributes to the newly created
child socket. If we decide we need a more elaborate LSM marking mechanism
for Bluetooth (I somewhat doubt this) we can always revisit this decision
in the future.

Reported-by: James M. Cape <jcape@ignore-your.tv>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_sock.c
fcomm/sock.c
co.c
42dceae2819b5ac6fc9a0d414ae05a8960e2a1d9 17-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: parse L2CAP config request

Add parsing Extended Flow Specification option in L2CAP Config Request
Based upon haijun.liu <haijun.liu@atheros.com> series of patches
(sent Sun, 22 Aug 2010)

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
c8f791626a8840fe60a05ab55468dfb3922cb35a 16-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: fix max_pdu calculation

Fix max_pdu_size calculationin for RFC. Change magic number to human readable
defines.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
03a512137da58e18bec15b46c409a62e0250447e 16-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: remove magic numbers in l2cap

Remove magic numbers for FCS, SDU LEN and PSM LEN
when calculating packet payload.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
836be934218eb80abc5515d584c329c26951086f 16-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: support extended seq numbers

Adds support for extended sequence numbers found in
extended control fields.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
88843ab06b6f279bff1c32e4218541ac7efe2600 16-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: handling different Control fields

There are three different Control Field formats: the Standard Control
Field, the Enhanced Control Field, and the Extended Control Field.
Patch adds function to handle all those fields seamlessly.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e5b82e58922749e79b84b85cfc6845cbfd1908ed 15-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix missing cmd_status in mgmt

set_service_cache() was missing a cmd_status for the error case.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
12dc0743015fee37f4090f0937c898294cd2d133 15-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use list_for_each_entry() in mgmt

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
b7059136d765603f2cff05d5e2d4850a4e505ec8 15-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add missing cmd_status() in mgmt

Improve error handling in mgmt load_keys()

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
56b7d137855eb02cba8aecbb67d49c24b43644b0 15-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: return proper error if sock_queue_rcv_skb() fails

Improve error handling at cmd_status() and cmd_complete()

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
33ca954daf1ac03c86237b73235d8b0856d84981 08-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Forward errors from hci_register_dev

We need to catch errors when calling hci_add_sysfs() and return them to
the caller to avoid kernel oopses on device_add() failure.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ce242970f0934869483221c410d09c00bc8967e7 08-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Rename sysfs un/register to add/del

As we introduced hci_init_sysfs() we should also rename
hci_register_sysfs() and hci_unregister_sysfs() to hci_add_sysfs() and
hci_del_sysfs() like we do with hci_conn_add/del_sysfs(). It looks more
consistent now.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_sysfs.c
0ac7e7002c4d0841197e9ccb8cfecc5b8c58b200 08-Oct-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: Fix hci core device initialization

We must not call device_del() if we didn't use device_add(). See module.c
for comments on that. Therefore, we need to call device_initialize() when
allocating the hci device and later device_add() instead of
device_register().

This also fixes a bug when hci_register_dev() failed and we call
hci_free_dev() without a valid core device. hci_free_dev() segfaults while
calling put_device() on invalid memory.

We already do this with hci_conn connections (hci_conn_init_sysfs()) so
they do not need to be fixed.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_sysfs.c
88149db4948ef90cf6220d76e34955e46c2ff9f9 26-Sep-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: rfcomm: Fix sleep in invalid context in rfcomm_security_cfm

This was triggered by turning off encryption on ACL link when rfcomm
was using high security. rfcomm_security_cfm (which is called from rx
task) was closing DLC and this involves sending disconnect message
(and locking socket).

Move closing DLC to rfcomm_process_dlcs and only flag DLC for closure
in rfcomm_security_cfm.

BUG: sleeping function called from invalid context at net/core/sock.c:2032
in_atomic(): 1, irqs_disabled(): 0, pid: 1788, name: kworker/0:3
[<c0068a08>] (unwind_backtrace+0x0/0x108) from [<c05e25dc>] (dump_stack+0x20/0x24)
[<c05e25dc>] (dump_stack+0x20/0x24) from [<c0087ba8>] (__might_sleep+0x110/0x12c)
[<c0087ba8>] (__might_sleep+0x110/0x12c) from [<c04801d8>] (lock_sock_nested+0x2c/0x64)
[<c04801d8>] (lock_sock_nested+0x2c/0x64) from [<c05670c8>] (l2cap_sock_sendmsg+0x58/0xcc)
[<c05670c8>] (l2cap_sock_sendmsg+0x58/0xcc) from [<c047cf6c>] (sock_sendmsg+0xb0/0xd0)
[<c047cf6c>] (sock_sendmsg+0xb0/0xd0) from [<c047cfc8>] (kernel_sendmsg+0x3c/0x44)
[<c047cfc8>] (kernel_sendmsg+0x3c/0x44) from [<c056b0e8>] (rfcomm_send_frame+0x50/0x58)
[<c056b0e8>] (rfcomm_send_frame+0x50/0x58) from [<c056b168>] (rfcomm_send_disc+0x78/0x80)
[<c056b168>] (rfcomm_send_disc+0x78/0x80) from [<c056b9f4>] (__rfcomm_dlc_close+0x2d0/0x2fc)
[<c056b9f4>] (__rfcomm_dlc_close+0x2d0/0x2fc) from [<c056bbac>] (rfcomm_security_cfm+0x140/0x1e0)
[<c056bbac>] (rfcomm_security_cfm+0x140/0x1e0) from [<c0555ec0>] (hci_event_packet+0x1ce8/0x4d84)
[<c0555ec0>] (hci_event_packet+0x1ce8/0x4d84) from [<c0550380>] (hci_rx_task+0x1d0/0x2d0)
[<c0550380>] (hci_rx_task+0x1d0/0x2d0) from [<c009ee04>] (tasklet_action+0x138/0x1e4)
[<c009ee04>] (tasklet_action+0x138/0x1e4) from [<c009f21c>] (__do_softirq+0xcc/0x274)
[<c009f21c>] (__do_softirq+0xcc/0x274) from [<c009f6c0>] (do_softirq+0x60/0x6c)
[<c009f6c0>] (do_softirq+0x60/0x6c) from [<c009f794>] (local_bh_enable_ip+0xc8/0xd4)
[<c009f794>] (local_bh_enable_ip+0xc8/0xd4) from [<c05e5804>] (_raw_spin_unlock_bh+0x48/0x4c)
[<c05e5804>] (_raw_spin_unlock_bh+0x48/0x4c) from [<c040d470>] (data_from_chip+0xf4/0xaec)
[<c040d470>] (data_from_chip+0xf4/0xaec) from [<c04136c0>] (send_skb_to_core+0x40/0x178)
[<c04136c0>] (send_skb_to_core+0x40/0x178) from [<c04139f4>] (cg2900_hu_receive+0x15c/0x2d0)
[<c04139f4>] (cg2900_hu_receive+0x15c/0x2d0) from [<c0414cb8>] (hci_uart_tty_receive+0x74/0xa0)
[<c0414cb8>] (hci_uart_tty_receive+0x74/0xa0) from [<c02cbd9c>] (flush_to_ldisc+0x188/0x198)
[<c02cbd9c>] (flush_to_ldisc+0x188/0x198) from [<c00b2774>] (process_one_work+0x144/0x4b8)
[<c00b2774>] (process_one_work+0x144/0x4b8) from [<c00b2e8c>] (worker_thread+0x198/0x468)
[<c00b2e8c>] (worker_thread+0x198/0x468) from [<c00b9bc8>] (kthread+0x98/0xa0)
[<c00b9bc8>] (kthread+0x98/0xa0) from [<c0061744>] (kernel_thread_exit+0x0/0x8)

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
928abaa777501ddab94b1b49aae485a2c730d303 12-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: AMP: read local amp info HCI command

Implementation of Read Local AMP Info Command

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
f89cef09cee60a9715150a6e335dce4e64df7400 13-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: add efs option in L2CAP conf req

Add Extended Flow Specification option when building L2CAP
Configuration Request. EFS is added if both the local and
remote L2CAP entities have indicated support for the
Extended Flow Specification for BR/EDR.

...
< ACL data: handle 1 flags 0x00 dlen 10
L2CAP(s): Info req: type 2
> ACL data: handle 1 flags 0x02 dlen 16
L2CAP(s): Info rsp: type 2 result 0
Extended feature mask 0x01f8
Enhanced Retransmission mode
Streaming mode
FCS Option
Extended Flow Specification
Fixed Channels
Extended Window Size
...
< ACL data: handle 1 flags 0x00 dlen 45
L2CAP(s): Config req: dcid 0x0040 flags 0x00 clen 33
RFC 0x03 (Enhanced Retransmission, TxWin 63, MaxTx 3, RTo 0, MTo 0, MPS 498)
EFS (Id 0x01, SerType Best Effort, MaxSDU 0xffff, SDUitime 0xffffffff,
AccLat 0xffffffff, FlushTO 0x0000ffff)
...

Based upon haijun.liu <haijun.liu@atheros.com> series of patches
(sent Sun, 22 Aug 2010)

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
8f7975b153faab4b78369458a892dd705e7c395b 13-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: assign default values in chan add

Assign default EFS values when creating L2CAP channel

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e4ca6d9854dc252e294007fc91249ce34d9a82e8 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: recalculate L2CAP header size

Recalculate length of L2CAP header based on Control field length.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e37817353bf94a4e00faad78ffb8cc07f8556252 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite handling POLL (P) bit

Handle POLL (P) bit in L2CAP ERTM using information about control field type.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
03f6715d463e6ee3e724ac64a9bedf1ad7d2b9b4 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite handling FINAL (F) bit

Handle final (F) bit in L2CAP using information about control field type.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
793c2f1cb9d722231290daf1744e6c5b7269f445 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite check frame type function

Check frame function uses now information about control field type.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
fb45de7dbaf2cf8eec43a88bdb98889f0d4d5d5f 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite L2CAP ERTM txseq calculation

L2CAP ERTM txseq calculation uses now information about control field type.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0b209fae88c6e844f2ee9d4d791f0f31f7f42ae9 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite reqseq calculation

reqseq calculation uses now information about control field type.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
7e0ef6ee13ecdf38c2c8b0b0c8ef729710b994eb 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite handling SAR bits

Segmentation and Reassembly (SAR) occupies different windows in standard and
extended control fields. Convert hardcoded masks to relative ones and use shift
to access SAR bits.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
ab784b7383735681660ccbdda4569fff196c2672 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: rewrite handling Supervisory (S) bits

Supervisory bits occupy different windows in standard / extended control
fields. Convert hardcoded masks to relative ones and use shift to access
S-bit window.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
6327eb980d2ff0c96363b81cb0ce580165cb81b8 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EWS: extended window size option support

Adds support for extended window size (EWS) config option. We enable EWS
feature in L2CAP Info RSP when hs enabled. EWS option is included in L2CAP
Config Req if tx_win (which is set via socket) bigger then standard default
value (63) && hs enabled && remote side supports EWS feature.

Using EWS selects extended control field in L2CAP.

Code partly based on Qualcomm and Atheros patches sent upstream a year ago.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
094daf7db7c47861009899ce23f9177d761e20b0 11-Oct-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.infradead.org/users/linville/wireless-next into for-davem

Conflicts:
Documentation/feature-removal-schedule.txt
669bb3962bd7f781879222eeb7263d527551dd5e 11-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix permission of enable_le param

With 0444 it is impossible to change the param, changing it to 0644.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
43bd0f32d5cf6593e420b26e2c1c41dc371a47d7 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: convert role_switch variable to flag in l2cap chan

role_switch variable inside l2cap_chan is a logical one and can
be easily converted to flag

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
15770b1ab9747de47604da3494e187056b120aff 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: convert force_active variable to flag in l2cap chan

force_active variable inside l2cap_chan is a logical one and can
be easily converted to flag

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
ecf61bdba845b5e77cf1d5e8620ef54abcfa50ef 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: convert force_reliable variable to flag in l2cap chan

force_reliable variable inside l2cap_chan is a logical one and can
be easily converted to flag

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
d57b0e8b8990419b7b7ae0dda5cc4452720b3c7c 11-Oct-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: convert flushable variable to flag in l2cap chan

flushable variable inside l2cap_chan is a logical one and can
be easily converted to flag. Added flags in l2cap_chan structure.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
3e90dc86f4b840297bd1fafdb9ba1bf58f2e0e49 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename hidp_find_connection()

hidp_get_connection() makes more sense because we hold a reference to the
connection inside this function.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
81b25cd04387fbceb76fe893db4863a380941413 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Delay session allocation in hidp

It gets allocated only when it is really needed.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
1785dbf9e30be62ab45e34900e574b8307bc98b5 30-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: hidp: safely acquire hci connection

Claim device lock to safely enumerate hci connection list and bump
hci connection proxy device ref count simultaneously.

This patch incorporates David Herrmann's fix to prevent adding an
HID device when the hci connection no longer exists.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
ab88f7149e0e3284623adcaa60460a9a69d9f131 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Uses test_and_clear_bit() when possible

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
192893c72197b3f49f76a315024bdcd5aa26fff3 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove wrong error check

d458a9dfc add this check, but now it proves to be wrong.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
3415a5fdde715062aa18bd6361f8e75cfbb31208 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix input device registration

This is a regression fix. It made impossible use input device when hid
fails.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
679344e44e09c74848535a28948df7c3b3c1a071 07-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Trasmit interrupt channel messages first

interrupt channel is low latency.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
dc0da5cdac44aea6a04b18acc5526931430e0c35 06-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: prioritize the interrupt channel in hidp

Interrupt channel has low latency requiments, should be processed first.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
cd11cdd28468d6222ce6489b2212fa7b0efaefdf 06-Oct-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: use list_for_each_entry() in hidp

list_for_each_entry is much more meaningful.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
794d175698f0e78be7f2e3f4bdbe0e7cd3f2d6ae 26-Aug-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: hidp: Stop I/O on shutdown

Current hidp driver purges the in/out queue on HID shutdown, but does
not prevent further I/O. If a driver uses hidp_output_raw_report or
hidp_get_raw_report during shutdown, the driver hangs for 5 or 10
seconds per call until it gets a timeout.
That is, if the output queue of an HID driver has 10 messages pending,
it will take 50s until hid_destroy_device() will return. The
hidp_session_sem semaphore is held during shutdown so no other HID
device may be added/removed during this time.

This patch makes hidp_output_raw_report and hidp_get_raw_report fail if
session->terminate is true. Also hidp_session will wakeup all current
calls to these functions to cancel the current operations.

We already purge the current I/O queues on hidp_stop(), so this data loss
does not change the behaviour of the HID drivers.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
a5fd6f300433ef7458c6d934f81f47ebd7c7e805 16-Sep-2011 Andrei Emeltchenko <andrei.emeltchenko@intel.com> Bluetooth: EFS: add enable_hs kernel param

Add enable_hs kernel parameter. L2CAP_FEAT_EXT_FLOW depends on it.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
8e00f5fbb4ecbc3431fa686cba60cd76a62604af 30-Sep-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.infradead.org/users/linville/wireless-next into for-davem

Conflicts:
drivers/net/wireless/iwlwifi/iwl-pci.c
drivers/net/wireless/wl12xx/main.c
e95beb414168f8fcae195b5a77be29b3362d6904 27-Sep-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: hci_le_adv_report_evt code refactoring

There is no reason to treat the first advertising entry differently
from the potential other ones. Besides, the current implementation
can easily leads to typos.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
b6f98044a6cbeba8234a3d433d715e9ef36880c4 23-Sep-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Fix possible NULL pointer dereference

Checking conn->pending_sec_level if there is no connection leads to potential
null pointer dereference. Don't process pin_code_request_event at all if no
connection exists.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
67c9e840a098fa62c0b464387160ff8f52a7ef4a 28-Jul-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Mark not declared l2cap_core functions as static

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0e8339151fa85cb9b088abfb13e2dd5214a25429 27-Jul-2011 Anderson Lizardo <anderson.lizardo@openbossa.org> Bluetooth: use recommended LE connection parameters

The new connection parameters now match the recommended values for
Proximity and Health Thermometer profiles. The previous values were
ramdomly chosen, and are either too low or too high for most cases.

New values:

Scan Interval: 60 ms
Scan Window: 30 ms
Minimum Connection Interval: 50 ms
Maximum Connection Interval: 70 ms
Supervision Timeout: 420 ms

See "Table 5.2: Recommended Scan Interval and Scan Window Values" and
"Table 5.3: Recommended Connection Interval Values" for both profiles
for details. Note that the "fast connection" parameters were chosen,
because we do not support yet dynamically changing these parameters from
initiator side.

Additionally, the Proximity profile recommends (section "4.4 Alert on
Link Loss"):

"It is recommended that the Link Supervision Timeout (LSTO) is set to 6x
the connection interval."

Minimum_CE_Length and Maximum_CE_Length were also changed from 0x0001 to
0x0000 because they are informational and optional, and old value was
not reflecting reality.

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
84084a3197a9fdec10fa542c0df11928a784e7fc 22-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Perform L2CAP SDU reassembly without copying data

Use sk_buff fragment capabilities to link together incoming skbs
instead of allocating a new skb for reassembly and copying.

The new reassembly code works equally well for ERTM and streaming
mode, so there is now one reassembly function instead of two.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
5b668eb3270f3f9c13ddf6e4fb57bf20c83dccff 22-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Handle fragmented skbs in bt_sock_stream_recvmsg()

ERTM reassembly will be more efficient when skbs are linked together
rather than copying every incoming data byte. The existing stream recv
function assumes skbs are linear, so it needs to know how to handle
fragments before reassembly is changed.

bt_sock_recvmsg() already handles fragmented skbs.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
449357200c5d73d80a9c42dee5dafed684b3cd17 22-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Linearize skbs for use in BNEP, CMTP, HIDP, and RFCOMM

Fragmented skbs are only encountered when receiving ERTM or streaming
mode L2CAP data. BNEP, CMTP, HIDP, and RFCOMM generally use basic
mode, but they need to handle fragments without crashing.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
mtp/core.c
idp/core.c
fcomm/core.c
8decf868790b48a727d7e7ca164f2bcd3c1389c0 22-Sep-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of github.com:davem330/net

Conflicts:
MAINTAINERS
drivers/net/Kconfig
drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
drivers/net/ethernet/broadcom/tg3.c
drivers/net/wireless/iwlwifi/iwl-pci.c
drivers/net/wireless/iwlwifi/iwl-trans-tx-pcie.c
drivers/net/wireless/rt2x00/rt2800usb.c
drivers/net/wireless/wl12xx/main.c
ab0ff76d1bda3b3b3e65caaa0cc5e4b01a81b2ee 12-Sep-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: mark l2cap_create_iframe_pdu as static

l2cap_create_iframe_pdu is only used in l2cap_core.c

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
f8523598ee608a8c4d1f3bbd3639785be3321111 09-Sep-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check 'dev_class' in mgmt_device_found()

The mgmt_device_found event will be used to report LE devices found
during discovery procedure. Since LE advertising reports events
doesn't have class of device information, we need to check if
'dev_class' is not NULL before copying it.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
a8f13c8cd2c732828e5da735c204447a55cdab03 09-Sep-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Reduce critical region.

This patch reduces the critial region (protected by hdev->lock) in
hci_cc_le_set_scan_enable(). This way, only really required code is
synchronized.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
51beabdf624df14d0805b001d3f939629b70d9db 19-Sep-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Fix wrong memcpy size on LE start encryption

This patch fixes wrong memcpy size when copying rand value to
HCI_OP_LE_START_ENC command.
The compiler pretends that the array parameter was declared as a pointer
and sizeof reports the size of the pointer. [1]

[1] http://www.c-faq.com/aryptr/aryparmsize.html

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ca10b5ee0cb298f094db00dba7e397a8bc4e8398 26-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Remove support for other SMP keys than the LTK

For now, only the LTK is properly supported. We are able to receive
and generate the other types of keys, but we are not able to use
them. So it's better not request them to be distributed.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
feb45eb5961b1c8c4f5e9559f48e513d2714b223 26-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix not setting a pending security level

For slave initiated security, we should set a default security level,
for now BT_SECURITY_MEDIUM.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
a492cd52b530cbcf42eb7349e6b435804a7a9271 26-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Revert "Bluetooth: Add support for communicating keys with userspace"

This reverts commit 5a0a8b49746771fba79866fb9185ffa051a6a183.

If we use separate messages and list for SMP specific keys we can
simplify the code.

Conflicts:

net/bluetooth/mgmt.c

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
988c5997d32052a58bd0127710bc8e2c8c5665b1 26-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Use the LTK after receiving a LE Security Request

When receiving a security request from the remote device we should find
if there is already a LTK associated with the remote device, if found
we should use it to encrypt the link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
0fb4eb6f630a22bf4c2f358ef2db91f28a3d18d4 26-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix sending wrong authentication requirements

Until we support any pairing method (Passkey Entry, OOB) that gives
MITM protection we shouldn't send that we have MITM protection.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
5e762444b0d3e56bbd66f5092434c4a1ba698313 25-Aug-2011 Antti Julku <antti.julku@nokia.com> Bluetooth: Add mgmt events for blacklisting

Add management interface events for blocking/unblocking a device.
Sender of the block device command gets cmd complete and other
mgmt sockets get the event. Event is also sent to mgmt sockets when
blocking is done with ioctl, e.g when blocking a device with
hciconfig. This makes it possible for bluetoothd to track status
of blocked devices when a third party block or unblocks a device.

Event sending is handled in mgmt_device_blocked function which gets
called from hci_blacklist_add in hci_core.c. A pending command is
added in mgmt_block_device, so that it can found when sending the
event - the event is not sent to the socket from which the pending
command came. Locks were moved out from hci_core.c to hci_sock.c
and mgmt.c, because locking is needed also for mgmt_pending_add in
mgmt.c.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_sock.c
gmt.c
c908df362c20be0eeef506fe62e13d835a4633f9 02-Sep-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Use the MEDIUM security level for pairings

This lifts the requirement of 16 digits pin codes when pairing
with devices that do not support SSP when using the mgmt interface.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e9bf2bf03e14627fac8520468231ea11dfa37610 02-Sep-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Require authentication if MITM protection is requested

The HIGH security level requires a 16 digit pin code for non-SSP
bondings. Sometimes this requirement is not acceptable and we still
want protection againts MITM attacks (which is something that the
MEDIUM security level doesn't provide), for that we should allow
another way to request authentication without using the HIGH security
level.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
8aab47574a7f5b46a4cdbc6fd820ab34e6c5dbf9 05-Sep-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Move SMP crypto functions to a workqueue

The function crypto_blkcipher_setkey() called by smp_e()
can sleep, so all the crypto work has to be moved to
hci_dev workqueue.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
mp.c
1c1def09c446aae441410b70e6439ffe44dee866 05-Sep-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Move SMP fields to a separate structure

The objective is to make the core to have as little as possible
information about SMP procedures and logic. Now, all the SMP
specific information is hidden from the core.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
mp.c
142c69c6eaab26587264881bb71546e30aafdcee 26-Aug-2011 David Herrmann <dh.herrmann@googlemail.com> Bluetooth: hidp: Add support for NO_INIT_REPORTS quirk

During setup the host initializes all HID reports. Some devices do not
support this. If this quirk is set, we skip the initialization.
See also usbhid_init_reports() for this quirk.

Signed-off-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
21061df3a2577b8d1feb1ca3cb51445085692e89 24-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Add LE link type for debugfs output

Add LE link type as known connection type for debugfs stringizing
output.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
f6422ec624a19ba144b4b5cdbbc5ee41cc6f6400 22-Jun-2011 Antti Julku <antti.julku@nokia.com> Bluetooth: Add mgmt command for fast connectable mode

Add command to management interface for enabling/disabling the
fast connectable mode.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
cfafccf730d363accacbd165542095ce6f7d2de8 20-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add link_type information to the mgmt Connected event

One piece of information that was lost when using the mgmt interface,
was the type of the connection. Using HCI events we used to know
the type of the connection based on the type of the event, e.g.
HCI_LE_Connection_Complete for LE links.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
160dc6ac1256ed15a507bec9a2ff1f6d24a5a3ff 20-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for running SMP without a socket

When doing the pairing procedure we won't have an associated
socket, but we still have to do the SMP negotiation. This
adds support for encrypting the link and exchanging keys.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
7a512d0172d3f54079efb2983afe04a5e68cfe50 20-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for pairing via mgmt over LE

Using the advertising cache we are able to infer the type
of the remote device, and so trigger pairing over the correct
link type.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
d26a23454813908a1bf0e2fd8c73233b22c6dbd7 20-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add a flag to indicate that SMP is going on

Add HCI_CONN_LE_SMP_PEND flag to indicate that SMP is pending
for that connection. This allows to have information that an SMP
procedure is going on for that connection.

We use the HCI_CONN_ENCRYPT_PEND to indicate that encryption
(HCI_LE_Start_Encryption) is pending for that connection.

While a SMP procedure is going on we hold an reference to the
connection, to avoid disconnections.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
mp.c
e2dcd113d15ef99d23498859e7006955b5367698 20-Aug-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Reset the security timer when a command is queued

Each time a SMP command is enqueued, we reset the SMP timer,
this way we follow exactly what the spec mandates:

"The Security Manager Timer shall be reset when an L2CAP SMP command is
queued for transmission." Vol. 3, Part H, Section 3.4

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
52087a792c1513b85de674a4fc67fb92855474c3 17-Aug-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: make use of connection number to optimize the scheduler

This checks if there is any existing connection according to its type
before start iterating in the list and immediately stop iterating when
reaching the number of connections.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2d20a26a92f72e3bb658fe8ce99c3663756e9e7a 30-Aug-2011 Oliver Neukum <oliver@neukum.org> Bluetooth: Fix timeout on scanning for the second time

The checks for HCI_INQUIRY and HCI_MGMT were in the wrong order,
so that second scans always failed.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
afc4b13df143122f99a0eb10bfefb216c2806de0 16-Aug-2011 Jiri Pirko <jpirko@redhat.com> net: remove use of ndo_set_multicast_list in drivers

replace it by ndo_set_rx_mode

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
687beaa0d1d937c327e2f97b4b4fa6c23ca70624 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: cmtp: Fix session cleanup on failed conn add

Once the session thread is running, cleanup must be handled
by the session thread only.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
ff062ea109217329b88693bc9081da893eb8b71b 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: hidp: Don't release device ref if never held

When an hidp connection is added for a boot protocol input
device, don't release a device reference that was never
acquired. The device reference is acquired when the session
is linked to the session list (which hasn't happened yet when
hidp_setup_input is called).

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
615aedd6e5add8104f031b0d547285652d04d330 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: hidp: Only free input device if failed register

When an hidp connection is added for a boot protocol input
device, only free the allocated device if device registration fails.
Subsequent failures should only unregister the device (the input
device api documents that unregister will also free the allocated
device).

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
1c97e94c0b7c56319754ee6f9ccd2e93fe1ee2b3 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: hidp: Fix memory leak of cached report descriptor

Free the cached HID report descriptor on thread terminate.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
e9d5cb541b22aa651edc29990092ec5f8174cd39 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: hidp: Fix session cleanup on failed conn add

Once the session thread is running, cleanup must be
handled by the session thread only.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
7176522cdca1f0b78a1434b41761f0334511822a 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: cmtp: Fix deadlock in session deletion

Commit fada4ac339 introduced the usage of kthread API.
kthread_stop is a blocking function which returns only when
the thread exits. In this case, the thread can't exit because it's
waiting for the write lock, which is being held by cmtp_del_connection()
which is waiting for the thread to exit -- deadlock.

Revert cmtp_reset_ctr to its original behavior: non-blocking signalling
for the session to terminate.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/capi.c
mtp/cmtp.h
mtp/core.c
751c10a56802513a6b057c8cf1552cecc1c9afde 05-Aug-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: bnep: Fix deadlock in session deletion

Commit f4d7cd4a4c introduced the usage of kthread API.
kthread_stop is a blocking function which returns only when
the thread exits. In this case, the thread can't exit because it's
waiting for the write lock, which is being held by bnep_del_connection()
which is waiting for the thread to exit -- deadlock.

Use atomic_t/wake_up_process instead to signal to the thread to exit.

Signed-off-by: Jaikumar Ganesh <jaikumar@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/bnep.h
nep/core.c
7bdb8a5cf17f66614a9897645efcd4ccc27535ee 26-Jul-2011 Szymon Janc <szymon@janc.net.pl> Bluetooth: Don't use cmd_timer to timeout HCI reset command

No command should be send before Command Complete event for HCI
reset is received. This fix regression introduced by commit
6bd32326cda(Bluetooth: Use proper timer for hci command timout)
for chips whose reset command takes longer to complete (e.g. CSR)
resulting in next command being send before HCI reset completed.

Signed-off-by: Szymon Janc <szymon@janc.net.pl>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
6be6b11f006840ba7d8d4b959b3fa0c522f8468a 28-Jul-2011 Chen Ganir <chen.ganir@ti.com> Bluetooth: Fixed wrong L2CAP Sock timer value

L2CAP connection timeout needs to be assigned as miliseconds
and not as jiffies.

Signed-off-by: Chen Ganir <chen.ganir@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
a71a0cf4e9cdb1c43843977a1efc43f96f6efc21 26-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: l2cap: Fix lost wakeup waiting for ERTM acks

Fix race condition which can result in missing wakeup during
l2cap socket shutdown.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
3a3f5c7df55a1294c9e6e2d0b8cea604b137438f 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: cmtp: Fix lost wakeup of session thread

Fix race condition which can result in missing the wakeup intended
to stop the session thread.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
38d57555616afcdad7381b02b523d494327494cd 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: bnep: Fix lost wakeup of session thread

Fix race condition which can result in missing the wakeup intended
to stop the session thread.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
552b0d3cb9ff648aa503011ef50ca24019cd0f5f 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: sco: Fix lost wakeups waiting to accept socket

Fix race conditions which can cause lost wakeups (or missed signals)
while waiting to accept a sco socket connection.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
f9a3c20aa07462108fc6fd759dea956053f020bb 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: l2cap: Fix lost wakeups waiting to accept socket

Fix race conditions which can cause lost wakeups (or misssed signals)
while waiting to accept an l2cap socket connection.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
9be4e3fbf2d3603e7a7010ede0697166738a788b 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix lost wakeups waiting for sock state change

Fix race conditions which can cause lost wakeups while waiting
for sock state to change.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
950e2d51e866623e4c360280aa63b85ab66d3403 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: rfcomm: Fix lost wakeups waiting to accept socket

Fix race conditions which can cause lost wakeups (or missed
signals) while waiting to accept an rfcomm socket connection.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
e5842cdb0f4f2c68f6acd39e286e5d10d8c073e8 24-Jul-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: rfcomm: Remove unnecessary krfcommd event

Removed superfluous event handling which was used to signal
that the rfcomm kthread had been woken. This appears to have been
used to prevent lost wakeups. Correctly ordering when the task
state is set to TASK_INTERRUPTIBLE is sufficient to prevent lost wakeups.

To prevent wakeups which occurred prior to initially setting
TASK_INTERRUPTIBLE from being lost, the main work of the thread loop -
rfcomm_process_sessions() - is performed prior to sleeping.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
8475e2336cf80ba6e7b27715b4b3214d73c211ab 03-Aug-2011 Dan Carpenter <error27@gmail.com> Bluetooth: unlock if allocation fails in hci_blacklist_add()

There was a small typo here so we never actually hit the goto which
would call hci_dev_unlock_bh().

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
550fd08c2cebad61c548def135f67aba284c6162 26-Jul-2011 Neil Horman <nhorman@tuxdriver.com> net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared

After the last patch, We are left in a state in which only drivers calling
ether_setup have IFF_TX_SKB_SHARING set (we assume that drivers touching real
hardware call ether_setup for their net_devices and don't hold any state in
their skbs. There are a handful of drivers that violate this assumption of
course, and need to be fixed up. This patch identifies those drivers, and marks
them as not being able to support the safe transmission of skbs by clearning the
IFF_TX_SKB_SHARING flag in priv_flags

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Karsten Keil <isdn@linux-pingi.de>
CC: "David S. Miller" <davem@davemloft.net>
CC: Jay Vosburgh <fubar@us.ibm.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: Patrick McHardy <kaber@trash.net>
CC: Krzysztof Halasa <khc@pm.waw.pl>
CC: "John W. Linville" <linville@tuxdriver.com>
CC: Greg Kroah-Hartman <gregkh@suse.de>
CC: Marcel Holtmann <marcel@holtmann.org>
CC: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
033b1142f4bd44a116d1356fe4a0510437ceddf9 21-Jul-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
net/bluetooth/l2cap_core.c
05e9a2f67849e427f8900bad0a3f2a939e8dd3d6 15-Jul-2011 Ilia Kolomisnky <iliak@ti.com> Bluetooth: Fix crash with incoming L2CAP connections

Another regression fix considering incomming l2cap connections with
defer_setup enabled. In situations when incomming connection is
extracted with l2cap_sock_accept, it's bt_sock info will have
'parent' member zerroed, but 'parent' may be used unconditionally
in l2cap_conn_start() and l2cap_security_cfm() when defer_setup
is enabled.

Backtrace:
[<bf02d5ac>] (l2cap_security_cfm+0x0/0x2ac [bluetooth]) from [<bf01f01c>] (hci_event_pac
ket+0xc2c/0x4aa4 [bluetooth])
[<bf01e3f0>] (hci_event_packet+0x0/0x4aa4 [bluetooth]) from [<bf01a844>] (hci_rx_task+0x
cc/0x27c [bluetooth])
[<bf01a778>] (hci_rx_task+0x0/0x27c [bluetooth]) from [<c008eee4>] (tasklet_action+0xa0/
0x15c)
[<c008ee44>] (tasklet_action+0x0/0x15c) from [<c008f38c>] (__do_softirq+0x98/0x130)
r7:00000101 r6:00000018 r5:00000001 r4:efc46000
[<c008f2f4>] (__do_softirq+0x0/0x130) from [<c008f524>] (do_softirq+0x4c/0x58)
[<c008f4d8>] (do_softirq+0x0/0x58) from [<c008f5e0>] (run_ksoftirqd+0xb0/0x1b4)
r4:efc46000 r3:00000001
[<c008f530>] (run_ksoftirqd+0x0/0x1b4) from [<c009f2a8>] (kthread+0x84/0x8c)
r7:00000000 r6:c008f530 r5:efc47fc4 r4:efc41f08
[<c009f224>] (kthread+0x0/0x8c) from [<c008cc84>] (do_exit+0x0/0x5f0)

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_core.c
9191e6ad897a8b4f0b89aea7c2d3c843f29a8630 15-Jul-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix regression in L2CAP connection procedure

Caused by the following commit, partially revert it.

commit 9fa7e4f76f3658ba1f44fbdb95c77e7df3f53f95
Author: Gustavo F. Padovan <padovan@profusion.mobi>
Date: Thu Jun 30 16:11:30 2011 -0300

Bluetooth: Fix regression with incoming L2CAP connections

PTS test A2DP/SRC/SRC_SET/TC_SRC_SET_BV_02_I revealed that
( probably after the df3c3931e commit ) the l2cap connection
could not be established in case when the "Auth Complete" HCI
event does not arive before the initiator send "Configuration
request", in which case l2cap replies with "Command rejected"
since the channel is still in BT_CONNECT2 state.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_core.c
95a943c162d74b20d869917bdf5df11293c35b63 15-Jul-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
net/bluetooth/l2cap_core.c
6a7ebdf2fd15417e87b4fd02ff411aeaca34da5f 14-Jul-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
net/bluetooth/l2cap_core.c
4b42c542afbc119c4012324ea80e0c5a89afea4f 11-Jul-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-next-2.6

Conflicts:
net/bluetooth/l2cap_core.c
d8598981146241064993e371cea8333f59553cb6 11-Jul-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Conflicts:
drivers/net/wireless/ath/ath5k/sysfs.c
net/bluetooth/l2cap_core.c
net/mac80211/wpa.c
e2fd318e3a9208245ee1041f6d413c8593fba29d 10-Jul-2011 Ilia Kolomisnky <iliak@ti.com> Bluetooth: Fixes l2cap "command reject" reply according to spec

There can 3 reasons for the "command reject" reply produced
by the stack. Each such reply should be accompanied by the
relevand data ( as defined in spec. ). Currently there is one
instance of "command reject" reply with reason "invalid cid"
wich is fixed. Also, added clean-up definitions related to the
"command reject" replies.

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
8f360119243c214eb5c5549c61981d51a276154a 08-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for returning the encryption key size

This will be useful when userspace wants to restrict some kinds of
operations based on the length of the key size used to encrypt the
link.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
726b4ffcaa450d9593b9b6ac8605967ce9f3e506 08-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for storing the key size

In some cases it will be useful having the key size used for
encrypting the link. For example, some profiles may restrict
some operations depending on the key length.

The key size is stored in the key that is passed to userspace
using the pin_length field in the key structure.

For now this field is only valid for LE controllers. 3.0+HS
controllers define the Read Encryption Key Size command, this
field is intended for storing the value returned by that
command.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
mp.c
5a0a8b49746771fba79866fb9185ffa051a6a183 08-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for communicating keys with userspace

As the key format has changed to something that has a dynamic size,
the way that keys are received and sent must be changed.

The structure fields order is changed to make the parsing of the
information received from the Management Interface easier.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
0eb08e339836989557ea3aa4c427377bd32ce19c 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Remove unused field in hci_conn

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
02bc74556a3f1b26adf3feb372376c56ba990564 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Use the stored LTK for restabilishing security

Now that it's possible that the exchanged key is present in
the link key list, we may be able to estabilish security with
an already existing key, without need to perform any SMP
procedure.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
e7e62c8592484f79469312fc694d2995918aa152 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Use the link key list to temporarily store the STK

With this we can use only one place to store all keys, without
need to use a field in the connection structure for this
purpose.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
16b908396fbf1be49d417ffdb4a8b41c8c8cb670 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for storing the LTK

Now when the LTK is received from the remote or generated it is stored,
so it can later be used.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
54790f73a3ec87c181e4d6e5eb6963de3d50ebd7 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix SM pairing parameters negotiation

Before implementing SM key distribution, the pairing features
exchange must be better negotiated, taking into account some
features of the host and connection requirements.

If we are in the "not pairable" state, it makes no sense to
exchange any key. This allows for simplification of the key
negociation method.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
bea710feff617e3469789dd8f930b284c83a87f5 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Reject an encryption request when the key isn't found

Now that we have methods to finding keys by its parameters we can
reject an encryption request if the key isn't found.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
75d262c2ad927751bb5f096f3a6a37d81e7784f2 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add functions to manipulate the link key list for SMP

As the LTK (the new type of key being handled now) has more data
associated with it, we need to store this extra data and retrieve
the keys based on that data.

Methods for searching for a key and for adding a new LTK are
introduced here.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
7034b911af1aa571995b56db3ed71a25daf00373 07-Jul-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for SMP phase 3 (key distribution)

This adds support for generating and distributing all the keys
specified in the third phase of SMP.

This will make possible to re-establish secure connections, resolve
private addresses and sign commands.

For now, the values generated are random.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
mp.c
fadd192e81b0a8d8086531b8c11bd88b311b68c2 07-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Remove L2CAP busy queue

The ERTM receive buffer is now handled in a way that does not require
the busy queue and the associated polling code.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e328140fdacbba43292a59a22fb55d9185288318 07-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use event-driven approach for handling ERTM receive buffer

This change moves most L2CAP ERTM receive buffer handling out of the
L2CAP core and in to the socket code. It's up to the higher layer
(the socket code, in this case) to tell the core when its buffer is
full or has space available. The recv op should always accept
incoming ERTM data or else the connection will go down.

Within the socket layer, an skb that does not fit in the socket
receive buffer will be temporarily stored. When the socket is read
from, that skb will be placed in the receive buffer if possible. Once
adequate buffer space becomes available, the L2CAP core is informed
and the ERTM local busy state is cleared.

Receive buffer management for non-ERTM modes is unchanged.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
26f880d221302b5d061185d8a6795bb532693bf3 07-Jul-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Move code for ERTM local busy state to separate functions

The local busy state is entered and exited based on buffer status in
the socket layer (or other upper layer). This change is in
preparation for general buffer status reports from the socket layer,
which will then be used to change the local busy status.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
8c156c322f8a300afe59259bd554db166cf88203 07-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix potential deadlock in mgmt

All threads running in process context should disable local bottom
halve before locking hdev->lock.

This patch fix the following message generated when Bluetooh module
is loaded with enable_mgmt=y (CONFIG_PROVE_LOCKING enabled).

[ 107.880781] =================================
[ 107.881631] [ INFO: inconsistent lock state ]
[ 107.881631] 2.6.39+ #1
[ 107.881631] ---------------------------------
[ 107.881631] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 107.881631] rcuc0/7 [HC0[0]:SC1[3]:HE1:SE0] takes:
[ 107.881631] (&(&hdev->lock)->rlock){+.?...}, at: [<ffffffffa0012c8d>] mgmt_set_local_name_complete+0x84/0x10b [bluetooth]
[ 107.881631] {SOFTIRQ-ON-W} state was registered at:
[ 107.881631] [<ffffffff8105188b>] __lock_acquire+0x347/0xd52
[ 107.881631] [<ffffffff810526ac>] lock_acquire+0x8a/0xa7
[ 107.881631] [<ffffffff812b3758>] _raw_spin_lock+0x2c/0x3b
[ 107.881631] [<ffffffffa0011cc2>] mgmt_control+0xd4d/0x175b [bluetooth]
[ 107.881631] [<ffffffffa0013275>] hci_sock_sendmsg+0x97/0x293 [bluetooth]
[ 107.881631] [<ffffffff8121940c>] sock_aio_write+0x126/0x13a
[ 107.881631] [<ffffffff810a35fa>] do_sync_write+0xba/0xfa
[ 107.881631] [<ffffffff810a3beb>] vfs_write+0xaa/0xca
[ 107.881631] [<ffffffff810a3d80>] sys_write+0x45/0x69
[ 107.881631] [<ffffffff812b4892>] system_call_fastpath+0x16/0x1b
[ 107.881631] irq event stamp: 2100876
[ 107.881631] hardirqs last enabled at (2100876): [<ffffffff812b40d4>] restore_args+0x0/0x30
[ 107.881631] hardirqs last disabled at (2100875): [<ffffffff812b3f6a>] save_args+0x6a/0x70
[ 107.881631] softirqs last enabled at (2100862): [<ffffffff8106a805>] rcu_cpu_kthread+0x2b5/0x2e2
[ 107.881631] softirqs last disabled at (2100863): [<ffffffff812b56bc>] call_softirq+0x1c/0x26
[ 107.881631]
[ 107.881631] other info that might help us debug this:
[ 107.881631] Possible unsafe locking scenario:
[ 107.881631]
[ 107.881631] CPU0
[ 107.881631] ----
[ 107.881631] lock(&(&hdev->lock)->rlock);
[ 107.881631] <Interrupt>
[ 107.881631] lock(&(&hdev->lock)->rlock);
[ 107.881631]
[ 107.881631] *** DEADLOCK ***
[ 107.881631]
[ 107.881631] 1 lock held by rcuc0/7:
[ 107.881631] #0: (hci_task_lock){++.-..}, at: [<ffffffffa0008353>] hci_rx_task+0x49/0x2f3 [bluetooth]
[ 107.881631]
[ 107.881631] stack backtrace:
[ 107.881631] Pid: 7, comm: rcuc0 Not tainted 2.6.39+ #1
[ 107.881631] Call Trace:
[ 107.881631] <IRQ> [<ffffffff812ae901>] print_usage_bug+0x1e7/0x1f8
[ 107.881631] [<ffffffff8100a796>] ? save_stack_trace+0x27/0x44
[ 107.881631] [<ffffffff8104fc3f>] ? print_irq_inversion_bug.part.26+0x19a/0x19a
[ 107.881631] [<ffffffff810504bb>] mark_lock+0x106/0x258
[ 107.881631] [<ffffffff81051817>] __lock_acquire+0x2d3/0xd52
[ 107.881631] [<ffffffff8102be73>] ? vprintk+0x3ab/0x3d7
[ 107.881631] [<ffffffff810526ac>] lock_acquire+0x8a/0xa7
[ 107.881631] [<ffffffffa0012c8d>] ? mgmt_set_local_name_complete+0x84/0x10b [bluetooth]
[ 107.881631] [<ffffffff81052615>] ? lock_release+0x16c/0x179
[ 107.881631] [<ffffffff812b3952>] _raw_spin_lock_bh+0x31/0x40
[ 107.881631] [<ffffffffa0012c8d>] ? mgmt_set_local_name_complete+0x84/0x10b [bluetooth]
[ 107.881631] [<ffffffffa0012c8d>] mgmt_set_local_name_complete+0x84/0x10b [bluetooth]
[ 107.881631] [<ffffffffa000d3fe>] hci_event_packet+0x122b/0x3e12 [bluetooth]
[ 107.881631] [<ffffffff81050658>] ? mark_held_locks+0x4b/0x6d
[ 107.881631] [<ffffffff812b3cff>] ? _raw_spin_unlock_irqrestore+0x40/0x4d
[ 107.881631] [<ffffffff810507b9>] ? trace_hardirqs_on_caller+0x13f/0x172
[ 107.881631] [<ffffffff812b3d07>] ? _raw_spin_unlock_irqrestore+0x48/0x4d
[ 107.881631] [<ffffffffa00083d2>] hci_rx_task+0xc8/0x2f3 [bluetooth]
[ 107.881631] [<ffffffff8102f836>] ? __local_bh_enable+0x90/0xa4
[ 107.881631] [<ffffffff8102f5a9>] tasklet_action+0x87/0xe6
[ 107.881631] [<ffffffff8102fa11>] __do_softirq+0x9f/0x13f
[ 107.881631] [<ffffffff812b56bc>] call_softirq+0x1c/0x26
[ 107.881631] <EOI> [<ffffffff810033b8>] ? do_softirq+0x46/0x9a
[ 107.881631] [<ffffffff8106a805>] ? rcu_cpu_kthread+0x2b5/0x2e2
[ 107.881631] [<ffffffff8102f906>] _local_bh_enable_ip+0xac/0xc9
[ 107.881631] [<ffffffff8102f93b>] local_bh_enable+0xd/0xf
[ 107.881631] [<ffffffff8106a805>] rcu_cpu_kthread+0x2b5/0x2e2
[ 107.881631] [<ffffffff81041586>] ? __init_waitqueue_head+0x46/0x46
[ 107.881631] [<ffffffff8106a550>] ? rcu_yield.constprop.42+0x98/0x98
[ 107.881631] [<ffffffff81040f0a>] kthread+0x7f/0x87
[ 107.881631] [<ffffffff812b55c4>] kernel_thread_helper+0x4/0x10
[ 107.881631] [<ffffffff812b40d4>] ? retint_restore_args+0x13/0x13
[ 107.881631] [<ffffffff81040e8b>] ? __init_kthread_worker+0x53/0x53
[ 107.881631] [<ffffffff812b55c0>] ? gs_change+0x13/0x13

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
8aded7110a5625bc00aef05e94dd4b1a9cf3605f 07-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Fix potential deadlock in hci_core

Since hdev->lock may be acquired by threads runnning in interrupt
context, all threads running in process context should disable
local bottom halve before locking hdev->lock. This can be done by
using hci_dev_lock_bh macro.

This way, we avoid potencial deadlocks like this one reported by
CONFIG_PROVE_LOCKING=y.

[ 304.788780] =================================
[ 304.789686] [ INFO: inconsistent lock state ]
[ 304.789686] 2.6.39+ #1
[ 304.789686] ---------------------------------
[ 304.789686] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[ 304.789686] ksoftirqd/0/3 [HC0[0]:SC1[1]:HE1:SE0] takes:
[ 304.789686] (&(&hdev->lock)->rlock){+.?...}, at: [<ffffffffa000bbfe>] hci_conn_check_pending+0x38/0x76 [bluetooth]
[ 304.789686] {SOFTIRQ-ON-W} state was registered at:
[ 304.789686] [<ffffffff8105188b>] __lock_acquire+0x347/0xd52
[ 304.789686] [<ffffffff810526ac>] lock_acquire+0x8a/0xa7
[ 304.789686] [<ffffffff812b3758>] _raw_spin_lock+0x2c/0x3b
[ 304.789686] [<ffffffffa0009cf0>] hci_blacklist_del+0x1f/0x8a [bluetooth]
[ 304.789686] [<ffffffffa00139fd>] hci_sock_ioctl+0x2d9/0x314 [bluetooth]
[ 304.789686] [<ffffffff812197d8>] sock_ioctl+0x1f2/0x214
[ 304.789686] [<ffffffff810b0fd6>] do_vfs_ioctl+0x46c/0x4ad
[ 304.789686] [<ffffffff810b1059>] sys_ioctl+0x42/0x65
[ 304.789686] [<ffffffff812b4892>] system_call_fastpath+0x16/0x1b
[ 304.789686] irq event stamp: 9768
[ 304.789686] hardirqs last enabled at (9768): [<ffffffff812b40d4>] restore_args+0x0/0x30
[ 304.789686] hardirqs last disabled at (9767): [<ffffffff812b3f6a>] save_args+0x6a/0x70
[ 304.789686] softirqs last enabled at (9726): [<ffffffff8102fa9b>] __do_softirq+0x129/0x13f
[ 304.789686] softirqs last disabled at (9739): [<ffffffff8102fb33>] run_ksoftirqd+0x82/0x133
[ 304.789686]
[ 304.789686] other info that might help us debug this:
[ 304.789686] Possible unsafe locking scenario:
[ 304.789686]
[ 304.789686] CPU0
[ 304.789686] ----
[ 304.789686] lock(&(&hdev->lock)->rlock);
[ 304.789686] <Interrupt>
[ 304.789686] lock(&(&hdev->lock)->rlock);
[ 304.789686]
[ 304.789686] *** DEADLOCK ***
[ 304.789686]
[ 304.789686] 1 lock held by ksoftirqd/0/3:
[ 304.789686] #0: (hci_task_lock){++.-..}, at: [<ffffffffa0008353>] hci_rx_task+0x49/0x2f3 [bluetooth]
[ 304.789686]
[ 304.789686] stack backtrace:
[ 304.789686] Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.39+ #1
[ 304.789686] Call Trace:
[ 304.789686] [<ffffffff812ae901>] print_usage_bug+0x1e7/0x1f8
[ 304.789686] [<ffffffff8100a796>] ? save_stack_trace+0x27/0x44
[ 304.789686] [<ffffffff8104fc3f>] ? print_irq_inversion_bug.part.26+0x19a/0x19a
[ 304.789686] [<ffffffff810504bb>] mark_lock+0x106/0x258
[ 304.789686] [<ffffffff812b40d4>] ? retint_restore_args+0x13/0x13
[ 304.789686] [<ffffffff81051817>] __lock_acquire+0x2d3/0xd52
[ 304.789686] [<ffffffff8102be73>] ? vprintk+0x3ab/0x3d7
[ 304.789686] [<ffffffff812ae126>] ? printk+0x3c/0x3e
[ 304.789686] [<ffffffff810526ac>] lock_acquire+0x8a/0xa7
[ 304.789686] [<ffffffffa000bbfe>] ? hci_conn_check_pending+0x38/0x76 [bluetooth]
[ 304.789686] [<ffffffff811601c6>] ? __dynamic_pr_debug+0x10c/0x11a
[ 304.789686] [<ffffffff812b3758>] _raw_spin_lock+0x2c/0x3b
[ 304.789686] [<ffffffffa000bbfe>] ? hci_conn_check_pending+0x38/0x76 [bluetooth]
[ 304.789686] [<ffffffffa000bbfe>] hci_conn_check_pending+0x38/0x76 [bluetooth]
[ 304.789686] [<ffffffffa000c561>] hci_event_packet+0x38e/0x3e12 [bluetooth]
[ 304.789686] [<ffffffff81052615>] ? lock_release+0x16c/0x179
[ 304.789686] [<ffffffff812b3b41>] ? _raw_read_unlock+0x23/0x27
[ 304.789686] [<ffffffffa0013e7f>] ? hci_send_to_sock+0x179/0x188 [bluetooth]
[ 304.789686] [<ffffffffa00083d2>] hci_rx_task+0xc8/0x2f3 [bluetooth]
[ 304.789686] [<ffffffff8102f5a9>] tasklet_action+0x87/0xe6
[ 304.789686] [<ffffffff8102fa11>] __do_softirq+0x9f/0x13f
[ 304.789686] [<ffffffff8102fb33>] run_ksoftirqd+0x82/0x133
[ 304.789686] [<ffffffff8102fab1>] ? __do_softirq+0x13f/0x13f
[ 304.789686] [<ffffffff81040f0a>] kthread+0x7f/0x87
[ 304.789686] [<ffffffff812b55c4>] kernel_thread_helper+0x4/0x10
[ 304.789686] [<ffffffff812b40d4>] ? retint_restore_args+0x13/0x13
[ 304.789686] [<ffffffff81040e8b>] ? __init_kthread_worker+0x53/0x53
[ 304.789686] [<ffffffff812b55c0>] ? gs_change+0x13/0x13

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2e65c9d2c5206eb24439f2dd2daa2f6702df358e 01-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove enable_smp parameter

The enable_smp parameter is no longer needed. It can be replaced by
checking lmp_host_le_capable.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
mp.c
eead27da60df80a112d1ac3ea482226e9794c26b 01-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add lmp_host_le_capable() macro

Since we have the extended LMP features properly implemented, we
should check the LMP_HOST_LE bit to know if the host supports LE.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
e6100a2541987b84af37e4c4247d989644a3aa69 01-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add enable_le module parameter

This patch adds a new module parameter to enable/disable host LE
support. By default host LE support is disabled.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
f9b49306dc0b9f514ffb275ae853c50d7ccd6856 01-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Write LE Host Supported command

This patch adds a handler to Write LE Host Supported command complete
events. Once this commands has completed successfully, we should
read the extended LMP features and update the extfeatures field in
hci_dev.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
971e3a4bbcbf7378315b85150853d86be59cffe0 01-Jul-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add extfeatures to struct hci_dev

This new field holds the extended LMP features value. Some LE
mechanism such as discovery procedure needs to read the extended
LMP features to work properly.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
02f1b641060486df8eecd66b060ae6551f398593 29-Jun-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Check earlier for L2CAP ERTM frames to drop

Even when the received tx_seq is expected, the frame still needs to be
dropped if the TX window is exceeded or the receiver is in the local
busy state.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2461daacb3e2ecca5edea2fa637a1b0922e86515 17-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bad locking balance

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e1447d8d8da5ceea60dca027e78274e6ea9b660e 01-Jul-2011 Joe Perches <joe@perches.com> Bluetooth: Add bt_printk

Add a local logging function to emit bluetooth specific
messages. Using vsprintf extension %pV saves code/text
space.

Convert the current BT_INFO and BT_ERR macros to use bt_printk.
Remove __func__ from BT_ERR macro (and the uses).
Prefix "Bluetooth: " to BT_ERR
Remove __func__ from BT_DBG as function can be prefixed when
using dynamic_debug.

With allyesconfig:

text data bss dec hex filename
129956 8632 36096 174684 2aa5c drivers/bluetooth/built-in.o.new2
134402 8632 36064 179098 2bb9a drivers/bluetooth/built-in.o.old
14778 1012 3408 19198 4afe net/bluetooth/bnep/built-in.o.new2
15067 1012 3408 19487 4c1f net/bluetooth/bnep/built-in.o.old
346595 19163 86080 451838 6e4fe net/bluetooth/built-in.o.new2
353751 19163 86064 458978 700e2 net/bluetooth/built-in.o.old
18483 1172 4264 23919 5d6f net/bluetooth/cmtp/built-in.o.new2
18927 1172 4264 24363 5f2b net/bluetooth/cmtp/built-in.o.old
19237 1172 5152 25561 63d9 net/bluetooth/hidp/built-in.o.new2
19581 1172 5152 25905 6531 net/bluetooth/hidp/built-in.o.old
59461 3884 14464 77809 12ff1 net/bluetooth/rfcomm/built-in.o.new2
61206 3884 14464 79554 136c2 net/bluetooth/rfcomm/built-in.o.old

with x86 defconfig (and just bluetooth):

$ size net/bluetooth/built-in.o.defconfig.*
text data bss dec hex filename
66358 933 100 67391 1073f net/bluetooth/built-in.o.defconfig.new
66643 933 100 67676 1085c net/bluetooth/built-in.o.defconfig.old

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ib.c
e175072f377047e28e399c5c661e39e69722f35b 30-Jun-2011 Joe Perches <joe@perches.com> Bluetooth: Rename function bt_err to bt_to_errno

Make it easier to use more normal logging styles later.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap_core.c
ib.c
co.c
942ecc9c4643db5ce071562e0a23f99464d6b461 29-Jun-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: ERTM timeouts need to be converted to jiffies

ERTM timeouts are defined in milliseconds, but need to be converted
to jiffies when passed to mod_timer().

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
774e5651460ee7c688914fd76b6caa1675de355c 29-Jun-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix indentation whitespace

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
163f4dabea4e3be485c17e8f08e3a6468ad31cbf 30-Jun-2011 Tomas Targownik <ttargownik@geicp.com> Bluetooth: Fix memory leak under page timeouts

If the remote device is not present, the connections attemp fails and
the struct hci_conn was not freed

Signed-off-by: Tomas Targownik <ttargownik@geicp.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
9fa7e4f76f3658ba1f44fbdb95c77e7df3f53f95 30-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix regression with incoming L2CAP connections

PTS test A2DP/SRC/SRC_SET/TC_SRC_SET_BV_02_I revealed that
( probably after the df3c3931e commit ) the l2cap connection
could not be established in case when the "Auth Complete" HCI
event does not arive before the initiator send "Configuration
request", in which case l2cap replies with "Command rejected"
since the channel is still in BT_CONNECT2 state.

Based on patch from: Ilia Kolomisnky <iliak@ti.com>

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
7bb59df83b190817f56c4e2fec3078d99d906ad4 30-Jun-2011 Peter Hurley <peter@hurleysoftware.com> Bluetooth: Fix hidp disconnect deadlocks and lost wakeup

Partial revert of commit aabf6f89. When the hidp session thread
was converted from kernel_thread to kthread, the atomic/wakeups
were replaced with kthread_stop. kthread_stop has blocking semantics
which are inappropriate for the hidp session kthread. In addition,
the kthread signals itself to terminate in hidp_process_hid_control()
- it cannot do this with kthread_stop().

Lastly, a wakeup can be lost if the wakeup happens between checking
for the loop exit condition and setting the current state to
TASK_INTERRUPTIBLE. (Without appropriate synchronization mechanisms,
the task state should not be changed between the condition test and
the yield - via schedule() - as this creates a race between the
wakeup and resetting the state back to interruptible.)

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
idp/hidp.h
df2cbe40753dc36af294c30209ed909869aca6cf 30-Jun-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
7ac28817536797fd40e9646452183606f9e17f71 24-Jun-2011 Dan Rosenberg <drosenberg@vsecurity.com> Bluetooth: Prevent buffer overflow in l2cap config request

A remote user can provide a small value for the command size field in
the command header of an l2cap configuration request, resulting in an
integer underflow when subtracting the size of the configuration request
header. This results in copying a very large amount of data via
memcpy() and destroying the kernel heap. Check for underflow.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
daf4ce85cd5221a3609e68419d01730170975e94 22-Jun-2011 Randy Dunlap <randy.dunlap@oracle.com> bluetooth: uses crypto interfaces, select CRYPTO

Recent changes to hci_core.c use crypto interfaces, so select CRYPTO
to make sure that those interfaces are present.

Fixes these build errors when CRYPTO is not enabled:

net/built-in.o: In function `hci_register_dev':
(.text+0x4cf86): undefined reference to `crypto_alloc_base'
net/built-in.o: In function `hci_unregister_dev':
(.text+0x4f912): undefined reference to `crypto_destroy_tfm'

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
config
9a7b1501182477299e678b787e32fca5844c7ea1 22-Jun-2011 Randy Dunlap <randy.dunlap@oracle.com> Bluetooth: uses crypto interfaces, select CRYPTO

Recent changes to hci_core.c use crypto interfaces, so select CRYPTO
to make sure that those interfaces are present.

Fixes these build errors when CRYPTO is not enabled:

net/built-in.o: In function `hci_register_dev':
(.text+0x4cf86): undefined reference to `crypto_alloc_base'
net/built-in.o: In function `hci_unregister_dev':
(.text+0x4f912): undefined reference to `crypto_destroy_tfm'

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
config
36099365c7cc64e5184b66b6eb094950a13f540c 24-Jun-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
drivers/net/wireless/rtlwifi/pci.c
include/linux/netlink.h
f70490e6078abe1182437e629f67a7f0b6f08cd4 22-Jun-2011 Stephen Rothwell <sfr@canb.auug.org.au> Bluetooth: include scatterlist.h where needed

net/bluetooth/smp.c: In function 'smp_e':
net/bluetooth/smp.c:49:21: error: storage size of 'sg' isn't known
net/bluetooth/smp.c:67:2: error: implicit declaration of function 'sg_init_one'
net/bluetooth/smp.c:49:21: warning: unused variable 'sg'

Caused by commit d22ef0bc83c5 ("Bluetooth: Add LE SMP Cryptoolbox
functions"). Missing include file, presumably. This batch has been in
the bluetooth tree since June 14, so it may have been exposed by the
removal of linux/mm.h from netdevice.h ...

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
mp.c
43f3dc41571c47a1fbded9aca1cf0a737967b005 20-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix not setting the chan state

When the connection is ready we should set the connection
to CONNECTED so userspace can use it.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0555891184a5c18df0e2349872e7ecf9701fc5b5 21-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6

Conflicts:
net/bluetooth/l2cap_core.c
9f6ec8d697c08963d83880ccd35c13c5ace716ea 21-Jun-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
drivers/net/wireless/rtlwifi/pci.c
net/netfilter/ipvs/ip_vs_core.c
e13e21dc5d06bd9ed4a88daf057b8dbe80c220de 18-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Remove useless access to the socket

We already have access to the chan, we don't have to access the
socket to get its imtu.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
6312845169e8719f6f0726efc62bc6a8dedea9d3 18-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix crash when setting a LE socket to ready

We should not try to do any other type of configuration for
LE links when they become ready.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
a7925bd27d6ef020b8f3a3a64bde61d0add07220 17-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix locking in blacklist code

There was no unlock call on the errors path

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
e2ab43536c53ba112a0adfb4c0dba286544c41f6 11-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use bit operations on conn_state

Instead of setting bits manually we use set_bit, test_bit, etc.
Also remove L2CAP_ prefix from macros.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
c1360a1cf35117d6f3898cb5183ce4349d06714c 10-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: use bit operation on conf_state

Instead of making the bit operations manually, we now use set_bit,
test_bit, etc.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
7fbec224cfb44074ab88720c878aa3bdb3158377 14-Jun-2011 Antti Julku <antti.julku@nokia.com> Bluetooth: Add blacklisting support for mgmt interface

Management interface commands for blocking and unblocking devices.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
b2a66aad8620337e38d6692f03d94a03d5129840 14-Jun-2011 Antti Julku <antti.julku@nokia.com> Bluetooth: Move blacklisting functions to hci_core

Move blacklisting functions to hci_core.c, so that they can
be used by both management interface and hci socket interface.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_sock.c
330605423ca6eafafb8dcc27502bce1c585d1b06 15-Jun-2011 Ilia Kolomisnky <ilia.kolominsky@gmail.com> Bluetooth: Fix L2CAP connection establishment

In hci_conn_security ( which is used during L2CAP connection
establishment ) test for HCI_CONN_ENCRYPT_PEND state also
sets this state, which is bogus and leads to connection time-out
on L2CAP sockets in certain situations (especially when
using non-ssp devices )

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
3158c50c33c1acddcfa3c57fab812435aa459750 14-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add key size checks for SMP

This patch implements a check in smp cmd pairing request and pairing
response to verify if encryption key maximum size is compatible in both
slave and master when SMP Pairing is requested. Keys are also masked to
the correct negotiated size.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
5d3de7df18077a0f508ae2c3e3f1866da65fdffd 14-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for SMP timeout

This patch adds support for disconnecting the link when SMP procedure
takes more than 30 seconds.

SMP begins when either the Pairing Request command is sent or the
Pairing Response is received, and it ends when the link is encrypted
(or terminated). Vol 3, Part H Section 3.4.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
mp.c
df3c3931ec58cca3409c71b18ad6da0cd71fe163 13-Jun-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Fix accepting connect requests for defer_setup

When authentication completes we shouldn't blindly accept any pending
L2CAP connect requests. If the socket has the defer_setup feature
enabled it should still wait for user space acceptance of the connect
request. The issue only happens for non-SSP connections since with SSP
the L2CAP Connect request may not be sent for non-SDP PSMs before
authentication has completed successfully.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
94ac02726cb87dd569bac4536f33e4b696b692eb 13-Jun-2011 Anderson Lizardo <anderson.lizardo@openbossa.org> Bluetooth: fix missing parameter for HCI_OP_DISCONNECT

The "dc" variable is initialized but not passed to hci_send_cmd().

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Bruna Moreira <bruna.moreira@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
da85e5e5afeb72bb6e6b5192a2d252861fafc3e7 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for Pairing features exchange

This patch implements a simple version of the SMP Pairing Features
exchange procedure (Vol. 3 Part H, Section 2.3.5.1).

For now, everything that would cause a Pairing Method different of
Just Works to be chosen is rejected.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
mp.c
b8e66eacab21870d4f800822111c494f9ef291e3 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for building pairing commands

Before we are able to do a proper exchange of pairing parameters,
we need a unified way of building pairing requests and responses.

For IO Capability we use the value that was set by userspace,
using the management interface.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
7b5c0d5242295a3b52e7161bf129e2f0e8c624cb 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix initial security level of LE links

As the default security level (BT_SECURITY_SDP) doesn't make sense for
LE links, initialize LE links with something that makes sense.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
f1cb9af557dd8fb5d98fbcc4b5d3eb9d6d235af7 27-Jan-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for resuming socket when SMP is finished

This adds support for resuming the user space traffic when SMP
negotiation is complete.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
mp.c
9b3d67405b17d61ba8be9d824222fb410f487b8a 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Remove debug statements

Now that these commands are sent to the controller we can use hcidump
to verify that the correct values are produced.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
a7a595f675f1b33dc73167147321dba5c4395acc 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for LE Start Encryption

This adds support for starting SMP Phase 2 Encryption, when the initial
SMP negotiation is successful. This adds the LE Start Encryption and LE
Long Term Key Request commands and related events.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
mp.c
7d24ddcc1140d2f796436e476c8d69469610588b 09-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Add SMP confirmation checks methods

This patch includes support for generating and sending the random value
used to produce the confirmation value.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
f01ead315785768cdb6e928646f90a47640bcdd9 09-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Add SMP confirmation structs

This patch adds initial support for verifying the confirmation value
that the remote side has sent.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
d22ef0bc83c5a4e7ca9f2791e658dc8949d31ff4 09-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Add LE SMP Cryptoolbox functions

This patch implements SMP crypto functions called ah, c1, s1 and e.
It also implements auxiliary functions. All These functions are needed
for SMP keys generation.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Bruna Moreira <bruna.moreira@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
3a0259bb80cec7595a2d085a150412d23ba28c81 09-Jun-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for using the crypto subsystem

This will allow using the crypto subsystem for encrypting data. As SMP
(Security Manager Protocol) is implemented almost entirely on the host
side and the crypto module already implements the needed methods
(AES-128), it makes sense to use it.

There's now a new module option to enable/disable SMP support.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
config
ci_core.c
mp.c
88ba43b662b6b944c6278ad81a114fa559807776 09-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Add simple SMP pairing negotiation

This implementation only exchanges SMP messages between the Host and the
Remote. No keys are being generated. TK and STK generation will be
provided in further patches.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mp.c
b501d6a1dc21eb61cbbc54e40780084f5d517164 07-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Start SMP procedure

Start SMP procedure for LE connections. This modification intercepts
l2cap received frames and call proper SMP functions to start the SMP
procedure. By now, no keys are being used.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
eb492e0169974ac6d168f11d1fc1e2753fe1f3b4 09-Jun-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Implement the first SMP commands

These simple commands will allow the SMP procedure to be started
and terminated with a not supported error. This is the first step
toward something useful.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
akefile
mp.c
b569450682e944653f307b47c549ca12150d4596 09-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't forget to check for LE_LINK

Otherwise the wrong error can be returned.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
1a09bcb97ca1b4eb9a6ea381fbc3beb7a9d2895d 17-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: keep reference if any ERTM timer is enabled

ERTM use the generic L2CAP timer functions to keep a reference to the
channel. This is useful for avoiding crashes.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
c9b66675373e6edb2dc291562ce1fa05f7980102 17-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Make timer functions generic

We now plan to use l2cap_set_timer and l2cap_clear_timer in ERTM timers.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
71ba0e569bb43ab99a07ccbb514f8b0f732140c3 17-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add refcnt to struct l2cap_chan

struct l2cap_chan has now its own refcnt that is compatible with the
socket refcnt, i.e., we won't see sk_refcnt = 0 and chan->refcnt > 0.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
89bc500e41fc5b48e0573e6b0d927fc97b8951dc 03-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add state tracking to struct l2cap_chan

Now socket state is tracked by struct sock and channel state is tracked by
chan->state. At this point both says the same, but this is going to change
when we add AMP Support for example.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
ba3bd0ee3946d9300512e685e8d5573dfa10c060 16-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: add close() callback to l2cap_chan_ops

close() calls l2cap_sock_kill() on l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
230704942283cb3990584ddd6955ac8decfa6a2c 16-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: add recv() callback to l2cap_chan_ops

This abstracts the call to sock_queue_recv_skb() into
l2cap_chan_ops->recv().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
80808e431e1ef25856457de82ce141bed6a6313a 16-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add l2cap_chan_ops abstraction

Add an abstraction layer between L2CAP core and its users (only
l2cap_sock.c now). The first function implemented is new_connection() that
replaces calls to l2cap_sock_alloc() in l2cap_core.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
dc50a06dac61d7ca7ddb3d9bb8921ca5d68f51b6 16-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Merge l2cap_chan_create() in the l2cap_sock_alloc()

As a first step to remove l2cap_sock_alloc() and l2cap_sock_init() from
l2cap_core.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6fdf658c9a0e51e6663f2769f6d310c2843a862b 13-Jun-2011 Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Bluetooth: Fix L2CAP security check

With older userspace versions (using hciops) it might not have the
key type to check if the key has sufficient security for any security
level so it is necessary to check the return of hci_conn_auth to make
sure the connection is authenticated

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
7f4f0572df6c8eaa6a587bc212b0806ff37380dd 27-May-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Do not send SET_EVENT_MASK for 1.1 and earlier devices

Some old hci controllers do not accept any mask so leave the
default mask on for these devices.

< HCI Command: Set Event Mask (0x03|0x0001) plen 8
Mask: 0xfffffbff00000000
> HCI Event: Command Complete (0x0e) plen 4
Set Event Mask (0x03|0x0001) ncmd 1
status 0x12
Error: Invalid HCI Command Parameters

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Tested-by: Corey Boyle <corey@kansanian.com>
Tested-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
0da67bed835fdde68ca0e924d2a2d6ac82c70833 12-May-2011 Luiz Augusto von Dentz <luiz.dentz-von@nokia.com> Bluetooth: fix shutdown on SCO sockets

shutdown should wait for SCO link to be properly disconnected before
detroying the socket, otherwise an application using the socket may
assume link is properly disconnected before it really happens which
can be a problem when e.g synchronizing profile switch.

Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
448f2627c169092d2091a1be22feb6a7775f6201 09-Jun-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6

Conflicts:
net/bluetooth/rfcomm/sock.c
d29d04ce0f49b9fbcaefc83ec4e9bdb7badd45fa 19-May-2011 David Miller <davem@davemloft.net> Bluetooth: Kill set but unused variable 'cmd' in cmtp_recv_capimsg()

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/capi.c
6de6c18d8d3b2a82cc1c657f005e61b1c1f2f886 27-May-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Do not send SET_EVENT_MASK for 1.1 and earlier devices

Some old hci controllers do not accept any mask so leave the
default mask on for these devices.

< HCI Command: Set Event Mask (0x03|0x0001) plen 8
Mask: 0xfffffbff00000000
> HCI Event: Command Complete (0x0e) plen 4
Set Event Mask (0x03|0x0001) ncmd 1
status 0x12
Error: Invalid HCI Command Parameters

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Tested-by: Corey Boyle <corey@kansanian.com>
Tested-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
8d03e971cf403305217b8e62db3a2e5ad2d6263f 12-May-2011 Filip Palian <s3810@pjwstk.edu.pl> Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.

Structures "l2cap_conninfo" and "rfcomm_conninfo" have one padding
byte each. This byte in "cinfo" is copied to userspace uninitialized.

Signed-off-by: Filip Palian <filip.palian@pjwstk.edu.pl>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
fcomm/sock.c
4a77708b055a71bf769a917283a9eba3dcedb017 12-May-2011 Luiz Augusto von Dentz <luiz.dentz-von@nokia.com> Bluetooth: fix shutdown on SCO sockets

shutdown should wait for SCO link to be properly disconnected before
detroying the socket, otherwise an application using the socket may
assume link is properly disconnected before it really happens which
can be a problem when e.g synchronizing profile switch.

Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
d0fad89da9801b3945d2ee7243ecbc75b3da6f09 13-May-2011 Stephen Boyd <sboyd@codeaurora.org> Bluetooth: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning

Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
warning:

In function 'copy_from_user',
inlined from 'rfcomm_sock_setsockopt' at
net/bluetooth/rfcomm/sock.c:705:
arch/x86/include/asm/uaccess_64.h:65:
warning: call to 'copy_from_user_overflow' declared with
attribute warning: copy_from_user() buffer size is not provably
correct

presumably due to buf_size being signed causing GCC to fail to
see that buf_size can't become negative.

Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
e694928067b52f569a7df39b7f02efd7b34ab8f4 04-Jun-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix check for the ERTM local busy state

Local busy is encoded in a bitfield, but was not masked out correctly.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
d8d69c54fb8fbb7483180b609f99f2e3e539962b 04-Jun-2011 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Restore accidentally-deleted line

When code was moved from l2cap_core.c to l2cap_sock.c in commit
6de0702b5b93da0ef097aa092b4597fbc024ebba, one line was dropped
from the old __l2cap_sock_close() implementation. This sk_state
change should still be in l2cap_chan_close().

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
ef4177e2bf92543e422fae154888062376e2283d 02-Jun-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Simplify hci_conn_accept_secure check

If the link key is secure (authenticated or combination 16 digit)
the sec_level will be always BT_SECURITY_HIGH. Therefore, instead
of checking the link key type simply check the sec_level on the link.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
14b12d0b98f87162b7e9e93dde66d1af97886567 24-May-2011 Jaikumar Ganesh <jaikumar@google.com> Bluetooth: Add BT_POWER L2CAP socket option.

Add BT_POWER socket option used to control the power
characteristics of the underlying ACL link. When the remote end
has put the link in sniff mode and the host stack wants to send
data we need need to explicitly exit sniff mode to work well with
certain devices (For example, A2DP on Plantronics Voyager 855).
However, this causes problems with HID devices.

Hence, moving into active mode when sending data, irrespective
of who set the sniff mode has been made as a socket option. By
default, we will move into active mode. HID devices can set the
L2CAP socket option to prevent this from happening.

Currently, this has been implemented for L2CAP sockets. This has been
tested with incoming and outgoing L2CAP sockets for HID and A2DP.

Based on discussions on linux-bluetooth and patches submitted by
Andrei Emeltchenko.

Signed-off-by: Jaikumar Ganesh <jaikumar@google.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
2cap_core.c
2cap_sock.c
96d97a673d42408c0f960cc54d44be7629343bce 01-Jun-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Verify a pin code in pin_code_reply

As we cannot relay on a userspace mgmt api implementation we should verify
if pin_code_reply in fact contains the secure pin code.

If userspace replied with unsecure pincode when secure was required we will
send pin_code_neg_reply to the controller.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
24718ca5eeb6d36a4a78deb34a2d50e4017bbd4a 01-Jun-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Remove a magic number

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
b5ad8b7f8c3f3711129d67aeda85ceec690c3cd0 01-Jun-2011 Johannes Berg <johannes.berg@intel.com> Bluetooth: fix sparse & gcc warnings

sparse complains about a few things that should
be static.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
gmt.c
6d3ce0e7902314ddb330deaf8827205881d7e59f 31-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Set 'peer_addr_type' in hci_le_connect()

Set the 'peer_addr_type' field of the LE Create Connection command
sent in hci_le_connect().

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
eda42b503a3c866d51146549fe46da1f5f64e2c7 31-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Check advertising cache in hci_connect()

When connecting to a LE device, we need to check the advertising
cache in order to know the address type of that device.

If its advertising entry is not found, the connection is not
established and hci_connect() returns error.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
893d67514aebcfd3ebf17bd212ceea1e2741a443 31-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Remove useless check in hci_connect()

There is no need to check the connection's state since hci_conn_add()
has just created a new connection and its state has been set properly.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
29b7988a23daf79c15d587ef9e98e64715aa1ea8 31-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add 'dst_type' field to struct hci_conn

This patch adds a new field (dst_type) to the struct hci_conn which
holds the type of the destination address (bdaddr_t dst). This
approach is needed in order to use the struct hci_conn as an
abstraction of LE connections in HCI Layer. For non-LE this field
is ignored.

This patch also set properly the 'dst_type' field after initializing
LE hci_conn structures.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
d7556e20ade582a223ca1792e1f8a7bfd7d5d008 31-May-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Refactor hci_auth_complete_evt function

Replace if(conn) with if(!conn) checking to avoid too many nested statements

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
19f8def031bfa50c579149b200bfeeb919727b27 31-May-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Fix auth_complete_evt for legacy units

Legacy devices don't re-authenticate the link properly if a link key
already exists. Thus, don't update sec_level for this case even if
hci_auth_complete_evt indicates success. Otherwise the sec_level will
not reflect a real security on the link.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
3581508571b513ed2e66d71f9708d6be907460fd 26-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Advertising entries lifetime

This patch adds a timer to clear 'adv_entries' after three minutes.

After some amount of time, the advertising entries cached during
the last LE scan should be considered expired and they should be
removed from the advertising cache.

It was chosen a three minutes timeout as an initial attempt. This
value might change in future.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
eb9d91f5ae9c14583c49223e49f7e88f77b84749 26-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Clear advertising cache before scanning

The LE advertising cache should be cleared before performing a LE
scanning. This will force the cache to contain only fresh advertising
entries.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
9aa04c9108164e62cf94d6913183817a0d3dbf03 26-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: Add Advertising Report Meta Event handler

This patch adds a function to handle LE Advertising Report Meta
Events.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
76c8686f8871f1bcb2dc8b4c5311cd0e2f73d4cd 26-May-2011 Andre Guedes <andre.guedes@openbossa.org> Bluetooth: LE advertising cache

This patch implements the LE advertising cache. It stores sensitive
information (bdaddr and bdaddr_type so far) gathered from LE
advertising report events.

Only advertising entries from connectables devices are added to the
cache.

Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
0f8527249646bbe75d036fe8b9b84d662ece90a9 05-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename __l2cap_chan_close() to l2cap_chan_close()

To make it consistent with the rest of the API.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
500698d3fd987f6c405d6d5f68fdf535a539e71e 05-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove export of l2cap_chan_clear_timer()

The call to l2cap_chan_clear_timer() is not really needed in l2cap_sock.c.
This patch also adds a call to l2cap_chan_clear_timer() to the only place
in __l2cap_sock_close() that wasn't calling it. It's safe call it there
because l2cap_chan_clear_timer() check first for timer_peding().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
ab07801d28985090ac38047b5a4d8952a7e1689f 02-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: create channel timer to replace sk_timer

The new timer does not belong to struct sock, tought it still touch some
sock things, but this will be sorted out soon.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
715ec005cd10c5d53109ffe513e4d403644e3e48 02-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add chan->chan_type struct member

chan_type says if our chan is raw(direclty access to HCI),
connection less or connection oriented.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
9a91a04a95d30a18909e2aec9d7b17b4c86088a7 28-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Create l2cap_chan_send()

This move all the sending logic to l2cap_core.c, but we still have a
socket dependence there, struct msghdr. It will be removed in some of the
further commits.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
4519de9a0478d8de438f8b80ab2e94668ef63ab4 28-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Create __l2cap_chan_close()

This is actually __l2cap_sock_close() renamed to __l2cap_chan_close().
At a first look it may not make sense, but with the further cleanups that
will come it will.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
37e1c55de7b1edd3fb8fc3411ad0c32a213723d0 20-May-2011 Johan Hedberg <johan.hedberg@intel.com> Bluetooth: Remove unnecessary use of hci_dev_list_lock

The get_connections function has no need to use hci_dev_list_lock. The
code was there probably because of a copy-paste mistake.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
75fde9ee1bca0c0c004aadaebdedf17370f93f18 20-May-2011 David Miller <davem@davemloft.net> Bluetooth: Kill set but not used variable 'l2cap_sk' in rfcomm_sock_getsockopt_old()

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
78676a06260a4162b6837a8a2fb954445004ebc2 18-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix set but not used warning

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
224f8af0db1cd50e9d954ca9d5a7d7716f63d2b0 13-May-2011 Ruiyi Zhang <Ruiyi.Zhang@Atheros.com> Bluetooth: Allow unsegmented SDU retries on sock_queue_rcv_skb failure

In L2CAP_SDU_UNSEGMENTED case, if sock_queue_rcv_skb returns error,
l2cap_ertm_reassembly_sdu should not return 0 so as to insert the
skb into BUSY_QUEUE for later retries.

Signed-off-by: Ruiyi Zhang <Ruiyi.Zhang@Atheros.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
f81c62242045fb7be0a124d8c2540af96d842fad 03-Jun-2011 Joe Perches <joe@perches.com> net: Remove unnecessary semicolons

Semicolons are not necessary after switch/while/for/if braces
so remove them.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
a7567b2059020bf3fa96c389ec25eed8e28ad4ba 01-Jun-2011 Johannes Berg <johannes.berg@intel.com> bluetooth l2cap: fix locking in l2cap_global_chan_by_psm

read_lock() ... read_unlock_bh() is clearly bogus.
This was broken by

commit 23691d75cdc69c3b285211b4d77746aa20a17d18
Author: Gustavo F. Padovan <padovan@profusion.mobi>
Date: Wed Apr 27 18:26:32 2011 -0300

Bluetooth: Remove l2cap_sk_list

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2cap_core.c
ee9ec4f82049c678373a611ce20ac67fe9ad836e 23-May-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (36 commits)
HID: hid-multitouch: cosmetic changes, sort classes and devices
HID: hid-multitouch: class MT_CLS_STANTUM is redundant with MT_CLS_CONFIDENCE
HID: hid-multitouch: add support for Unitec panels
HID: hid-multitouch: add support for Touch International panels
HID: hid-multitouch: add support for GoodTouch panels
HID: hid-multitouch: add support for CVTouch panels
HID: hid-multitouch: add support for ActionStar panels
HID: hiddev: fix race between hiddev_disconnect and hiddev_release
HID: magicmouse: ignore 'ivalid report id' while switching modes
HID: fix a crash in hid_report_raw_event() function.
HID: hid-multitouch: add support for Elo TouchSystems 2515 IntelliTouch Plus
HID: assorted usage updates from hut 1.12
HID: roccat: fix actual/startup profile sysfs attribute in koneplus
HID: hid-multitouch: Add support for Lumio panels
HID: 'name' and 'phys' in 'struct hid_device' can never be NULL
HID: hid-multitouch: add support for Ilitek dual-touch panel
HID: picolcd: Avoid compile warning/error triggered by copy_from_user()
HID: add support for Logitech G27 wheel
HID: hiddev: fix error path in hiddev_read when interrupted
HID: add support for Sony Navigation Controller
...
06f4e926d256d902dd9a53dcb400fd74974ce087 20-May-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1446 commits)
macvlan: fix panic if lowerdev in a bond
tg3: Add braces around 5906 workaround.
tg3: Fix NETIF_F_LOOPBACK error
macvlan: remove one synchronize_rcu() call
networking: NET_CLS_ROUTE4 depends on INET
irda: Fix error propagation in ircomm_lmp_connect_response()
irda: Kill set but unused variable 'bytes' in irlan_check_command_param()
irda: Kill set but unused variable 'clen' in ircomm_connect_indication()
rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()
be2net: Kill set but unused variable 'req' in lancer_fw_download()
irda: Kill set but unused vars 'saddr' and 'daddr' in irlan_provider_connect_indication()
atl1c: atl1c_resume() is only used when CONFIG_PM_SLEEP is defined.
rxrpc: Fix set but unused variable 'usage' in rxrpc_get_peer().
rxrpc: Kill set but unused variable 'local' in rxrpc_UDP_error_handler()
rxrpc: Kill set but unused variable 'sp' in rxrpc_process_connection()
rxrpc: Kill set but unused variable 'sp' in rxrpc_rotate_tx_window()
pkt_sched: Kill set but unused variable 'protocol' in tc_classify()
isdn: capi: Use pr_debug() instead of ifdefs.
tg3: Update version to 3.119
tg3: Apply rx_discards fix to 5719/5720
...

Fix up trivial conflicts in arch/x86/Kconfig and net/mac80211/agg-tx.c
as per Davem.
6b7b8e488bbdedeccabdd001a78ffcbe43bb8a3a 18-May-2011 Jiri Kosina <jkosina@suse.cz> Merge branch 'master' into upstream.

This is sync with Linus' tree to receive KEY_IMAGES definition
that went in through input tree.
6dcae1eaee2b437536b2fe928a609f9589691ebf 17-May-2011 David S. Miller <davem@davemloft.net> bluetooth: Fix warnings in l2cap_core.c

net/bluetooth/l2cap_core.c: In function ‘l2cap_recv_frame’:
net/bluetooth/l2cap_core.c:3758:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3758:15: note: ‘sk’ was declared here
net/bluetooth/l2cap_core.c:3791:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3791:15: note: ‘sk’ was declared here

Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_core.c
e00cf3b9eb7839b952e434a75bff6b99e47337ac 16-May-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
drivers/net/wireless/iwlwifi/iwl-agn-tx.c
net/mac80211/sta_info.h
15cb309614f35df344b9f06a9ea9f077d1e449db 12-May-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next-2.6
55183d06cd1bd939ceccdad628b0aae12c86b803 12-May-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove leftover debug messages

They were added by me while testing and I forgot to remove.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
ce8453776d68982cfe93bcb28191af8ccad01f45 12-May-2011 Linus Torvalds <torvalds@linux-foundation.org> Revert "Bluetooth: fix shutdown on SCO sockets"

This reverts commit f21ca5fff6e548833fa5ee8867239a8378623150.

Quoth Gustavo F. Padovan:
"Commit f21ca5fff6e548833fa5ee8867239a8378623150 can cause a NULL
dereference if we call shutdown in a bluetooth SCO socket and doesn't
wait the shutdown completion to call close(). Please revert it. I
may have a fix for it soon, but we don't have time anymore, so revert
is the way to go. ;)"

Requested-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
co.c
365227e5fdf3d117e096416d9d3cc148959a829e 06-May-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for disconnecting LE links via mgmt

If we can't find a ACL link between the devices, we search
the connection list one second time looking for LE links.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
83bc71b4102d2a288edaf9ee398b330b88a88086 06-May-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Add support for sending connection events for LE links

We need to be able for receive events notifying that the connection
was established, the connection attempt failed or that disconnection
happened.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
b3b1b061583ba4909b59a2f736825d86495fe956 06-May-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Double check sec req for pre 2.1 device

In case of pre v2.1 devices authentication request will return
success immediately if the link key already exists without any
authentication process.

That means, it's not possible to re-authenticate the link if you
already have combination key and for instance want to re-authenticate
to get the high security (use 16 digit pin).

Therefore, it's necessary to check security requirements on auth
complete event to prevent not enough secure connection.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
fcomm/core.c
a70171dce9cd44cb06c7d299eba9fa87a8933045 05-May-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
drivers/net/wireless/libertas/if_cs.c
drivers/net/wireless/rtlwifi/pci.c
net/bluetooth/l2cap_sock.c
23691d75cdc69c3b285211b4d77746aa20a17d18 27-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove l2cap_sk_list

A new list was added to replace the socket based one. This new list
doesn't depent on sock and then fits better inside l2cap_core.c code.

It also rename l2cap_chan_alloc() to l2cap_chan_create() and
l2cap_chan_free() to l2cap_chan_destroy)

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
73b2ec18532f45e9028ce4c7bc8d7f8818eabd2a 19-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Handle psm == 0 case inside l2cap_add_psm()

When the user doesn't specify a psm we have the choose one for the
channel. Now we do this inside l2cap_add_psm().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
9e4425fff9e0a0fb6a8c705777ed861f991f8747 18-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add l2cap_add_psm() and l2cap_add_scid()

The intention is to get rid of the l2cap_sk_list usage inside
l2cap_core.c. l2cap_sk_list will soon be replaced by a list that does not
depend on socket usage.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
dee04cac28b5f8a99e002ec1b2e0a49f3155bda0 29-Apr-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next-2.6
7cbc9bd99542752ff570abca79d0027669a01fb8 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix updating conn->auth_type in hci_io_capa_request_evt

In some circumstances hci_get_auth_req will return a value different
from the current conn->auth_type. In these cases update conn->auth_type
so that when a user confirm request comes it doesn't falsely trigger
auto-accept.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
4df378a10e31698df1679f3329301d773a654b61 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add store_hint parameter to mgmt_new_key

Even for keys that shouldn't be stored some use cases require the
knowledge of a new key having been created so that the conclusion of a
successful pairing can be made. Therefore, always send the mgmt_new_key
event but add a store_hint parameter to it to indicate to user space
whether the key should be stored or not.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
4748fed2d1a2a7a816277754498b8aa70850e051 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Remove old_key_type from mgmt_ev_new_key

User space shouldn't have any need for the old key type so remove it
from the corresponding Management interface event.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
655fe6ece7e71b37c17577ae485d11bf701c95f7 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix connection key type updating for buggy controllers

If a controller generates a changed combination key as its first key the
connection key type will not be correctly set. In these situations make
sure the update the connection key type when such a buggy controller is
detected.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
12adcf3a953c3aa4006d855aa638133bf018ceac 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix old_key_type logic for non-persistent keys

Even if there's no previous key stored the connection might still be
secured with a non-persistent key and in that case the key type in the
hci_conn struct should be checked.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
d25e28abe58d2bcedf6025a6ccc532c29a19046f 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix link key persistent storage criteria

Link keys should only be stored if very specific criteria of the
authentication process are fulfilled. This patch essentially copies the
criteria that user space has so far been using to the kernel side so
that the management interface works properly.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
582fbe9ef9d6fc089ff20956595f046d4899e74e 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix logic in hci_pin_code_request_evt

The mgmt_ev_pin_code_request event should not be sent to user space if
the request gets rejected by the kernel due to the pairable flag not
being set.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
be77159c3f37e73a18ecc5c1eab3c67e07c6ce22 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix reason code for pairing rejection

"Pairing not allowed" is 0x18 and not 0x16.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
55bc1a378cc35f21a26e07af2ff2b71820808cd4 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add confirm_hint parameter to user confirmation requests

When accepting a pairing request which fulfills the SSP auto-accept
criteria we need to push the request all the way to the user for
confirmation. This patch adds a new hint to the user_confirm_request
management event so user space can know when to show a numeric
comparison dialog and when to show a simple yes/no confirmation dialog.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
79c6c70cbe35c270e7b59207ab76b44183a1030a 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix HCI_CONN_AUTH_PEND flag for all authentication requests

The HCI_CONN_AUTH_PEND flag should be set whenever requesting
authentication so that multiple pending requests can't occur.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
9f61656a60c9506e3e4cd41af5efbcf6a30ee3b9 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add variable SSP auto-accept delay support

Some test systems require an arbitrary delay to the auto-accept test
cases for Secure Simple Pairing in order for the tests to pass.
Previously when this was handled in user space it was worked around by
code modifications and recompilation, but now that it's on the kernel
side it's more convenient if there's a debugfs interface for it.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
ci_sysfs.c
7a828908a026d801c6192fd32cfb35d6843f1539 28-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add automated SSP user confirmation responses

This patch adds automated negative and positive (auto-accept) responses
for Secure Simple Pairing user confirmation requests. The responses are
only sent if the HCI_MGMT flag is set in order not to confuse older user
space versions (without management interface support).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
a770bb5aea84ee2509d4775f9959665f96da3b9d 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Add secure flag for mgmt_pin_code_req

Extend the mgmt_pin_code_request interface to require secure
pin code (16 digit) for authentication.

This is a kernel part of the secure pin code requirement notification
to user space agent.

Code styling fix by Johan Hedberg.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
58797bf77234154a84827186bda316a1205bde05 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Respect local MITM req in io_cap reply

If host requires MITM protection notify that to controller in
io capabilities reply even if the remote device requires no bonding.

If it is not respected, host can get an unauthenticated link key while
it expects authenticated one.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
60b83f571cf17a7a8ca9ddf2090db63e6a594571 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Ignore key unauthenticated for high security

High security level for pre v2.1 devices requires combination link key
authenticated by at least 16 digit PIN code.

It's also necessary to update key_type and pin_length when the key
exists and is sufficently secured for the connection as there will be
no link key notify event in that case.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
13d39315c22b128f4796fc008b04914a7c32bb1a 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Map sec_level to link key requirements

Keep the link key type together with connection and use it to
map security level to link key requirements. Authenticate and/or
encrypt connection if the link is insufficiently secure.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
9003c4e220c2954a53c5da0d739ed15a46c13429 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Don't modify sec_level if auth failed

If authentication fails the security level should stay as it was set
before the process has started. Setting BT_SECURITY_LOW can hide real
security level on a link eg. having BT_SECURITY_MEDIUM on the link,
re-authenticate with failure to get BT_SECURITY_HIGH, as a result we
get BT_SECURITY_LOW on the link while the real security is still medium.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
b6020ba055c7f1ca901dc8751ecc7c9de58164db 28-Apr-2011 Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Bluetooth: Add definitions for link key types

Introduce the link key types defs and use them instead of magic numbers.

Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
314b2381a79c6bfe3ddc4ba3806ecb6aec27a3db 27-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add discovering event to the Management interface

This patch adds a new event to the Management interface to track when
local adapters are discovering remote devices. For now this only tracks
BR/EDR discovery procedures.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
14a53664138a8407382745bb470045d1817b7801 27-Apr-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add basic discovery commands to the management interface

This patch adds start_discovery and stop_discovery commands to the
management interface. Right now their implementation is fairly
simplistic and the parameters are fixed to what user space has
defaulted to so far.
This is the very initial phase for discovery implementation into
the kernel. Next steps include name resolution, LE scanning and
bdaddr type handling.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
cf2f90f59bbf2c2a539d171cde6e1dfe72048555 27-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't export l2cap_sock_ops

l2cap_sk_ops can be static, it's not used outside l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
6ff5abbf4e4aa88feb9c2367d4fbd9ea081bf98c 25-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix memory leak with L2CAP channels

A new l2cap_chan_free() is added to free the channels.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
8c1d787be4b62d2d1b6f04953eca4bcf7c839d44 14-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move conn to struct l2cap_chan

There is no need to the socket deal directly with the channel, most of the
time it cares about the channel only.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
fcomm/core.c
fcomm/sock.c
fe4128e0aabc3c748786c00da21e6eff9d3aeddb 14-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move more vars to struct l2cap_chan

In this commit, psm, scid and dcid.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
0c1bc5c626e9783034264ccca4b262b3acc628f1 13-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move more channel info to struct l2cap_chan

In this commit, omtu, imtu, flush_to, mode and sport. It also remove the
pi var from l2cap_sock_sendmsg().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
idp/core.c
2cap_core.c
2cap_sock.c
fcomm/core.c
47d1ec6161da2c7b9dbc56a5200fa26b17d5fdc1 13-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move more vars to struct l2cap_chan

In this commit all ERTM and Streaming Mode specific vars.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
fcomm/core.c
4343478f3a4806394136d8141b2e451aa5443f03 12-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move some more elements to struct l2cap_chan

In this commit sec_level, force_reliable, role_switch and flushable.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
77a74c7e0861e6ebac7effe233fd7e83f1ad9ecc 12-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename l2cap_do_connect() to l2cap_chan_connect()

l2cap_chan_connect() is a much better name and reflects what this
functions is doing (or will do once socket dependence is removed from the
core).

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
b44500351845e4f6df0d752a8870da246be8216f 12-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move conf_state to struct l2cap_chan

First move of elements depending on user data.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
5d41ce1dd91bce01d50aff79786dc5d5eedcfab7 08-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Refactor L2CAP channel allocation

If the allocation happens at l2cap_sock_create() will be able to use the
struct l2cap_chan to store channel info that comes from the user via
setsockopt.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
429576b97c623b9c4e3375fb7c37bce377f51e68 26-Apr-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
2bd93d7af1581d40e3c4b25242472661cb7c637a 26-Apr-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Resolved logic conflicts causing a build failure due to
drivers/net/r8169.c changes using a patch from Stephen Rothwell.

Signed-off-by: David S. Miller <davem@davemloft.net>
bf734843120b905bacc3d24c88d7455ae70bf6e1 25-Apr-2011 David S. Miller <davem@davemloft.net> bluetooth: Fix use-before-initiailized var.

net/bluetooth/l2cap_core.c: In function ‘l2cap_recv_frame’:
net/bluetooth/l2cap_core.c:3612:15: warning: ‘sk’ may be used uninitialized in this function
net/bluetooth/l2cap_core.c:3612:15: note: ‘sk’ was declared here

Actually the problem is in the inline function l2cap_data_channel(), we
branch to the label 'done' which tests 'sk' before we set it to anything.

Initialize it to NULL to fix this.

Signed-off-by: David S. Miller <davem@davemloft.net>
2cap_core.c
cfef6047c4027a8448ec8dafeaf2bb362cc882e4 25-Apr-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
drivers/net/wireless/iwlwifi/iwl-core.c
drivers/net/wireless/rt2x00/rt2x00queue.c
drivers/net/wireless/rt2x00/rt2x00queue.h
1ed3aad141fe595673c20225a9e004730088be52 22-Apr-2011 David S. Miller <davem@davemloft.net> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
6d67c110ab204bc4c2f4f3e368b8d7cf1f38a4f8 06-Apr-2011 Antonio Ospite <ospite@studenti.unina.it> HID: bt: hidp.h: do not use a tab after a #define

Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/hidp.h
828d7d7b19446bf5a40928da47955c575a454c75 21-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6

Conflicts:
net/bluetooth/l2cap_core.c
net/bluetooth/l2cap_sock.c
net/bluetooth/mgmt.c
a429b51930e64dd355840c37251a563000d7c10b 18-Apr-2011 Ruiyi Zhang <Ruiyi.zhang@atheros.com> Bluetooth: Only keeping SAR bits when retransmitting one frame.

When retrasmitting one frame, only SAR bits in control field should
be kept.

Signed-off-by: Ruiyi Zhang <Ruiyi.zhang@atheros.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
f21ca5fff6e548833fa5ee8867239a8378623150 08-Apr-2011 Luiz Augusto von Dentz <luiz.dentz-von@nokia.com> Bluetooth: fix shutdown on SCO sockets

shutdown should wait for SCO link to be properly disconnected before
detroying the socket, otherwise an application using the socket may
assume link is properly disconnected before it really happens which
can be a problem when e.g synchronizing profile switch.

Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
b79f44c16a4e2181b1d6423afe746745d5e949ff 11-Apr-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix keeping the command timer running

In the teardown path the reset command is sent to the controller,
this event causes the command timer to be reactivated.

So the timer is removed in two situations, when the adapter isn't
marked as UP and when we know that some command has been sent.

Reported-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
7a74aeb022b34a8fa8ef00545e66cf0568b5ddf6 07-Apr-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Fix refcount balance for hci connection

hci_io_capa_reply_evt() holds reference for hciconnection. It's useless since
hci_io_capa_request_evt()/hci_simple_pair_complete_evt() already protects the
connection. In addition it leaves connection open after failed SSP pairing.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
26954c7f26068b6ced108806fdd39aee5cd54e6f 14-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix lockdep warning in L2CAP

Fix a regression from the L2CAP "rewrite" patches.
Purge the tx_q already happens on l2cap_chan_del() so we don't need it at
l2cap_disconnect_req().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
62f3a2cfb1891c070631e496eeea852e949ea8bb 14-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix another locking unbalance

l2cap_get_sock_by_scid was changed to not lock the socket anymore, but I
forgot to change all the users of this function.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
280f294f7bd0c14d9f802a551c95dc930e31d723 14-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't lock sock inside l2cap_get_sock_by_scid()

Fix an locking issue with the new l2cap_att_channel(). l2cap_att_channel()
was trying to lock a locked socket.

Reported-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
e1ba1f15469903b6f443fbf00f069d169e3fba6d 06-Apr-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix Out Of Band pairing when mgmt interface is disabled

Use kernel stored remote Out Of Band data only if management interface
is enabled. Otherwise HCI_OP_REMOTE_OOB_DATA_NEG_REPLY was sent to
controller even if remote Out Of Band data was present in bluetoothd.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
9f69bda6aa8b365169b4a6fd35432ee40574d661 07-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add proper handling of received LE data

Despite it works, handling through l2cap_data_channel() is wrongs.
That function should handle only connection oriented data.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
cd69a03af1106c486033df600c7945957ea5abeb 05-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix wrong comparison in listen()

We should check for the pi->scid there.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
58d35f87effa0235181a24d55576aaa756ef7312 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move tx queue to struct l2cap_chan

tx_q is the queue used by ERTM mode.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
c916fbe45c1f30417fa28e62cbbfae295a3f315c 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove unneeded uninitialized_vars()

That was unnecessary use of it.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
49208c9c7b483098401683fef5cfbd66931ca643 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove some sk references from l2cap_core.c

Change some BT_DBG messages and consequently remove some struct sock
declarations.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
39d5a3ee355fa903ef4609402c79f570eb9fc4d2 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move SREJ list to struct l2cap_chan

As part of moving all the Channel related operation to struct l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
252f4bf400df1712408fe83ba199a66a1b57ab1d 12-Apr-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

Conflicts:
drivers/net/wireless/ath/ar9170/main.c
drivers/net/wireless/ath/ar9170/phy.c
drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
2ead70b8390d199ca04cd35311b51f5f3676079e 01-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix lockdep warning with skb list lock

This is a regression acctually, caused by the first patch series for
creating a formal strcut l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
311bb895e325e5f4d708c1ed2206da8a3885c83a 26-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move busy workqueue to struct l2cap_chan

As part of the moving channel stuff to l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
f1c6775be6fc944e32e0150305d9753b9a846519 26-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move srej and busy queues to struct l2cap_chan

As part of the moving channel stuff to l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
e92c8e70faf5e3cc22979daba2a895359aa1eab2 01-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move ERTM timers to struct l2cap_chan

This also triggered a change in l2cap_send_disconn_req() parameters.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
2c03a7a49e0831646bd35d0877ec7d051d8f174b 26-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move remote info to struct l2cap_chan

As part of the moving channel stuff to l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6f61fd475907bf0a1470cb969ee993a31d305513 26-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move SDU related vars to struct l2cap_chan

As part of the moving channel stuff to l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
6a026610eee2c53ff59598905fcbaa979aec68d1 01-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move more ERTM stuff to struct l2cap_chan

As part of the moving channel stuff to l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
42e5c8027bad6f1591032941f0ebf4fc079405c8 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move of ERTM *_seq vars to struct l2cap_chan

As part of the moving channel to stuff to struct l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
525cd1851b9faaadf5ea33e05192b8d22f42487e 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move conn_state to struct l2cap_chan

This is part of "moving things to l2cap_chan". As one the first move it
triggered a big number of changes in the funcions parameters, basically
changing the struct sock param to struct l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
710f9b0a423cad155144742f6497efe5163ed750 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: clean up l2cap_sock_recvmsg()

Move some channel specific stuff to l2cap_core.c, this will make things
more clear.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
73ffa904b78287f6acf8797e040150aa26a4af4a 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move conf_{req,rsp} stuff to struct l2cap_chan

They are also l2cap_chan specific.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
fc7f8a7ed4543853a99852ca405ea71fabe78946 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move ident to struct l2cap_chan

ident is chan property, no need to reside on socket.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
820ffdb3d25f74fbd553453f461709d52dfa72a2 01-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove struct del_list

As we use struct list_head to keep L2CAP channels list the workaround with
del_list is not needed anymore.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
baa7e1fa6d2870462bd744df1c6ddbd497fe86d6 31-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use struct list_head for L2CAP channels list

Use a well known Kernel API is always a good idea than implement your own
list.
In the future we might use RCU on this list.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
48454079c2d4b9ee65c570a22c5fdfe1827996a4 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Create struct l2cap_chan

struct l2cap_chan cames to create a clear separation between what
properties and data belongs to the L2CAP channel and what belongs to the
socket. By now we just fold the struct sock * in struct l2cap_chan as all
the channel info is struct l2cap_pinfo today.

In the next commits we will see a move of channel stuff to struct
l2cap_chan.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
42933bac11e811f02200c944d8562a15f8ec4ff0 07-Apr-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6

* 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6:
Fix common misspellings
db940cb0db7c69a217661ecd49e1e6b0d680a6cc 02-Apr-2011 Alexey Dobriyan <adobriyan@gmail.com> Bluetooth: convert net/bluetooth/ to kstrtox

Convert from strict_strto*() interfaces to kstrto*() interfaces.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
e63a15ec0f25c0f97e8f6247b97ac9b30968b6b3 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use GFP_KERNEL in user context

The allocation in mgmt_control() code are in user context and not locked
by any spinlock, so it's not recommended the use of GFP_ATOMIC there.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
1322901da5094cecd9826ec3aaade83f6452cc45 05-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't use spin_lock_bh in user context

spin_lock() and spin_unlock() are more apropiated for user context.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
fada4ac33992b1f953d95584e36f6ca7860aea40 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use kthread API in cmtp

kernel_thread() is a low-level implementation detail and
EXPORT_SYMBOL(kernel_thread) is scheduled for removal.
Use the <linux/kthread.h> API instead.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/capi.c
mtp/cmtp.h
mtp/core.c
f4d7cd4a4c25cb4a5c30a675d4cc0052c93b925a 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use kthread API in bnep

kernel_thread() is a low-level implementation detail and
EXPORT_SYMBOL(kernel_thread) is scheduled for removal.
Use the <linux/kthread.h> API instead.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/bnep.h
nep/core.c
aabf6f897e44bdf3e237ada04aa8f88d77d75cac 05-Apr-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use kthread API in hidp

kernel_thread() is a low-level implementation detail and
EXPORT_SYMBOL(kernel_thread) is scheduled for removal.
Use the <linux/kthread.h> API instead.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
idp/hidp.h
a88a9652d25a63ce10b6a5fe680d0ad8f33b9c9b 30-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add mgmt_remote_name event

This patch adds a new remote_name event to the Management interface
which is sent every time the name of a remote device is resolved (over
BR/EDR).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
e17acd40f6006d0a0e0b1b3f7359ba4d543011c6 30-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add mgmt_device_found event

This patch adds a device_found event to the Management interface. For
now the event only maps to BR/EDR inquiry result HCI events, but in the
future the plan is to also use it for the LE device discovery process.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
1e429f3842b5c9b5967a250f4daf78f92436268c 04-Apr-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove gfp_mask param from hci_reassembly()

It is unnecessary, once we are always in interrupt context.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
220b881a77eca96afdd6037dbca3441e8938228f 31-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6
6f5ef998b7b0b1bf1471654bf6176a5419197128 24-Mar-2011 Thomas Gleixner <tglx@linutronix.de> Bluetooth: Fix warning with hci_cmd_timer

After we made debugobjects working again, we got the following:

WARNING: at lib/debugobjects.c:262 debug_print_object+0x8e/0xb0()
Hardware name: System Product Name
ODEBUG: free active (active state 0) object type: timer_list hint: hci_cmd_timer+0x0/0x60
Pid: 2125, comm: dmsetup Tainted: G W 2.6.38-06707-gc62b389 #110375
Call Trace:
[<ffffffff8104700a>] warn_slowpath_common+0x7a/0xb0
[<ffffffff810470b6>] warn_slowpath_fmt+0x46/0x50
[<ffffffff812d3a5e>] debug_print_object+0x8e/0xb0
[<ffffffff81bd8810>] ? hci_cmd_timer+0x0/0x60
[<ffffffff812d4685>] debug_check_no_obj_freed+0x125/0x230
[<ffffffff810f1063>] ? check_object+0xb3/0x2b0
[<ffffffff810f3630>] kfree+0x150/0x190
[<ffffffff81be4d06>] ? bt_host_release+0x16/0x20
[<ffffffff81be4d06>] bt_host_release+0x16/0x20
[<ffffffff813a1907>] device_release+0x27/0xa0
[<ffffffff812c519c>] kobject_release+0x4c/0xa0
[<ffffffff812c5150>] ? kobject_release+0x0/0xa0
[<ffffffff812c61f6>] kref_put+0x36/0x70
[<ffffffff812c4d37>] kobject_put+0x27/0x60
[<ffffffff813a21f7>] put_device+0x17/0x20
[<ffffffff81bda4f9>] hci_free_dev+0x29/0x30
[<ffffffff81928be6>] vhci_release+0x36/0x70
[<ffffffff810fb366>] fput+0xd6/0x1f0
[<ffffffff810f8fe6>] filp_close+0x66/0x90
[<ffffffff810f90a9>] sys_close+0x99/0xf0
[<ffffffff81d4c96b>] system_call_fastpath+0x16/0x1b

That timer was introduced with commit 6bd32326cda(Bluetooth: Use
proper timer for hci command timout)

Timer seems to be running when the thing is closed. Removing the timer
unconditionally fixes the problem. And yes, it needs to be fixed
before the HCI_UP check.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
34bd0273b631742e8d929c80e90cb7782105d8da 24-Mar-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: delete hanging L2CAP channel

Sometimes L2CAP connection remains hanging. Make sure that
L2CAP channel is deleted.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
08ba53824a7fb224085a0ff73eab213cab0197e9 16-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix missing hci_dev_lock_bh in user_confirm_reply

The code was correctly calling _unlock at the end of the function but
there was no actual _lock call anywhere.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
105721328f0fa53e772592eaca17ee0023f0cc87 16-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix HCI_RESET command synchronization

We can't send new commands before a cmd_complete for the HCI_RESET command
shows up.

Reported-by: Mikko Vinni <mmvinni@yahoo.com>
Reported-by: Justin P. Mattock <justinmattock@gmail.com>
Reported-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Tested-by: Justin P. Mattock <justinmattock@gmail.com>
Tested-by: Mikko Vinni <mmvinni@yahoo.com>
Tested-by: Ed Tomlinson <edt@aei.ca>
ci_core.c
ci_event.c
23e9fde2b344c22c5176c7fd37b52c3776ef5aba 09-Mar-2011 Suraj Sumangala <suraj@atheros.com> Bluetooth: Increment unacked_frames count only the first transmit

This patch lets 'l2cap_pinfo.unacked_frames' be incremented only
the first time a frame is transmitted.

Previously it was being incremented for retransmitted packets
too resulting the value to cross the transmit window size.

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
80a1e1dbf62a08984d4c1bfb5a4bca38c3e1664f 28-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add local Extended Inquiry Response (EIR) support

This patch adds automated creation of the local EIR data based on what
16-bit UUIDs are registered and what the device name is. This should
cover the majority use cases, however things like 32/128-bit UUIDs, TX
power and Device ID will need to be added later to be on par with what
bluetoothd is capable of doing (without the Management interface).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e90165be9a4d6a1e8fa632fcae00a5294abd3981 25-Mar-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: check L2CAP info_rsp ident and state

Information requests/responses are unbound to L2CAP channel. Patch
fixes issue arising when two devices connects at the same time to
each other. This way we do not process out of the context messages.
We are safe dropping info_rsp since info_timer is left running.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
d1010240fa9aac93da56a683c1295e759ee69d10 25-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move bt_accept_enqueue() to outside __l2cap_chan_add

bt_accept_enqueue() is not really a channel action, so do it outside.
This patch is part of a set of patches to create an struct l2cap_chan to
have a clear separation between the struct sock and the L2CAP channel
stuff.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
ce85ee13e6b5d078f4a6c3b02ba7cd0fa140c552 22-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Enable support for out of band association model

If remote side reports oob availability or we are pairing initiator
use oob data for pairing if available.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
2763eda6ccaf126633bb3180f440c8f3589f0679 22-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Add add/remove_remote_oob_data management commands

This patch adds commands to add and remove remote OOB data to the managment
interface. Remote data is stored in kernel and can be used by corresponding
HCI commands and events when needed.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
c35938b2f56547ee77b5a038fe0db394aeac59bb 22-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Add read_local_oob_data management command

This patch adds a command to read local OOB data to the managment interface.
The command maps directly to the Read Local OOB Data HCI command.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
8fce6357a9e72c4c9c846f9951895954bfb34ad1 22-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Allow for NULL data in mgmt_pending_add

Since index is in mgmt_hdr it is possible to have mgmt command with
no parameters that still needs to add itself to pending list.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
c68fb7ff29622a7db8264f939f94e37330c27080 22-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Rename cmd to param in pending_cmd

This field holds not whole command but only command specific
parameters.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e0e185efbad442a659657c152a9cd9b3fdcb43f2 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix checkpatch error in cmtp.h

Do not use C99 // comments.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/cmtp.h
ffd13320aa96e07f3048ebdcc603aaf38bed0c47 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use #include <linux/uaccess.h> instead of <asm/uaccess.h>

As warned by checkpatch.pl, use #include <linux/uaccess.h> instead of
<asm/uaccess.h>

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/sock.c
58aac468be411f2a9b4a28f2ed8e6e2a0db04267 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Do not use assignments in IF conditions

Fix checkpatch warnings concerning assignments in if conditions.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
17f09a7e4ec5dd6a0d96498da6bf78762fba4468 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix checkpatch errors, code style issues and typos in hidp

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
idp/hidp.h
idp/sock.c
8c20aa9ffc5a5ef52b6148e905671a8d12b40c87 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use #include <linux/uaccess.h> instead of <asm/uaccess.h>

As warned by checkpatch.pl, use #include <linux/uaccess.h> instead of
<asm/uaccess.h>

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/sock.c
3aad75a128e2f2b8da31de1df4b9b9b4a8f65c66 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix checkpatch errors and some code style issues in bnep

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/bnep.h
nep/core.c
a3d9bd4c00f13defd4c0fdcf8b47f8764a69e54d 21-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Opencode macros in bnep/core.c

BNEP_RX_TYPES and INCA macros have only one user each and don't provide
any benefits compared to opencoding them.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
2c6d1a2eec5c49793c6760546d05515ce1b76881 23-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Improve error message on wrong link type

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
b312b161ecb833b1bce5c4a97853f4a4f40c7901 16-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: mgmt: Add support for setting the local name

This patch adds a new set_local_name management command as well as a
local_name_changed management event. With these user space can both
change the local name as well as monitor changes to it by others.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
dc4fe30b8675033e538e2dea50be8af9c75f1b6a 16-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: mgmt: Add local name information to read_info reply

This patch adds the name of the adapter to the reply of the read_info
management command.

The management messages reserve 249 bytes for the name instead of 248
(like in the HCI spec) so that there is always a guarantee that it is
nul-terminated. That way it can safely be passed onto string
manipulation functions.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
1f6c6378c59f3ddac9ed89a68ccefe2611300c09 16-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add define for the maximum name length on HCI level

This patch adds a clear define for the maximum device name length in HCI
messages and thereby avoids magic numbers in the code.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
ci_sysfs.c
f0681a68dd3a32699891cd1de93459aee5af7728 17-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: remove unnecessary function declaration

hci_notify() doesn't need declaration first.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
25985edcedea6396277003854657b5f3cb31a628 31-Mar-2011 Lucas De Marchi <lucas.demarchi@profusion.mobi> Fix common misspellings

Fixes generated by 'codespell' and manually reviewed.

Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
ci_core.c
2cap_sock.c
b77dcf8460ae57d4eb9fd3633eb4f97b8fb20716 24-Mar-2011 Thomas Gleixner <tglx@linutronix.de> Bluetooth: Fix warning with hci_cmd_timer

After we made debugobjects working again, we got the following:

WARNING: at lib/debugobjects.c:262 debug_print_object+0x8e/0xb0()
Hardware name: System Product Name
ODEBUG: free active (active state 0) object type: timer_list hint: hci_cmd_timer+0x0/0x60
Pid: 2125, comm: dmsetup Tainted: G W 2.6.38-06707-gc62b389 #110375
Call Trace:
[<ffffffff8104700a>] warn_slowpath_common+0x7a/0xb0
[<ffffffff810470b6>] warn_slowpath_fmt+0x46/0x50
[<ffffffff812d3a5e>] debug_print_object+0x8e/0xb0
[<ffffffff81bd8810>] ? hci_cmd_timer+0x0/0x60
[<ffffffff812d4685>] debug_check_no_obj_freed+0x125/0x230
[<ffffffff810f1063>] ? check_object+0xb3/0x2b0
[<ffffffff810f3630>] kfree+0x150/0x190
[<ffffffff81be4d06>] ? bt_host_release+0x16/0x20
[<ffffffff81be4d06>] bt_host_release+0x16/0x20
[<ffffffff813a1907>] device_release+0x27/0xa0
[<ffffffff812c519c>] kobject_release+0x4c/0xa0
[<ffffffff812c5150>] ? kobject_release+0x0/0xa0
[<ffffffff812c61f6>] kref_put+0x36/0x70
[<ffffffff812c4d37>] kobject_put+0x27/0x60
[<ffffffff813a21f7>] put_device+0x17/0x20
[<ffffffff81bda4f9>] hci_free_dev+0x29/0x30
[<ffffffff81928be6>] vhci_release+0x36/0x70
[<ffffffff810fb366>] fput+0xd6/0x1f0
[<ffffffff810f8fe6>] filp_close+0x66/0x90
[<ffffffff810f90a9>] sys_close+0x99/0xf0
[<ffffffff81d4c96b>] system_call_fastpath+0x16/0x1b

That timer was introduced with commit 6bd32326cda(Bluetooth: Use
proper timer for hci command timout)

Timer seems to be running when the thing is closed. Removing the timer
unconditionally fixes the problem. And yes, it needs to be fixed
before the HCI_UP check.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
a0cc9a1b5712ea52aaa4e7abfa0ec2dbe0d820ff 24-Mar-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: delete hanging L2CAP channel

Sometimes L2CAP connection remains hanging. Make sure that
L2CAP channel is deleted.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
6994ca5e8ade57d18b7d1e05aad040c441a2ad37 16-Mar-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix missing hci_dev_lock_bh in user_confirm_reply

The code was correctly calling _unlock at the end of the function but
there was no actual _lock call anywhere.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
f630cf0d5434e3923e1b8226ffa2753ead6b0ce5 16-Mar-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix HCI_RESET command synchronization

We can't send new commands before a cmd_complete for the HCI_RESET command
shows up.

Reported-by: Mikko Vinni <mmvinni@yahoo.com>
Reported-by: Justin P. Mattock <justinmattock@gmail.com>
Reported-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Tested-by: Justin P. Mattock <justinmattock@gmail.com>
Tested-by: Mikko Vinni <mmvinni@yahoo.com>
Tested-by: Ed Tomlinson <edt@aei.ca>
ci_core.c
ci_event.c
52cb1c0d208565d8f06b743cdc6596d744f92e3b 09-Mar-2011 Suraj Sumangala <suraj@atheros.com> Bluetooth: Increment unacked_frames count only the first transmit

This patch lets 'l2cap_pinfo.unacked_frames' be incremented only
the first time a frame is transmitted.

Previously it was being incremented for retransmitted packets
too resulting the value to cross the transmit window size.

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
7fd23a24717a327a66f3c32d11a20a2f169c824f 18-Mar-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (48 commits)
HID: add support for Logitech Driving Force Pro wheel
HID: hid-ortek: remove spurious reference
HID: add support for Ortek PKB-1700
HID: roccat-koneplus: vorrect mode of sysfs attr 'sensor'
HID: hid-ntrig: init settle and mode check
HID: merge hid-egalax into hid-multitouch
HID: hid-multitouch: Send events per slot if CONTACTCOUNT is missing
HID: ntrig remove if and drop an indent
HID: ACRUX - activate the device immediately after binding
HID: ntrig: apply NO_INIT_REPORTS quirk
HID: hid-magicmouse: Correct touch orientation direction
HID: ntrig don't dereference unclaimed hidinput
HID: Do not create input devices for feature reports
HID: bt hidp: send Output reports using SET_REPORT on the Control channel
HID: hid-sony.c: Fix sending Output reports to the Sixaxis
HID: add support for Keytouch IEC 60945
HID: Add HID Report Descriptor to sysfs
HID: add IRTOUCH infrared USB to hid_have_special_driver
HID: kernel oops in out_cleanup in function hidinput_connect
HID: Add teletext/color keys - gyration remote - EU version (GYAR3101CKDE)
...
65b06194c9c9f41bc07ac6a6d42edb4b9e43fea4 17-Mar-2011 Jiri Kosina <jkosina@suse.cz> Merge branches 'dragonrise', 'hidraw-feature', 'multitouch', 'ntrig', 'roccat', 'upstream' and 'upstream-fixes' into for-linus
7a6362800cb7d1d618a697a650c7aaed3eb39320 17-Mar-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1480 commits)
bonding: enable netpoll without checking link status
xfrm: Refcount destination entry on xfrm_lookup
net: introduce rx_handler results and logic around that
bonding: get rid of IFF_SLAVE_INACTIVE netdev->priv_flag
bonding: wrap slave state work
net: get rid of multiple bond-related netdevice->priv_flags
bonding: register slave pointer for rx_handler
be2net: Bump up the version number
be2net: Copyright notice change. Update to Emulex instead of ServerEngines
e1000e: fix kconfig for crc32 dependency
netfilter ebtables: fix xt_AUDIT to work with ebtables
xen network backend driver
bonding: Improve syslog message at device creation time
bonding: Call netif_carrier_off after register_netdevice
bonding: Incorrect TX queue offset
net_sched: fix ip_tos2prio
xfrm: fix __xfrm_route_forward()
be2net: Fix UDP packet detected status in RX compl
Phonet: fix aligned-mode pipe socket buffer header reserve
netxen: support for GbE port settings
...

Fix up conflicts in drivers/staging/brcm80211/brcmsmac/wl_mac80211.c
with the staging updates.
e6bee325e49f17c65c1fd66e9e8b348c85788341 16-Mar-2011 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'tty-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6

* 'tty-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: (76 commits)
pch_uart: reference clock on CM-iTC
pch_phub: add new device ML7213
n_gsm: fix UIH control byte : P bit should be 0
n_gsm: add a documentation
serial: msm_serial_hs: Add MSM high speed UART driver
tty_audit: fix tty_audit_add_data live lock on audit disabled
tty: move cd1865.h to drivers/staging/tty/
Staging: tty: fix build with epca.c driver
pcmcia: synclink_cs: fix prototype for mgslpc_ioctl()
Staging: generic_serial: fix double locking bug
nozomi: don't use flush_scheduled_work()
tty/serial: Relax the device_type restriction from of_serial
MAINTAINERS: Update HVC file patterns
tty: phase out of ioctl file pointer for tty3270 as well
tty: forgot to remove ipwireless from drivers/char/pcmcia/Makefile
pch_uart: Fix DMA channel miss-setting issue.
pch_uart: fix exclusive access issue
pch_uart: fix auto flow control miss-setting issue
pch_uart: fix uart clock setting issue
pch_uart : Use dev_xxx not pr_xxx
...

Fix up trivial conflicts in drivers/misc/pch_phub.c (same patch applied
twice, then changes to the same area in one branch)
a177584609f7eb2ab1f1c0211bee4ec20d98d892 04-Mar-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next-2.6
b8534e0f2b09e47790c261af0aee86fc88c6eb3c 01-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix some small code style issues in mgmt.c

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
3cf2a4f6ca4e088ba79d05d6e7f4635c535e6ae4 01-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use variable name instead of type in sizeof()

As written in the CodingStyle doc.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
8ce6284ea350a5249d09c958bdd088ec0eb4f57f 01-Mar-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Remove unused code from get_connections

Command pointer was a leftover after moving controller index to
mgmt_hdr.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
34eb525c1fda689507118a1f2c77fef51832ec8a 28-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Log all parameters in cmd_status for easier debugging

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
8020c16a6c9fc8d6a5217be8d005f2fc558f6ab5 28-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix possible NULL pointer dereference in cmd_complete

It is now possible to create command complete event without specific
reply data by passing NULL as reply with len 0. Check pointer before
calling memcpy to avoid undefined behaviour.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
d45dcef77019012fc6769e657fc2f1a5d681bbbb 26-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix BT_L2CAP and BT_SCO in Kconfig

If we want something "bool" built-in in something "tristate" it can't
"depend on" the tristate config option.

Report by DaveM:

I give it 'y' just to make it happen, for both, and afterways no
matter how many times I rerun "make oldconfig" I keep seeing things
like this in my build:

scripts/kconfig/conf --silentoldconfig Kconfig
include/config/auto.conf:986:warning: symbol value 'm' invalid for BT_SCO
include/config/auto.conf:3156:warning: symbol value 'm' invalid for BT_L2CAP

Reported-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
config
30e7627219f985cd17a1ac24e0163ebcfb1277bf 22-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Use ERR_PTR as return error from hci_connect

Use ERR_PTR mechanism to return error from hci_connect.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
2cap_core.c
gmt.c
co.c
bdce7bafb786701004b2055e15d6ff4b3be678f3 25-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Validate data size before accessing mgmt commands

Crafted (too small) data buffer could result in reading data outside of buffer.
Validate buffer size and return EINVAL if size is wrong.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
4e51eae9cdda4bf096e73a4ebe23f8f96a17596a 25-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Move index to common header in management interface

Most mgmt commands and event are related to hci adapter. Moving index to
common header allow to easily use it in command status while reporting errors.
For those not related to adapter use MGMT_INDEX_NONE (0xFFFF) as index.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
779cb85016587d9ffaea681c38691d5301a3fedc 25-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use proper command structure in remove_uuid

The structure used for command was wrong (probably copy-paste mistake).

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
50899e8d3a1b0655087838374a51ee5b865961b6 22-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove duplicated BT_INFO() from L2CAP

The message for the initialization of the L2CAP layer was being
printed twice.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
0ed54dad52e8056f4440da723a4c117f2aef1f68 21-Feb-2011 Anand Gadiyar <gadiyar@ti.com> Bluetooth: remove unnecessary call to hci_sock_cleanup

hci_sock_cleanup is already called after the sock_err label.
It appears that we can drop this call.

Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
f227e08b71b9c273eaa29a57370a3a5b833aa382 24-Feb-2011 Greg Kroah-Hartman <gregkh@suse.de> Merge 2.6.38-rc6 into tty-next

This was to resolve a merge issue with drivers/char/Makefile and
drivers/tty/serial/68328serial.c

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
b7440a14f28492bac30d7d43fd982fd210c6e971 21-Feb-2011 Anand Gadiyar <gadiyar@ti.com> Bluetooth: fix build break on hci_sock.c

Linux-next as of 20110217 complains when building for OMAP1.

LD vmlinux
`hci_sock_cleanup' referenced in section `.init.text' of net/built-in.o: defined in discarded section `.exit.text' of net/built-in.o
`hci_sock_cleanup' referenced in section `.init.text' of net/built-in.o: defined in discarded section `.exit.text' of net/built-in.o
make: *** [vmlinux] Error 1

A recent patch by Gustavo (Bluetooth: Merge L2CAP and SCO modules
into bluetooth.ko) introduced this by calling the hci_sock_cleanup
function in the error path of bt_init.

Fix this by dropping the __exit marking for hci_sock_cleanup.

Signed-off-by: Anand Gadiyar <gadiyar@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sock.c
97e1efbbe1c8492ea4f804618e26b19325c879fe 20-Feb-2011 Antonio Ospite <ospite@studenti.unina.it> HID: bt hidp: send Output reports using SET_REPORT on the Control channel

The current implementation of hidp_output_raw_report() relies only on
the Control channel even for Output reports, and the BT HID
specification [1] does not mention using the DATA message for Output
reports on the Control channel (see section 7.9.1 and also Figure 11:
SET_ Flow Chart), so let us just use SET_REPORT.

This also fixes sending Output reports to some devices (like Sony
Sixaxis) which are not able to handle DATA messages on the Control
channel.

Ideally hidp_output_raw_report() could be improved to use this scheme:
Feature Report -- SET_REPORT on the Control channel
Output Report -- DATA on the Interrupt channel
for more efficiency, but as said above, right now only the Control
channel is used.

[1] http://www.bluetooth.com/Specification%20Documents/HID_SPEC_V10.pdf

Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
15c4794fe247d85ce38eb5f5e2a5855d996f56cd 21-Feb-2011 Anderson Briglia <anderson.briglia@openbossa.org> Bluetooth: Fix LE conn creation

This patch prevents a crash when remote host tries to create a LE
link which already exists. i.e.: call l2test twice passing the
same parameters.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
a664b5bc77fbc80c163de5606114659d3cbeb043 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix unnecessary list traversal in mgmt_pending_remove

All of the places that need to call mgmt_pending_remove already have a
pointer to the pending command, so searching for the command in the list
doesn't make sense. The added benefit is that many places that
previously had to call list_del + mgmt_pending_free can just call
mgmt_pending_remove now.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
a958355699dd90ba69951bdf55dda00e3e97222c 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix inititial value for remote authentication requirements

The remote authentication requirements for conections need to be
initialized to 0xff (unknown) since it is possible that we receive a IO
Capability Request before we have received information about the remote
requirements.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
2a61169209c72317d4933f8d22f749a6a61a3d36 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add mgmt_auth_failed event

To properly track bonding completion an event to indicate authentication
failure is needed. This event will be sent whenever an authentication
complete HCI event with a non-zero status comes. It will also be sent
when we're acting in acceptor role for SSP authentication in which case
the controller will send a Simple Pairing Complete event.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
ac56fb13c0508181b4227b8ada6d47aaaf72794c 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix mgmt_pin_code_reply return parameters

The command complete event for mgmt_pin_code_reply &
mgmt_pin_code_neg_reply should have the adapter index, Bluetooth address
as well as the status.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
59a24b5d0d4befc2498f51c57905cb02963ff275 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix mgmt_pin_code_reply command status opcode

The opcode for the ENODEV case was wrong (probably copy-paste mistake).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
a5c296832b4fde7d32c01cff9cdd27d9c7c1c4f5 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add management support for user confirmation request

This patch adds support for the user confirmation (numeric comparison)
Secure Simple Pairing authentication method.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add mgmt_pair_device command

This patch adds a new mgmt_pair_device which can be used to initiate a
dedicated bonding procedure. Some extra callbacks are added to the
hci_conn struct so that the pairing code can get notified of the
completion of the procedure.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
366a033698266c304abd6365ea3bcaec36860328 19-Feb-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Make pending_add return a pointer to the added entry

This makes it more convenient to do manipulations on the entry (needed
by later commits).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
b67afe7f43afd2f5cd98798993561920c1684c12 18-Feb-2011 John W. Linville <linville@tuxdriver.com> Merge ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Conflicts:
drivers/bluetooth/ath3k.c
drivers/bluetooth/btusb.c
8ffd878419839638d1aea102455b575da39c1a62 17-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix checkpatch errors in af_bluetooth.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
602f9887cdb14851631416d64ca27b48e2dd1f92 17-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix errors reported by checkpatch.pl

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
e2174ca430ec52375a02ed20859aeceb0d455b72 17-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix errors reported by checkpatch.pl

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6caa76b7786891b42b66a0e61e2c2fff2c884620 14-Feb-2011 Alan Cox <alan@linux.intel.com> tty: now phase out the ioctl file pointer for good

Only oddities here are a couple of drivers that bogusly called the ldisc
helpers instead of returning -ENOIOCTLCMD. Fix the bug and the rest goes
away.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
20b9d17715017ae4dd4ec87fabc36d33b9de708e 14-Feb-2011 Alan Cox <alan@linux.intel.com> tiocmset: kill the file pointer argument

Doing tiocmget was such fun we should do tiocmset as well for the same
reasons

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
60b33c133ca0b7c0b6072c87234b63fee6e80558 14-Feb-2011 Alan Cox <alan@linux.intel.com> tiocmget: kill off the passing of the struct file

We don't actually need this and it causes problems for internal use of
this functionality. Currently there is a single use of the FILE * pointer.
That is the serial core which uses it to check tty_hung_up_p. However if
that is true then IO_ERROR is also already set so the check may be removed.

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
138d22ef14bf00e44de7885cd03f0c3b6ac168f5 17-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix some code style issues in hci_event.c

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
01df8c31d152493ddc58a0bd1719eac6759add87 17-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Fix some code style issues in hci_core.c

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
0786f8b7777721c0d3d5dd691692eaee696e94e1 17-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Clean up hci_sniff_subrate_evt function

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
7235975383785276bdcfc13dd73cc87739cd25d0 17-Feb-2011 Szymon Janc <szymon.janc@tieto.com> Bluetooth: Use #include <linux/uaccess.h> instead of <asm/uaccess.h>

As warned by checkpatch.pl, use #include <linux/uaccess.h> instead of
<asm/uaccess.h>.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
2ce603ebe1f1420c7c5b013638ec29b4fc975180 16-Feb-2011 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Send LE Connection Update Command

If the new connection update parameter are accepted, the LE master
host sends the LE Connection Update Command to its controller informing
the new requested parameters.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
2cap_core.c
6bd32326cdaa9b14794416150c88e4832fb7e592 16-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Use proper timer for hci command timout

Use proper timer instead of hci command flow control to timeout
failed hci commands. Otherwise stack ends up sending commands
when flow control is used to block new commands.

2010-09-01 18:29:41.592132 < HCI Command: Remote Name Request (0x01|0x0019) plen 10
bdaddr 00:16:CF:E1:C7:D7 mode 2 clkoffset 0x0000
2010-09-01 18:29:41.592681 > HCI Event: Command Status (0x0f) plen 4
Remote Name Request (0x01|0x0019) status 0x00 ncmd 0
2010-09-01 18:29:51.022033 < HCI Command: Remote Name Request Cancel (0x01|0x001a) plen 6
bdaddr 00:16:CF:E1:C7:D7

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
c6f3c5f7f2938d2809bcc15889e9aa212038a554 16-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix crash when ioctl(HCIUARTSETPROTO) fails

If the fail happens the HCI del_timer may timeout after the the hci dev
unregister. This lead to a kernel crash.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
de73115a7d67e1b81dbde2285a7657f3e3867703 11-Feb-2011 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Add connection parameter update response

Implements L2CAP Connection Parameter Update Response defined in
the Bluetooth Core Specification, Volume 3, Part A, section 4.21.
Address the LE Connection Parameter Procedure initiated by the slave.

Connection Interval Minimum and Maximum have the same range: 6 to
3200. Time = N * 1.25ms. Minimum shall be less or equal to Maximum.
The Slave Latency field shall have a value in the range of 0 to
((connSupervisionTimeout / connIntervalMax) - 1). Latency field shall
be less than 500. connSupervisionTimeout = Timeout Multiplier * 10 ms.
Multiplier field shall have a value in the range of 10 to 3200.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
3300d9a930a79508032e3e03ac2bde3a22dd048d 11-Feb-2011 Claudio Takahasi <claudio.takahasi@openbossa.org> Bluetooth: Add LE signaling commands handling

This patch splits the L2CAP command handling function in order to
have a clear separation between the commands related to BR/EDR and
LE. Commands and responses in the LE signaling channel are not being
handled yet, command reject is sent to all received requests. Bluetooth
Core Specification, Volume 3, Part A, section 4 defines the signaling
packets formats and allowed commands/responses over the LE signaling
channel.

Signed-off-by: Claudio Takahasi <claudio.takahasi@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
bae1f5d9464d231148301fcbf4e425a096a5b96d 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Treat LE and ACL links separately on timeout

Separate LE and ACL timeouts. Othervise ACL connections
on non LE hw will time out after 45 secs.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
b92a62238ff2d3fb88cf0f6de454f3d1b4ae5d52 11-Feb-2011 Vinicius Costa Gomes <vinicius.gomes@openbossa.org> Bluetooth: Fix initiated LE connections

Fix LE connections not being marked as master.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
5589fa9c2d2b8c134f44db36892ccc500aac3147 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Do not send disconn comand over LE links

l2cap over LE links can be disconnected without sending
disconnect command first.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
b62f328b8f20abe97cdbaaf44c6e4f5e7a610f18 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Add server socket support for LE connection

Add support for LE server sockets.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
2cap_core.c
2cap_sock.c
acd7d3708555b3da7522e23c183cc21efc785f72 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Add LE connection support to L2CAP

Add basic LE connection support to L2CAP. LE
connection can be created by specifying cid
in struct sockaddr_l2

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6ed58ec520ad2b2fe3f955c8a5fd0eecafccebdf 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Use LE buffers for LE traffic

Bluetooth chips may have separate buffers for LE traffic.
This patch add support to use LE buffers provided by the chip.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
ci_event.c
fcd89c09a59a054fb986861e0862aa2fff7d7c40 11-Feb-2011 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Add LE connect support

Bluetooth V4.0 adds support for Low Energy (LE) connections.
Specification introduces new set of hci commands to control LE
connection. This patch adds logic to create, cancel and disconnect
LE connections.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
840af824b2bf9194ea596e0ddc7aa05066794ca1 14-Feb-2011 Vladislav P <vladisslav@inbox.ru> Bluetooth: Release BTM while sleeping to avoid deadlock

Signed-off-by: Vladislav P <vladisslav@inbox.ru>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/tty.c
903d343e202e51059e7d20524010ef54a6087aed 10-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add L2CAP mode to debugfs output

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
c531a12ae63b6438a7859994aca23859f5706010 07-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: remove l2cap_load() hack

l2cap_load() was added to trigger l2cap.ko module loading from the RFCOMM
and BNEP modules. Now that L2CAP module is gone, we don't need it anymore.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
mtp/core.c
idp/core.c
2cap_core.c
fcomm/core.c
642745184f82688eb3ef0cdfaa4ba632055be9af 07-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Merge L2CAP and SCO modules into bluetooth.ko

Actually doesn't make sense have these modules built separately.
The L2CAP layer is needed by almost all Bluetooth protocols and profiles.
There isn't any real use case without having L2CAP loaded.
SCO is only essential for Audio transfers, but it is so small that we can
have it loaded always in bluetooth.ko without problems.
If you really doesn't want it you can disable SCO in the kernel config.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
config
akefile
f_bluetooth.c
2cap_core.c
co.c
c4c896e1471aec3b004a693c689f60be3b17ac86 14-Feb-2011 Vasiliy Kulikov <segoon@openwall.com> Bluetooth: sco: fix information leak to userspace

struct sco_conninfo has one padding byte in the end. Local variable
cinfo of type sco_conninfo is copied to userspace with this uninizialized
one byte, leading to old stack contents leak.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
43629f8f5ea32a998d06d1bb41eefa0e821ff573 14-Feb-2011 Vasiliy Kulikov <segoon@openwall.com> Bluetooth: bnep: fix buffer overflow

Struct ca is copied from userspace. It is not checked whether the "device"
field is NULL terminated. This potentially leads to BUG() inside of
alloc_netdev_mqs() and/or information leak by creating a device with a name
made of contents of kernel stack.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/sock.c
e3fb592b15602196d38b225dc78aab8d631a5f89 10-Feb-2011 Vasiliy Kulikov <segoon@openwall.com> Bluetooth: l2cap: fix 1 byte infoleak to userspace

Structure l2cap_options has one padding byte between max_tx and
txwin_size fields. This byte in "opts" is copied to userspace
uninitialized.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_sock.c
0ff1731a1ae51e8e48cd559d70db536281c47f8e 18-Jan-2011 Alan Ott <alan@signal11.us> HID: bt: Add support for hidraw HIDIOCGFEATURE and HIDIOCSFEATURE

This patch adds support or getting and setting feature reports for bluetooth
HID devices from HIDRAW.

Signed-off-by: Alan Ott <alan@signal11.us>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
0825411ade21a39ac63b3e011d092b1f95b5f3f5 18-Jan-2011 Alan Ott <alan@signal11.us> HID: bt: Wait for ACK on Sent Reports

Wait for an ACK from the device before returning from
hidp_output_raw_report(). This way, failures can be returned to the user
application. Also, it prevents ACK/NAK packets from an output packet from
being confused with ACK/NAK packets from an input request packet.

Signed-off-by: Alan Ott <alan@signal11.us>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
0f69dca20f77dc374b67e17e10b30cec37e778c4 18-Jan-2011 Alan Ott <alan@signal11.us> HID: bt: Move hid_add_device() call to after hidp_session() has started.

Move the call to hid_add_device() (which calls a device's probe() function)
to after the kernel_thread() call which starts the hidp_session() thread.
This ensures the Bluetooth receive socket is fully running by the time a
device's probe() function is called. This way, a device can communicate
(send and receive) with the Bluetooth device from its probe() function.

Signed-off-by: Alan Ott <alan@signal11.us>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
a0019bca04029d25a8bbbaaaf28487e6ccd7878e 07-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: update Bluetooth daemon name in Kconfig help

Change hcid to bluetoothd.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
config
6de0702b5b93da0ef097aa092b4597fbc024ebba 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move __l2cap_sock_close() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
05fc1576dabb1defae3c8c0371fb9d21f7db997a 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_kill() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6ddc0485e1a6ecd450140ea40ffa52786f99183c 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move L2CAP sock timers function to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
fd83ccdb393e3190633e0240dd73faac8998164b 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_sendmsg() to l2cap_sock.c

Also moves some L2CAP sending functions declaration to l2cap.h

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
dcba0dba54b566a08376f93cab35cdabd6abda20 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_shutdown() to l2cap_sock.c

Declare __l2cap_wait_ack() and l2cap_sock_clear_timer() in l2cap.h

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
6898325923f9571fbede3372dc490faa43b3258a 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_recvmsg() to l2cap_sock.c

It causes the move of the declaration of 3 functions to l2cap.h:
l2cap_get_ident(), l2cap_send_cmd(), l2cap_build_conf_req()

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
4e34c50bfe5ba87da1622cc7c6ed10712da255ad 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_connect() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
99f4808db0c052f3c92a689ec2841618bf2ce14a 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_getsockopt() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
33575df7be6748292f88453f29319af6d639c5c8 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
d7175d55255cb0a576844bc6e986000e0d7f8e9d 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_getname() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
c47b7c724bc7106acf602b2ce99922a2d14ea62b 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_accept() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
af6bcd8205ac06fa1de98b2b28303157fb9c3dfc 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_bind()/listen() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
554f05bb8a0707dcc0ba4ea1dba1fb9970846ab5 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_release() to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
65390587c7bcf8bb60b48387db766d8d7dfea982 04-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: move l2cap_sock_ops to l2cap_sock.c

First step to move all l2cap_sock_ops function to l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap_core.c
2cap_sock.c
bb58f747e519aba07a6f05a78d58cf8a0788e2d5 03-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Initial work for L2CAP split.

This patch tries to do the minimal to move l2cap_sock_create() and its
dependencies to l2cap_sock.c. It create a API to initialize and cleanup
the L2CAP sockets from l2cap_core.c through l2cap_init_sockets() and
l2cap_cleanup_sockets().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
akefile
2cap_core.c
2cap_sock.c
0a708f8fc46fde3be2116b8d79f7469a24097c90 03-Feb-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Rename l2cap.c to l2cap_core.c

In a preparation to the the L2CAP code split in many files.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
akefile
2cap.c
2cap_core.c
d37f50e19094862a5d60d79637d6f4dbdc42f4f1 24-Jan-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: fix crash by disabling tasklet in sock accept

Crash can happen when tasklet handling connect/disconnect requests
preempts socket accept. Can be reproduced with "l2test -r" on one
side and several "l2test -c -b 1000 -i hci0 -P 10 <bdaddr>" on the
other side.

disable taskets in socket accept and change lock_sock and release_sock
to bh_lock_sock and bh_unlock_sock since we have to use spinlocks and
there is no need to mark sock as owned by user.

...
[ 3555.897247] Unable to handle kernel NULL pointer dereference at virtual
address 000000bc
[ 3555.915039] pgd = cab9c000
[ 3555.917785] [000000bc] *pgd=8bf3d031, *pte=00000000, *ppte=00000000
[ 3555.928314] Internal error: Oops: 17 [#1] PREEMPT
[ 3555.999786] CPU: 0 Not tainted (2.6.32.21-13874-g67918ef #65)
...
[ 3556.005981] PC is at bt_accept_unlink+0x20/0x58 [bluetooth]
[ 3556.011627] LR is at bt_accept_dequeue+0x3c/0xe8 [bluetooth]
...
[ 3556.161285] [<bf0007fc>] (bt_accept_unlink+0x20/0x58 [bluetooth]) from
[<bf000870>] (bt_accept_dequeue+0x3c/0xe8 [bluetooth])
[ 3556.172729] [<bf000870>] (bt_accept_dequeue+0x3c/0xe8 [bluetooth]) from
[<bf324df8>] (l2cap_sock_accept+0x100/0x15c [l2cap])
[ 3556.184082] [<bf324df8>] (l2cap_sock_accept+0x100/0x15c [l2cap]) from
[<c026a0a8>] (sys_accept4+0x120/0x1e0)
[ 3556.193969] [<c026a0a8>] (sys_accept4+0x120/0x1e0) from [<c002c9a0>]
(ret_fast_syscall+0x0/0x2c)
[ 3556.202819] Code: e5813000 e5901164 e580c160 e580c15c (e1d13bbc)
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
5a08eccedaa1e12b74cf3afea9e11a9aefc29f73 11-Jan-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Do not use assignments in IF conditions

Fix checkpatch warnings concerning assignments in if conditions.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
mtp/capi.c
mtp/core.c
ci_core.c
ci_event.c
idp/core.c
2cap.c
17fa4b9dff72fb3a1a68cc80caf98fc941d2b8b3 25-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add set_io_capability management command

This patch adds a new set_io_capability management command which is used
to set the IO capability for Secure Simple Pairing (SSP) as well as the
Security Manager Protocol (SMP). The value is per hci_dev and each
hci_conn object inherits it upon creation.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
ci_event.c
gmt.c
980e1a537fed7dfa53e9a4b6e586b43341f8c2d5 22-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add support for PIN code handling in the management interface

This patch adds the necessary commands and events needed to communicate
PIN code related actions between the kernel and userspace. This includes
a pin_code_request event as well as pin_code_reply and
pin_code_negative_reply commands.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
a38528f1117590169c0bf61cbf874e9fd2d5c5c9 22-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Create common cmd_complete function for mgmt.c

A lot of management code needs to generate command complete events so it
makes sense to have a helper function for this.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
2784eb41b1fbb3ff80f4921fe9dbb4c4acb6dc24 21-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add get_connections managment interface command

This patch adds a get_connections command to the management interface.
With this command userspace can get the current list of connected
devices. Typically this command would only be used once when enumerating
existing adapters. After that the connected and disconnected events are
used to track connections.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
17d5c04cb597418a177c3ca18dfde679636dd51c 22-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add support for connect failed management event

This patch add a new connect failed management event to track failures
in connecting to remote devices. It is particularly useful for security
mode 3 scenarios when we don't have a connected state while pairing but
still need to detect when the connect attempt failed.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
8962ee74be48df16027100f657b2b12e8ef3d34d 19-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add disconnect managment command

This patch adds a disconnect command to the managment interface. Using
this command user space is able to force the disconnection of connected
devices. The command maps directly to the Disconnect HCI command.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
f7520543ab40341edbc2aeee7fef68218be19a0a 19-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add connected/disconnected management events

This patch adds connected and disconnected managment events to track the
connection status to remote devices. The events map directly to
successful connection complete and disconnection complete HCI events for
ACL links.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
55ed8ca10f3530de8edbbf138acb50992bf5005b 17-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement link key handling for the management interface

This patch adds a management commands to feed the kernel with all stored
link keys as well as remove specific ones or all of them. Once the
load_keys command has been called the kernel takes over link key
replies. A new_key event is also added to inform userspace of newly
created link keys that should be stored permanently.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
gmt.c
1aff6f09491f454d4cd9f405c783fa5e9d3168a0 13-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add class of device control to the management interface

This patch adds the possibility for user space to fully control the
Class of Device value of local adapters. To control the service class
bits each UUID that's added comes with a service class "hint" which acts
as a mask of bits that the UUID needs to have enabled. The
set_service_cache management command is used to make sure we queue up
all UUID changes as user space initializes its drivers and then send a
single HCI_Write_Class_of_Device command when initialization is
complete.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
d5859e22cd40b73164b3e5d8d5d796f96edcc6af 25-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement a more complete adapter initialization sequence

Using the managment interface means that user space doesn't need to do
any HCI command sending at all. This patch moves the remaining
initialization commands from user space to the kernel side. The patch
makes use of the new feature of __hci_request which allows the request
to be dynamically modified while it is ongoing (something that is needed
to react appropriately to the local features and the version of the
adapter).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
d83506003608910d24d5ace9ec06ad1bfd9ad110 10-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Remove page timeout setting from HCI init sequence

User space should set the page timeout so there's no need to explicitly
set it in the HCI init sequence. Even if user space fails to set it the
controller default value will be used.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
b0916ea0d9e6ea3ed46bb7a61c13a2b357b0248b 10-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add controller side link key clearing to hci_init_req

The controller may have link keys in its own memory and these keys could
be used for secure connections. However, since the interface to access
these keys doesn't provide information about the key types (which would
be needed to infer the level of security each key provides) using these
keys is rather useless. Therefore, simply clear the controller side list
in the initialization procedure.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
a5040efa2017f3e4f1b4d5f40fd989567f3994c1 10-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add special handling with __hci_request and HCI_INIT

To support a more dynamic HCI initialization sequence the __hci_request
behavior requires some more changes. Particularly, the init sequence
should be able to have conditionals in it (sending some HCI commands
depending on the outcome of a previous command) instead of being a fixed
list as it is right now.

The reasons for these additional requirements are the moving all
previously user space driven initialization commands to the kernel side
as well as the support the Low Energy controllers.

To fulfull these requirements the init sequence is made the only special
case for multi-command requests and req_last_cmd is renamed to
init_last_cmd. The hci_send_cmd function is changed to update
init_last_cmd as long as the HCI_INIT flag is set.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
03b555e119de8288a16e086e1fbd223d9b429d3d 04-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Reject pairing requests when in non-pairable mode

This patch adds the necessary logic to act accordingly when the
HCI_PAIRABLE flag is not set. In that case PIN code replies as well as
Secure Simple Pairing requests without a NoBonding requirement need to
be rejected.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
930e13363fb0e94db6e8b59c54dfb5c59355113e 04-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement debugfs support for listing UUIDs

This patch adds a debugfs entry to list the UUIDs that have been
registered through the management interface.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
2aeb9a1ae0e34fb46cb78b82f827a6a54ab65111 03-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement UUID handling through the management interface

This patch adds methods to the management interface for userspace to
notify the kernel of which services have been registered for specific
adapters. This information is needed for setting the appropriate Class
of Device value as well as the Extended Inquiry Response value. This
patch doesn't actually implement setting of these values but just
provides the storage of the UUIDs so the needed functionality can be
built on top of it.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
c542a06c29acbf4ea0024884a198065a10613147 26-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement set_pairable managment command

This patch implements a new set_pairable management command to control
the pairable state of local adapters. The state is represented using a
new HCI_PAIRABLE flag in the hci_dev struct.

For backwards compatibility with older user space versions the
HCI_PAIRABLE flag gets automatically set when the existence of an
adapter is reported to user space through legacy methods and the
HCI_MGMT flag is not set.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
053f0211d3b1a991f06a7b4aec5b762e42d7c6a4 26-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add send_mode_rsp convenience function for mgmt.c

Several management commands have similar responses but they are not
always sent asynchronously. To enable synchronous sending (from the
managment command handler function) a send_mode_rsp function is added.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
ebc99feba7378349e2bfae7018af062767382f6c 04-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add flag to track managment controlled adapters

This patch adds a HCI_MGMT flag to track adapters which are under the
control of the management interface. This is needed to make sure that
new kernels will work with old user space versions. I.e. behaviour which
could break old user space versions (but is needed by the management
interface) should not be exhibited when the HCI_MGMT flag is not set.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
72a734ec1aca8cd2ef3fc85428c11bde662e149e 29-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Unify mode related management messages to a single struct

The powered, connectable and discoverable messages all have the same
format. By using a single struct for all of them a lot of code can be
simplified and reused.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
9fbcbb455dd01abfad4f314b618ac51d566114cb 29-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add set_connectable management command

This patch adds a set_connectable command as well as a corresponding
event to the management interface. It's mainly useful for setting an
adapter as connectable from a non-initialized state as well as setting
an already initialized adapter as non-connectable (mostly useful for
qualification purposes).

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
73f22f62388795c0f6b4f3f97bda7a64f9681aac 29-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add support for set_discoverable management command

This patch adds a set_discoverable command to the management interface
as well as the corresponding event. The command is used to control the
discoverable state of adapters.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
gmt.c
eec8d2bcc841ae44edcde9660ff21144a2016053 16-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add support for set_powered management command

This patch adds a set_powered command to the management interface
through which the powered state of local adapters can be controlled.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
ci_sock.c
gmt.c
5add6af8fcbce269cac2457584c0ebfda055474a 16-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add support for management powered event

This patch adds support for the powered event that's used to indicate to
userspace when the powered state of a local adapter changes.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
ab81cbf99c881ca2b9a83682a8722fc84b2483d2 15-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Implement automatic setup procedure for local adapters

This patch implements automatic initialization of basic information
about newly registered Bluetooth adapters. E.g. the address and features
are always needed so it makes sense for the kernel to automatically
power on adapters and read this information. A new HCI_SETUP flag is
added to track this state.

In order to not consume unnecessary amounts of power if there isn't a
user space available that could switch the adapter back off, a timer is
added to do this automatically as long as no Bluetooth user space seems
to be present. A new HCI_AUTO_OFF flag is added that user space needs to
clear to avoid the automatic power off.

Additionally, the management interface index_added event is moved to the
end of the HCI_SETUP stage so a user space supporting the managment
inteface has all the necessary information available for fetching when
it gets notified of a new adapter. The HCI_DEV_REG event is kept in the
same place as before since existing HCI raw socket based user space
versions depend on seeing the kernels initialization sequence
(hci_init_req) to determine when the adapter is ready for use.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
7990681c409e8a31eac122342e64da6c3b77a249 24-Jan-2011 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix setting of MTU for ERTM and Streaming Mode

The desired MTU should be sent in an Config_Req for all modes.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
e702112ff68a554bcac16bb03ddc2b8e5425bcbf 03-Jan-2011 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Use non-flushable by default L2CAP data packets

Modification of Nick Pelly <npelly@google.com> patch.

With Bluetooth 2.1 ACL packets can be flushable or non-flushable. This commit
makes ACL data packets non-flushable by default on compatible chipsets, and
adds the BT_FLUSHABLE socket option to explicitly request flushable ACL
data packets for a given L2CAP socket. This is useful for A2DP data which can
be safely discarded if it can not be delivered within a short time (while
other ACL data should not be discarded).

Note that making ACL data flushable has no effect unless the automatic flush
timeout for that ACL link is changed from its default of 0 (infinite).

Default packet types (for compatible chipsets):
Frame 34: 13 bytes on wire (104 bits), 13 bytes captured (104 bits)
Bluetooth HCI H4
Bluetooth HCI ACL Packet
.... 0000 0000 0010 = Connection Handle: 0x0002
..00 .... .... .... = PB Flag: First Non-automatically Flushable Packet (0)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 8
Bluetooth L2CAP Packet

After setting BT_FLUSHABLE
(sock.setsockopt(274 /*SOL_BLUETOOTH*/, 8 /* BT_FLUSHABLE */, 1 /* flush */))
Frame 34: 13 bytes on wire (104 bits), 13 bytes captured (104 bits)
Bluetooth HCI H4
Bluetooth HCI ACL Packet
.... 0000 0000 0010 = Connection Handle: 0x0002
..10 .... .... .... = PB Flag: First Automatically Flushable Packet (2)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 8
Bluetooth L2CAP Packet

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
2cap.c
b2c60d42db0fea1e6c4345739601024863566a13 14-Jan-2011 Jesper Juhl <jj@chaosbits.net> Bluetooth: Fix failure to release lock in read_index_list()

If alloc_skb() fails in read_index_list() we'll return -ENOMEM without
releasing 'hci_dev_list_lock'.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e733fb62082b3b187870dfba28d5f6730b8436c4 29-Jan-2011 Bao Liang <tim.bao@gmail.com> Bluetooth: Set conn state to BT_DISCONN to avoid multiple responses

This patch fixes a minor issue that two connection responses will be sent
for one L2CAP connection request. If the L2CAP connection request is first
blocked due to security reason and responded with reason "security block",
the state of the connection remains BT_CONNECT2. If a pairing procedure
completes successfully before the ACL connection is down, local host will
send another connection complete response. See the following packets
captured by hcidump.

2010-12-07 22:21:24.928096 < ACL data: handle 12 flags 0x00 dlen 16
0000: 0c 00 01 00 03 19 08 00 41 00 53 00 03 00 00 00 ........A.S.....
... ...

2010-12-07 22:21:35.791747 > HCI Event: Auth Complete (0x06) plen 3
status 0x00 handle 12
... ...

2010-12-07 22:21:35.872372 > ACL data: handle 12 flags 0x02 dlen 16
L2CAP(s): Connect rsp: dcid 0x0054 scid 0x0040 result 0 status 0
Connection successful

Signed-off-by: Liang Bao <tim.bao@gmail.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
765c2a964b49bd06b61a52991519281c85d82b67 18-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix race condition with conn->sec_level

The conn->sec_level value is supposed to represent the current level of
security that the connection has. However, by assigning to it before
requesting authentication it will have the wrong value during the
authentication procedure. To fix this a pending_sec_level variable is
added which is used to track the desired security level while making
sure that sec_level always represents the current level of security.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_event.c
d00ef24fc2923b65fdd440dc6445903e965841ac 18-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix authentication request for L2CAP raw sockets

When there is an existing connection l2cap_check_security needs to be
called to ensure that the security level of the new socket is fulfilled.
Normally l2cap_do_start takes care of this, but that function doesn't
get called for SOCK_RAW type sockets. This patch adds the necessary
l2cap_check_security call to the appropriate branch in l2cap_do_connect.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
8556edd32f01c50a3c99e44dc2c3b1252ea59605 18-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Create a unified auth_type evaluation function

The logic for determining the needed auth_type for an L2CAP socket is
rather complicated and has so far been duplicated in
l2cap_check_security as well as l2cap_do_connect. Additionally the
l2cap_check_security code was completely missing the handling of
SOCK_RAW type sockets. This patch creates a unified function for the
evaluation and makes l2cap_do_connect and l2cap_check_security use that
function.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
65cf686ee102b7eb0477a4bab82ff227071a0258 18-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix MITM protection requirement preservation

If an existing connection has a MITM protection requirement (the first
bit of the auth_type) then that requirement should not be cleared by new
sockets that reuse the ACL but don't have that requirement.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
88644bb9fee591b2743a881923263bc28df4cded 18-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Revert "Bluetooth: Update sec_level/auth_type for already existing connections"

This reverts commit 045309820afe047920a50de25634dab46a1e851d. That
commit is wrong for two reasons:

- The conn->sec_level shouldn't be updated without performing
authentication first (as it's supposed to represent the level of
security that the existing connection has)

- A higher auth_type value doesn't mean "more secure" like the commit
seems to assume. E.g. dedicated bonding with MITM protection is 0x03
whereas general bonding without MITM protection is 0x04. hci_conn_auth
already takes care of updating conn->auth_type so hci_connect doesn't
need to do it.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
683d949a7fbf33c244670e34d35c460e0d6558cb 05-Jan-2011 Lukáš Turek <8an@praha12.net> Bluetooth: Never deallocate a session when some DLC points to it

Fix a bug introduced in commit 9cf5b0ea3a7f1432c61029f7aaf4b8b338628884:
function rfcomm_recv_ua calls rfcomm_session_put without checking that
the session is not referenced by some DLC. If the session is freed, that
DLC would refer to deallocated memory, causing an oops later, as shown
in this bug report: https://bugzilla.kernel.org/show_bug.cgi?id=15994

Signed-off-by: Lukas Turek <8an@praha12.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
e2e0cacbd4b0c7c69c7591d37c243f2363aeaa71 03-Jan-2011 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix leaking blacklist when unregistering a hci device

The blacklist should be freed before the hci device gets unregistered.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
4571928fc73589e9c5217cd069d2c0b4ff1818a8 14-Jan-2011 David Sterba <dsterba@suse.cz> Bluetooth: l2cap: fix misuse of logical operation in place of bitop

CC: Marcel Holtmann <marcel@holtmann.org>
CC: "Gustavo F. Padovan" <padovan@profusion.mobi>
CC: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
782a9e31e81956a271375c0ba8d46fbb0480983e 04-Jan-2011 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-next-2.6
17f9cc3124c97f50a19a7597e5f29f915b5b835c 23-Dec-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Improve handling of HCI control channel in bind

Does not allow any channel different of HCI_CHANNEL_RAW and
HCI_CHANNEL_CONTROL to bind.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sock.c
23bb57633df97ede067ea26f3cdc8a7ba2cd8109 21-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix __hci_request synchronization for hci_open_dev

The initialization function used by hci_open_dev (hci_init_req) sends
many different HCI commands. The __hci_request function should only
return when all of these commands have completed (or a timeout occurs).
Several of these commands cause hci_req_complete to be called which
causes __hci_request to return prematurely.

This patch fixes the issue by adding a new hdev->req_last_cmd variable
which is set during the initialization procedure. The hci_req_complete
function will no longer mark the request as complete until the command
matching hdev->req_last_cmd completes.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
ci_event.c
c71e97bfaadfa727669fcfcf12301744fd169091 13-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add management events for controller addition & removal

This patch adds Bluetooth Management interface events for controller
addition and removal. The events correspond to the existing HCI_DEV_REG
and HCI_DEV_UNREG stack internal events.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
gmt.c
f7b64e69c7c75c8e9f2d5e23edec8de1ce883bcc 13-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add read_info management command

This patch implements the read_info command which is used to fetch basic
info about an adapter.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
faba42eb2a8cf905ed26d540c3c93d429e327224 13-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add read_index_list management command

This patch implements the read_index_list command through which
userspace can get a list of current adapter indices.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
02d981292ad3149e8e5f37cffbccedab1a8576d8 13-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add read_version management command

This patch implements the initial read_version command that userspace
will use before any other management interface operations.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
e41d8b4e131a41f2a3b74aaa783b16aa46376d8e 13-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add error handling for managment command handlers

The command handlers for bluetooth management messaging should be able
to report errors (such as memory allocation failures) to the higher
levels in the call stack.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
gmt.c
1fcfe76a760e78d7774a254608557c84071b0cfb 15-Dec-2010 John W. Linville <linville@tuxdriver.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Conflicts:
drivers/net/wireless/iwlwifi/iwl-1000.c
drivers/net/wireless/iwlwifi/iwl-6000.c
drivers/net/wireless/iwlwifi/iwl-core.h
a40c406cbdd28dcca3483065bc2ba794cf5aaab7 07-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Make hci_send_to_sock usable for management control sockets

In order to send data to management control sockets the function should:

- skip checks intended for raw HCI data and stack internal events
- make sure RAW HCI data or stack internal events don't go to
management control sockets

In order to accomplish this the patch adds a new member to the bluetooth
skb private data to flag skb's that are destined for management control
sockets.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sock.c
0381101fd6a73c7d6b545044dc1472d019fc64e3 07-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add initial Bluetooth Management interface callbacks

Add initial code for handling Bluetooth Management interface messages.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
akefile
ci_sock.c
gmt.c
ff2109f5f94ff75f45e0c8d2d1d56fefdf20733f 21-Nov-2010 Tracey Dent <tdent48227@gmail.com> Net: bluetooth: Makefile: Remove deprecated kbuild goal definitions

Changed Makefile to use <modules>-y instead of <modules>-objs
because -objs is deprecated and not mentioned in
Documentation/kbuild/makefiles.txt.

Signed-off-by: Tracey Dent <tdent48227@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
akefile
183f732c3f3f307d5673e17b69de6894e1dd2918 06-Dec-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix initial RFCOMM DLC security level

Due to commit 63ce0900 connections initiated through TTYs created with
"rfcomm bind ..." would have security level BT_SECURITY_SDP instead of
BT_SECURITY_LOW. This would cause instant connection failure between any
two SSP capable devices due to the L2CAP connect request to RFCOMM being
sent before authentication has been performed. This patch fixes the
regression by always initializing the DLC security level to
BT_SECURITY_LOW.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
df6bd743b6f06b066c1c3ba7f2853a6e8d61468c 14-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't accept ConfigReq if we aren't in the BT_CONFIG state

If such event happens we shall reply with a Command Reject, because we are
not expecting any configure request.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
70f23020e6d89155504b5b39f22505f4aec6fa6f 01-Dec-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: clean up hci code

Do not use assignment in IF condition, remove extra spaces,
fixing typos, simplify code.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
894718a6be69d8cfd191dc291b42be32a1e4851b 01-Dec-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: clean up l2cap code

Do not initialize static vars to zero, macros with complex values
shall be enclosed with (), remove unneeded braces.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
285b4e90318dcf421a00b2ac3fe8ab713f3281e3 01-Dec-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: clean up rfcomm code

Remove extra spaces, assignments in if statement, zeroing static
variables, extra braces. Fix includes.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
735cbc4784a084b7a76c43c69f9dba683bb3b48b 01-Dec-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: clean up sco code

Do not use assignments in IF condition, remove extra spaces

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
b78d7b4f204a6ba1901af36c95e10fded9816054 29-Nov-2010 Anderson Lizardo <anderson.lizardo@openbossa.org> Bluetooth: Fix error handling for l2cap_init()

create_singlethread_workqueue() may fail with errors such as -ENOMEM. If
this happens, the return value is not set to a negative value and the
module load will succeed. It will then crash on module unload because of
a destroy_workqueue() call on a NULL pointer.

Additionally, the _busy_wq workqueue is not being destroyed if any
errors happen on l2cap_init().

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
eeb366564be7c311b31c70821d18a43a8a57f9bc 01-Nov-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Get rid of __rfcomm_get_sock_by_channel()

rfcomm_get_sock_by_channel() was the only user of this function, so I merged
both into rfcomm_get_sock_by_channel(). The socket lock now should be hold
outside of rfcomm_get_sock_by_channel() once we hold and release it inside the
same function now.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
e0f0cb56364958223f0cb1f1b0b0eecf1b8dcb95 01-Nov-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Get rid of __l2cap_get_sock_by_psm()

l2cap_get_sock_by_psm() was the only user of this function, so I merged
both into l2cap_get_sock_by_psm(). The socket lock now should be hold
outside of l2cap_get_sock_by_psm() once we hold and release it inside the
same function now.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
cc11b9c14da4ca1c545b424dae2ae8fb1ab04063 22-Nov-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: do not use assignment in if condition

Fix checkpatch errors like:
"ERROR: do not use assignment in if condition"
Simplify code and fix one long line.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
940a9eea80946b64b96bd8af1fc71b30c602d057 02-Nov-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: timer check sk is not owned before freeing

In timer context we might delete l2cap channel used by krfcommd.
The check makes sure that sk is not owned. If sk is owned we
restart timer for HZ/5.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
a49184c229535ebedbb659214db2d4d1d77b7c07 02-Nov-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Check sk is not owned before freeing l2cap_conn

Check that socket sk is not locked in user process before removing
l2cap connection handler.

lock_sock and release_sock do not hold a normal spinlock directly but
instead hold the owner field. This means bh_lock_sock can still execute
even if the socket is "locked". More info can be found here:
http://www.linuxfoundation.org/collaborate/workgroups/networking/socketlocks

krfcommd kernel thread may be preempted with l2cap tasklet which remove
l2cap_conn structure. If krfcommd is in process of sending of RFCOMM reply
(like "RFCOMM UA" reply to "RFCOMM DISC") then kernel crash happens.

...
[ 694.175933] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 694.184936] pgd = c0004000
[ 694.187683] [00000000] *pgd=00000000
[ 694.191711] Internal error: Oops: 5 [#1] PREEMPT
[ 694.196350] last sysfs file: /sys/devices/platform/hci_h4p/firmware/hci_h4p/loading
[ 694.260375] CPU: 0 Not tainted (2.6.32.10 #1)
[ 694.265106] PC is at l2cap_sock_sendmsg+0x43c/0x73c [l2cap]
[ 694.270721] LR is at 0xd7017303
...
[ 694.525085] Backtrace:
[ 694.527587] [<bf266be0>] (l2cap_sock_sendmsg+0x0/0x73c [l2cap]) from [<c02f2cc8>] (sock_sendmsg+0xb8/0xd8)
[ 694.537292] [<c02f2c10>] (sock_sendmsg+0x0/0xd8) from [<c02f3044>] (kernel_sendmsg+0x48/0x80)

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
d31dbf6e5989b2fd9a30ec5b25436e94f009d6df 30-Oct-2010 Vasiliy Kulikov <segooon@gmail.com> Bluetooth: hidp: fix information leak to userland

Structure hidp_conninfo is copied to userland with version, product,
vendor and name fields unitialized if both session->input and session->hid
are NULL. It leads to leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/core.c
3185fbd9d7bb166992f072440b3329f58bf2c60a 30-Oct-2010 Vasiliy Kulikov <segooon@gmail.com> Bluetooth: cmtp: fix information leak to userland

Structure cmtp_conninfo is copied to userland with some padding fields
unitialized. It leads to leaking of contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
5520d20f68310fc158dcbbecfd5eac5cdfc5a241 30-Oct-2010 Vasiliy Kulikov <segooon@gmail.com> Bluetooth: bnep: fix information leak to userland

Structure bnep_conninfo is copied to userland with the field "device"
that has the last elements unitialized. It leads to leaking of
contents of kernel stack memory.

Signed-off-by: Vasiliy Kulikov <segooon@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
nep/core.c
127178d24c7eb2df53b1ba2b6f6f743e88178a1b 18-Nov-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Automate remote name requests

In Bluetooth there are no automatic updates of remote device names when
they get changed on the remote side. Instead, it is a good idea to do a
manual name request when a new connection gets created (for whatever
reason) since at this point it is very cheap (no costly baseband
connection creation needed just for the sake of the name request).

So far userspace has been responsible for this extra name request but
tighter control is needed in order not to flood Bluetooth controllers
with two many commands during connection creation. It has been shown
that some controllers simply fail to function correctly if they get too
many (almost) simultaneous commands during connection creation. The
simplest way to acheive better control of these commands is to move
their sending completely to the kernel side.

This patch inserts name requests into the sequence of events that the
kernel performs during connection creation. It does this after the
remote features have been successfully requested and before any pending
authentication requests are performed. The code will work sub-optimally
with userspace versions that still do the name requesting themselves (it
shouldn't break anything though) so it is recommended to combine this
with a userspace software version that doesn't have automated name
requests.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
392599b95d76f4f3102d8614bdc1957795cd1a3a 18-Nov-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Create a unified authentication request function

This patch adds a single function that's responsible for requesting
authentication for outgoing connections. This is preparation for the
next patch which will add automated name requests and thereby move the
authentication requests to a different location.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
ccd556fe334914bf2e465eb5bc480d49cd4406d7 10-Nov-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Simplify remote features callback function logic

The current remote and remote extended features event callbacks logic
can be made simpler by using a label and goto statements instead of the
current multiple levels of nested if statements.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
c89ad7372232b69fd37edf90d6f5d2a8d6381214 01-Nov-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix not returning proper error in SCO

Return 0 in that situation could lead to errors in the caller.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
co.c
63ce0900d79645c714de6c8b66d8040670068c9e 19-Aug-2010 Luiz Augusto von Dentz <luiz.dentz-von@nokia.com> Bluetooth: fix not setting security level when creating a rfcomm session

This cause 'No Bonding' to be used if userspace has not yet been paired
with remote device since the l2cap socket used to create the rfcomm
session does not have any security level set.

Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
4f8b691c9fb02e72359e71592098c1de3b8ec712 18-Oct-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: fix endianness conversion in L2CAP

Last commit added a wrong endianness conversion. Fixing that.

Reported-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
bfaaeb3ed5533a2dd38e3aa9ea43efd619690aed 17-Oct-2010 steven miao <realmz6@gmail.com> Bluetooth: fix unaligned access to l2cap conf data

In function l2cap_get_conf_opt() and l2cap_add_conf_opt() the address of
opt->val sometimes is not at the edge of 2-bytes/4-bytes, so 2-bytes/4 bytes
access will cause data misalignment exeception. Use get_unaligned_le16/32
and put_unaligned_le16/32 function to avoid data misalignment execption.

Signed-off-by: steven miao <realmz6@gmail.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
bdb7524a75e4716535a29abb314a82619301e068 15-Oct-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix non-SSP auth request for HIGH security level sockets

When initiating dedicated bonding a L2CAP raw socket with HIGH security
level is used. The kernel is supposed to trigger the authentication
request in this case but this doesn't happen currently for non-SSP
(pre-2.1) devices. The reason is that the authentication request happens
in the remote extended features callback which never gets called for
non-SSP devices. This patch fixes the issue by requesting also
authentiation in the (normal) remote features callback in the case of
non-SSP devices.

This rule is applied only for HIGH security level which might at first
seem unintuitive since on the server socket side MEDIUM is already
enough for authentication. However, for the clients we really want to
prefer the server side to decide the authentication requrement in most
cases, and since most client sockets use MEDIUM it's better to be
avoided on the kernel side for these sockets. The important socket to
request it for is the dedicated bonding one and that socket uses HIGH
security level.

The patch is based on the initial investigation and patch proposal from
Andrei Emeltchenko <endrei.emeltchenko@nokia.com>.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_event.c
96c99b473a8531188e2f6106c6ef0e33bb4500f2 14-Oct-2010 Randy Dunlap <randy.dunlap@oracle.com> Bluetooth: fix hidp kconfig dependency warning

Fix kconfig dependency warning to satisfy dependencies:

warning: (BT_HIDP && NET && BT && BT_L2CAP && INPUT || USB_HID && HID_SUPPORT && USB && INPUT) selects HID which has unmet direct dependencies (HID_SUPPORT && INPUT)

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
idp/Kconfig
5f05647dd81c11a6a165ccc8f0c1370b16f3bcb0 23-Oct-2010 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1699 commits)
bnx2/bnx2x: Unsupported Ethtool operations should return -EINVAL.
vlan: Calling vlan_hwaccel_do_receive() is always valid.
tproxy: use the interface primary IP address as a default value for --on-ip
tproxy: added IPv6 support to the socket match
cxgb3: function namespace cleanup
tproxy: added IPv6 support to the TPROXY target
tproxy: added IPv6 socket lookup function to nf_tproxy_core
be2net: Changes to use only priority codes allowed by f/w
tproxy: allow non-local binds of IPv6 sockets if IP_TRANSPARENT is enabled
tproxy: added tproxy sockopt interface in the IPV6 layer
tproxy: added udp6_lib_lookup function
tproxy: added const specifiers to udp lookup functions
tproxy: split off ipv6 defragmentation to a separate module
l2tp: small cleanup
nf_nat: restrict ICMP translation for embedded header
can: mcp251x: fix generation of error frames
can: mcp251x: fix endless loop in interrupt handler if CANINTF_MERRF is set
can-raw: add msg_flags to distinguish local traffic
9p: client code cleanup
rds: make local functions/variables static
...

Fix up conflicts in net/core/dev.c, drivers/net/pcmcia/smc91c92_cs.c and
drivers/net/wireless/ath/ath9k/debug.c as per David
0587102cf9f427c185bfdeb2cef41e13ee0264b1 16-Sep-2010 Alan Cox <alan@linux.intel.com> tty: icount changeover for other main devices

Again basically cut and paste

Convert the main driver set to use the hooks for GICOUNT

Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
2198a10b501fd4443430cb17e065a9e859cc58c9 21-Oct-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
net/core/dev.c
d793fe8caa3911e6a1e826b45d4ee00d250cdec8 15-Oct-2010 Nathan Holstein <nathan.holstein@gmail.com> Bluetooth: fix oops in l2cap_connect_req

In error cases when the ACL is insecure or we fail to allocate a new
struct sock, we jump to the "response" label. If so, "sk" will be
null and the kernel crashes.

Signed-off-by: Nathan Holstein <nathan.holstein@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
534c92fde74c8d2143fc15b5f1d957f42cb43570 30-Sep-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: clean up rfcomm code

Remove dead code and unused rfcomm thread events

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
ab3e571564a5d8fa4923e2e858e574c931a014c7 30-Sep-2010 Haijun Liu <haijun.liu@atheros.com> Bluetooth: Update conf_state before send config_req out

Update conf_state with L2CAP_CONF_REQ_SENT before send config_req out in
l2cap_config_req().

Signed-off-by: Haijun Liu <haijun.liu@atheros.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
0175d629e096a5a59dde6cc91b32ac3160a44b9e 25-Sep-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use the proper error value from bt_skb_send_alloc()

&err points to the proper error set by bt_skb_send_alloc() when it
fails.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
d6b2eb2f893547d7488d31a7088d78dd77ab5995 03-Sep-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: make batostr() print in the right order

The Bluetooth core uses the the BD_ADDR in the opposite order from the
human readable order. So we are changing batostr() to print in the
correct order and then removing some baswap(), as they are not needed
anymore.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
ci_sysfs.c
idp/core.c
ib.c
fcomm/tty.c
cb810a189da312d4074cb3fc8b0267b7115e7be1 03-Sep-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: remove unused variable from cmtp

A value was attributed to 'src', but no one was using.

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
mtp/core.c
aae7fe22a875a84e328469e228cba033ebbf20cb 15-Sep-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: check for l2cap header in start fragment

BLUETOOTH SPECIFICATION Version 4.0 [Vol 3] page 36 mentioned
"Note: Start Fragments always begin with the Basic L2CAP header
of a PDU."

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
8979481328dc2e14cea9f99b3562ffcf8655998e 15-Sep-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: check L2CAP length in first ACL fragment

Current Bluetooth code assembles fragments of big L2CAP packets
in l2cap_recv_acldata and then checks allowed L2CAP size in
assemled L2CAP packet (pi->imtu < skb->len).

The patch moves allowed L2CAP size check to the early stage when
we receive the first fragment of L2CAP packet. We do not need to
reserve and keep L2CAP fragments for bad packets.

Updated version after comments from Mat Martineau <mathewm@codeaurora.org>
and Gustavo Padovan <padovan@profusion.mobi>.

Trace below is received when using stress tools sending big
fragmented L2CAP packets.
...
[ 1712.798492] swapper: page allocation failure. order:4, mode:0x4020
[ 1712.804809] [<c0031870>] (unwind_backtrace+0x0/0xdc) from [<c00a1f70>]
(__alloc_pages_nodemask+0x4)
[ 1712.814666] [<c00a1f70>] (__alloc_pages_nodemask+0x47c/0x4d4) from
[<c00a1fd8>] (__get_free_pages+)
[ 1712.824645] [<c00a1fd8>] (__get_free_pages+0x10/0x3c) from [<c026eb5c>]
(__alloc_skb+0x4c/0xfc)
[ 1712.833465] [<c026eb5c>] (__alloc_skb+0x4c/0xfc) from [<bf28c738>]
(l2cap_recv_acldata+0xf0/0x1f8 )
[ 1712.843322] [<bf28c738>] (l2cap_recv_acldata+0xf0/0x1f8 [l2cap]) from
[<bf0094ac>] (hci_rx_task+0x)
...

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
80e2c88803c72747cb19febe2ad708bf0ad557bf 09-Sep-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Don't clear the blacklist when closing the HCI device

Clearing the blacklist in hci_dev_do_close() would mean that user space
needs to do extra work to re-block devices after a DEVDOWN-DEVUP cycle.
This patch removes the clearing of the blacklist in this case and
thereby saves user space from the extra work.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_core.c
5017d8dde13313cab1e607379536a7930ed682b0 08-Sep-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: remove extra newline from debug output

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
6fdf482bb3298267816be59d9a3dce29632382d3 08-Sep-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use a stream-oriented recvmsg with SOCK_STREAM L2CAP sockets.

L2CAP ERTM sockets can be opened with the SOCK_STREAM socket type,
which is a mandatory request for ERTM mode.

However, these sockets still have SOCK_SEQPACKET read semantics when
bt_sock_recvmsg() is used to pull data from the receive queue. If the
application is only reading part of a frame, then the unread portion
of the frame is discarded. If the application requests more bytes
than are in the current frame, only the current frame's data is
returned.

This patch utilizes common code derived from RFCOMM's recvmsg()
function to make L2CAP SOCK_STREAM reads behave like RFCOMM reads (and
other SOCK_STREAM sockets in general). The application may read one
byte at a time from the input stream and not lose any data, and may
also read across L2CAP frame boundaries.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
3d7d01dffec4a6757ed1e3182f01c7ef5caa2539 08-Sep-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Use common SOCK_STREAM receive code in RFCOMM

To reduce code duplication, have rfcomm_sock_recvmsg() call
bt_sock_stream_recvmsg(). The common bt_sock_stream_recvmsg()
code is nearly identical, with the RFCOMM-specific functionality
for deferred setup and connection unthrottling left in
rfcomm_sock_recvmsg().

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
796c86eec84ddfd02281c5071838ed1fefda6b90 08-Sep-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Add common code for stream-oriented recvmsg()

This commit adds a bt_sock_stream_recvmsg() function for use by any
Bluetooth code that uses SOCK_STREAM sockets. This code is copied
from rfcomm_sock_recvmsg() with minimal modifications to remove
RFCOMM-specific functionality and improve readability.

L2CAP (with the SOCK_STREAM socket type) and RFCOMM have common needs
when it comes to reading data. Proper stream read semantics require
that applications can read from a stream one byte at a time and not
lose any data. The RFCOMM code already operated on and pulled data
from the underlying L2CAP socket, so very few changes were required to
make the code more generic for use with non-RFCOMM data over L2CAP.

Applications that need more awareness of L2CAP frame boundaries are
still free to use SOCK_SEQPACKET sockets, and may verify that they
connection did not fall back to basic mode by calling getsockopt().

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
f_bluetooth.c
0fba2558cbb3fae3a09147b7d6e18a6204204e0e 08-Sep-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Validate PSM values in calls to connect() and bind()

Valid L2CAP PSMs are odd numbers, and the least significant bit of the
most significant byte must be 0.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
08601469a5aac8b3453d8aca0b8f9bd8dfdae12c 23-Jul-2010 Yuri Kululin <ext-yuri.kululin@nokia.com> Bluetooth: Fix RFCOMM RPN negotiation

According to the ETSI 3GPP TS 07.10 the default bit rate value for RFCOMM
is 9600 bit/s. Return this bit rate in case of RPN request and accept other
sane bit rates proposed by the sender in RPM command.

Signed-off-by: Yuri Kululin <ext-yuri.kululin@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/core.c
8f1e1742233cd1c3444dfc6c945a2efb2814e157 09-Aug-2010 David Vrabel <david.vrabel@csr.com> Bluetooth: HCI devices are either BR/EDR or AMP radios

HCI transport drivers may not know what type of radio an AMP device has
so only say whether they're BR/EDR or AMP devices.

Signed-off-by: David Vrabel <david.vrabel@csr.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
ci_sysfs.c
d122179a3c0fdc71b88cb9e3605f372b1651a9ff 11-Oct-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
net/core/ethtool.c
eaa71b318c5ed0cd1ac3182a533471dc5edf372d 05-Oct-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Disallow to change L2CAP_OPTIONS values when connected

L2CAP doesn't permit change like MTU, FCS, TxWindow values while the
connection is alive, we can only set that before the
connection/configuration process. That can lead to bugs in the L2CAP
operation.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
b0239c80fe89d5832a68a0f3121a9d5ec9fb763e 08-Sep-2010 Gustavo F. Padovan <padovan@profusion.mobi> Revert "Bluetooth: Don't accept ConfigReq if we aren't in the BT_CONFIG state"

This reverts commit 8cb8e6f1684be13b51f8429b15f39c140326b327.

That commit introduced a regression with the Bluetooth Profile Tuning
Suite(PTS), Reverting this make sure that L2CAP is in a qualificable
state.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
fad003b6c8e3d944d4453fd569b0702ef1af82b3 14-Aug-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix inconsistent lock state with RFCOMM

When receiving a rfcomm connection with the old dund deamon a
inconsistent lock state happens. That's because interrupts were already
disabled by l2cap_conn_start() when rfcomm_sk_state_change() try to lock
the spin_lock.

As result we may have a inconsistent lock state for l2cap_conn_start()
after rfcomm_sk_state_change() calls bh_lock_sock() and disable interrupts
as well.

[ 2833.151999]
[ 2833.151999] =================================
[ 2833.151999] [ INFO: inconsistent lock state ]
[ 2833.151999] 2.6.36-rc3 #2
[ 2833.151999] ---------------------------------
[ 2833.151999] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
[ 2833.151999] krfcommd/2306 [HC0[0]:SC0[0]:HE1:SE1] takes:
[ 2833.151999] (slock-AF_BLUETOOTH){+.?...}, at: [<ffffffffa00bcb56>] rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999] {IN-SOFTIRQ-W} state was registered at:
[ 2833.151999] [<ffffffff81094346>] __lock_acquire+0x5b6/0x1560
[ 2833.151999] [<ffffffff8109534a>] lock_acquire+0x5a/0x70
[ 2833.151999] [<ffffffff81392b6c>] _raw_spin_lock+0x2c/0x40
[ 2833.151999] [<ffffffffa00a5092>] l2cap_conn_start+0x92/0x640 [l2cap]
[ 2833.151999] [<ffffffffa00a6a3f>] l2cap_sig_channel+0x6bf/0x1320 [l2cap]
[ 2833.151999] [<ffffffffa00a9173>] l2cap_recv_frame+0x133/0x770 [l2cap]
[ 2833.151999] [<ffffffffa00a997b>] l2cap_recv_acldata+0x1cb/0x390 [l2cap]
[ 2833.151999] [<ffffffffa000db4b>] hci_rx_task+0x2ab/0x450 [bluetooth]
[ 2833.151999] [<ffffffff8106b22b>] tasklet_action+0xcb/0xe0
[ 2833.151999] [<ffffffff8106b91e>] __do_softirq+0xae/0x150
[ 2833.151999] [<ffffffff8102bc0c>] call_softirq+0x1c/0x30
[ 2833.151999] [<ffffffff8102ddb5>] do_softirq+0x75/0xb0
[ 2833.151999] [<ffffffff8106b56d>] irq_exit+0x8d/0xa0
[ 2833.151999] [<ffffffff8104484b>] smp_apic_timer_interrupt+0x6b/0xa0
[ 2833.151999] [<ffffffff8102b6d3>] apic_timer_interrupt+0x13/0x20
[ 2833.151999] [<ffffffff81029dfa>] cpu_idle+0x5a/0xb0
[ 2833.151999] [<ffffffff81381ded>] rest_init+0xad/0xc0
[ 2833.151999] [<ffffffff817ebc4d>] start_kernel+0x2dd/0x2e8
[ 2833.151999] [<ffffffff817eb2e6>] x86_64_start_reservations+0xf6/0xfa
[ 2833.151999] [<ffffffff817eb3ce>] x86_64_start_kernel+0xe4/0xeb
[ 2833.151999] irq event stamp: 731
[ 2833.151999] hardirqs last enabled at (731): [<ffffffff8106b762>] local_bh_enable_ip+0x82/0xe0
[ 2833.151999] hardirqs last disabled at (729): [<ffffffff8106b93e>] __do_softirq+0xce/0x150
[ 2833.151999] softirqs last enabled at (730): [<ffffffff8106b96e>] __do_softirq+0xfe/0x150
[ 2833.151999] softirqs last disabled at (711): [<ffffffff8102bc0c>] call_softirq+0x1c/0x30
[ 2833.151999]
[ 2833.151999] other info that might help us debug this:
[ 2833.151999] 2 locks held by krfcommd/2306:
[ 2833.151999] #0: (rfcomm_mutex){+.+.+.}, at: [<ffffffffa00bb744>] rfcomm_run+0x174/0xb20 [rfcomm]
[ 2833.151999] #1: (&(&d->lock)->rlock){+.+...}, at: [<ffffffffa00b9223>] rfcomm_dlc_accept+0x53/0x100 [rfcomm]
[ 2833.151999]
[ 2833.151999] stack backtrace:
[ 2833.151999] Pid: 2306, comm: krfcommd Tainted: G W 2.6.36-rc3 #2
[ 2833.151999] Call Trace:
[ 2833.151999] [<ffffffff810928e1>] print_usage_bug+0x171/0x180
[ 2833.151999] [<ffffffff810936c3>] mark_lock+0x333/0x400
[ 2833.151999] [<ffffffff810943ca>] __lock_acquire+0x63a/0x1560
[ 2833.151999] [<ffffffff810948b5>] ? __lock_acquire+0xb25/0x1560
[ 2833.151999] [<ffffffff8109534a>] lock_acquire+0x5a/0x70
[ 2833.151999] [<ffffffffa00bcb56>] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999] [<ffffffff81392b6c>] _raw_spin_lock+0x2c/0x40
[ 2833.151999] [<ffffffffa00bcb56>] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999] [<ffffffffa00bcb56>] rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999] [<ffffffffa00b9239>] rfcomm_dlc_accept+0x69/0x100 [rfcomm]
[ 2833.151999] [<ffffffffa00b9a49>] rfcomm_check_accept+0x59/0xd0 [rfcomm]
[ 2833.151999] [<ffffffffa00bacab>] rfcomm_recv_frame+0x9fb/0x1320 [rfcomm]
[ 2833.151999] [<ffffffff813932bb>] ? _raw_spin_unlock_irqrestore+0x3b/0x60
[ 2833.151999] [<ffffffff81093acd>] ? trace_hardirqs_on_caller+0x13d/0x180
[ 2833.151999] [<ffffffff81093b1d>] ? trace_hardirqs_on+0xd/0x10
[ 2833.151999] [<ffffffffa00bb7f1>] rfcomm_run+0x221/0xb20 [rfcomm]
[ 2833.151999] [<ffffffff813905e7>] ? schedule+0x287/0x780
[ 2833.151999] [<ffffffffa00bb5d0>] ? rfcomm_run+0x0/0xb20 [rfcomm]
[ 2833.151999] [<ffffffff81081026>] kthread+0x96/0xa0
[ 2833.151999] [<ffffffff8102bb14>] kernel_thread_helper+0x4/0x10
[ 2833.151999] [<ffffffff813936bc>] ? restore_args+0x0/0x30
[ 2833.151999] [<ffffffff81080f90>] ? kthread+0x0/0xa0
[ 2833.151999] [<ffffffff8102bb10>] ? kernel_thread_helper+0x0/0x10

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
fcomm/sock.c
ccbb84af28594e19fd4bf27ff2828c80d03b6081 30-Aug-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Simplify L2CAP Streaming mode sending

As we don't have any error control on the Streaming mode, i.e., we don't
need to keep a copy of the skb for later resending we don't need to
call skb_clone() on it.
Then we can go one further here, and dequeue the skb before sending it,
that also means we don't need to look to sk->sk_send_head anymore.

The patch saves memory and time when sending Streaming mode data, so
it is good to mainline.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
8183b775bc5b79b6b1e250019c9dd930554dfa94 01-Sep-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: fix MTU L2CAP configuration parameter

When receiving L2CAP negative configuration response with respect
to MTU parameter we modify wrong field. MTU here means proposed
value of MTU that the remote device intends to transmit. So for local
L2CAP socket it is pi->imtu.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
8c462b6047da80491b8cb6be878e8bf9313ac3e1 25-Aug-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Only enable L2CAP FCS for ERTM or streaming

This fixes a bug which caused the FCS setting to show L2CAP_FCS_CRC16
with L2CAP modes other than ERTM or streaming. At present, this only
affects the FCS value shown with getsockopt() for basic mode.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
2cap.c
a02cec2155fbea457eca8881870fd2de1a4c4c76 22-Sep-2010 Eric Dumazet <eric.dumazet@gmail.com> net: return operator cleanup

Change "return (EXPR);" to "return EXPR;"

return is not a function, parentheses are not required.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
db40980fcdb560d7992b0511df16cdd3f7e381f3 06-Sep-2010 Eric Dumazet <eric.dumazet@gmail.com> net: poll() optimizations

No need to test twice sk->sk_shutdown & RCV_SHUTDOWN

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
cff70fae111efba80c27023772ce5265797fb514 06-Aug-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix incorrect setting of remote_tx_win for L2CAP ERTM

remote_tx_win is intended to be set on receipt of an L2CAP
configuration request. The value is used to determine the size of the
transmit window on the remote side of an ERTM connection, so L2CAP
can stop sending frames when that remote window is full.

An incorrect remote_tx_win value will cause the stack to not fully
utilize the tx window (performance impact), or to overfill the remote
tx window (causing dropped frames or a disconnect).

This patch removes an extra setting of remote_tx_win when a
configuration response is received. The transmit window has a
different meaning in a response - it is an informational value
less than or equal to the local tx_win.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
86b1b26326279299c93ddb11ab4782d3896bf84c 06-Aug-2010 Mat Martineau <mathewm@codeaurora.org> Bluetooth: Fix endianness issue with L2CAP MPS configuration

Incoming configuration values must be converted to native CPU order
before use. This fixes a bug where a little-endian MPS value is
compared to a native CPU value. On big-endian processors, this
can cause ERTM and streaming mode segmentation to produce PDUs
that are larger than the remote stack is expecting, or that would
produce fragmented skbs that the current FCS code cannot handle.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
adb08edea0119f7a5484a9f6a385fbcecdf85a63 04-Aug-2010 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Check result code of L2CAP information response

Check result code of L2CAP information response. Otherwise
it would read invalid feature mask and access invalid memory.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6340650400525a9ca8d86b1b4501cc50670dce0d 04-Aug-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't send RFC for Basic Mode if only it is supported

If the remote side doesn't support Enhanced Retransmission Mode neither
Streaming Mode, we shall not send the RFC option.

Some devices that only supports Basic Mode do not understanding the RFC
option. This patch fixes the regression found with these devices.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
28e9509b1270e5cfa8bb3c5ff51f39214aa09262 01-Aug-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove __exit from rfcomm_cleanup_ttys()

rfcomm_cleanup_ttys() is also called from rfcomm_init(), so it can't
have __exit.

Reported-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
ea4bd8ba804dedefa65303b3bd105d6d2808e621 31-Jul-2010 David Miller <davem@davemloft.net> Bluetooth: Use list_head for HCI blacklist head

The bdaddr in the list root is completely unused and just
taking up space.

Signed-off-by: David S. Miller <davem@davemloft.net>
Tested-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sock.c
ci_sysfs.c
2f8362afcd2da8b313ec3cc04a50af19d3592972 24-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add __init and __exit marks to RFCOMM

Those annotation save memory and space on the binary. __init code is
discarded just after execute and __exit code is discarded if the module
is built into the kernel image or unload of modules is not allowed.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
fcomm/tty.c
da5f6c37eee040775997191d1a1bc91c0c1e51eb 24-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Test 'count' value before enter the loop

Testing first we avoid enter the loop when count = 0.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
e73439d8c0e4c522c843b8bb98c0eb5700da6b05 26-Jul-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Defer SCO setup if mode change is pending

Certain headsets such as the Motorola H350 will reject SCO and eSCO
connection requests while the ACL is transitioning from sniff mode
to active mode. Add synchronization so that SCO and eSCO connection
requests will wait until the ACL has fully transitioned to active mode.

< HCI Command: Exit Sniff Mode (0x02|0x0004) plen 2
handle 12
> HCI Event: Command Status (0x0f) plen 4
Exit Sniff Mode (0x02|0x0004) status 0x00 ncmd 1
< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 12 voice setting 0x0040
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Number of Completed Packets (0x13) plen 5
handle 12 packets 1
> HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 12 mode 0x00 interval 0
Mode: Active
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x10 handle 14 bdaddr 00:1A:0E:50:28:A4 type SCO
Error: Connection Accept Timeout Exceeded

Signed-off-by: Ron Shaffer <rshaffer@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
d1c4a17d58a6dfacb48935aa430aa986559a885f 18-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Enable L2CAP Extended features by default

Change the enable_ertm param to disable_ertm and default value to 0. That
means that L2CAP Extended features are enabled by default now.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
893ef9711286d01763f3c175385d70076d5f9546 18-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix typo in hci_event.c

memmory -> memory

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
5d8868ff3d11e3fc5a5c07477f281a16c71714a3 16-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add Google's copyright to L2CAP

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9981151086385eecc2febf4ba95a14593f834b3d 14-Jul-2010 Suraj Sumangala <suraj@atheros.com> Bluetooth: Implemented HCI frame reassembly for RX from stream

Implemented frame reassembly implementation for reassembling fragments
received from stream.

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
f39a3c06404d01ef2ce47e821bc778dfb1836df9 14-Jul-2010 Suraj Sumangala <suraj@atheros.com> Bluetooth: Modified hci_recv_fragment() to use hci_reassembly helper

Modified packet based reassembly function hci_recv_fragment() to use
hci_reassembly()

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
33e882a5f2301a23a85ef2994e30fd9f48d39d9b 14-Jul-2010 Suraj Sumangala <suraj@atheros.com> Bluetooth: Implement hci_reassembly helper to reassemble RX packets

Implements feature to reassemble received HCI frames from any input stream

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
cd4c53919ed50b0d532f106aeb76e79077bece98 14-Jul-2010 Suraj Sumangala <suraj@atheros.com> Bluetooth: Add one more buffer for HCI stream reassembly

Additional reassembly buffer to keep track of stream reasembly

Signed-off-by: Suraj Sumangala <suraj@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
dd135240e8e10295f7e7cdf347800df6e1841437 13-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Update L2CAP version information

We did some changes on the L2CAP configuration process and its behaviour
is bit different now. That justifies a updated on the L2CAP version.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
ce5706bd69be6b25715ed6cd48a210b5080032bc 13-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add Copyright notice to L2CAP

Copyright for the time I worked on L2CAP during the Google Summer of Code
program.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
47731de789749c9ed3c54751db28fd9c9eeaf019 09-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Keep code under column 80

Purely a cosmetic change, it doesn't change the code flow.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
89746b856c88af9e5019e84615d88e002fb54dc3 09-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bug in kzalloc allocation size

Probably a typo error. We were using the wrong struct to get size.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e9aeb2ddd441f0c8699ff04c499d7213730a0f04 09-Jul-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Send ConfigReq after send a ConnectionRsp

The extended L2CAP features requires that one should initiate a
ConfigReq after send the ConnectionRsp. This patch changes the behaviour
of the configuration process of our stack.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
963cf687e825f7a59817f145a1ea19bdc224a18f 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix error return on L2CAP-HCI interface.

L2CAP only deals with ACL links. EINVAL should be returned otherwise.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7a560e5c99dc5f03e2c0dbe05ed20008af5d0bcf 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix error value for wrong FCS.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
57d3b22bf56579bb1ab2d6f5020d372c99a7afae 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix error return for l2cap_connect_rsp().

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
bc766db2ef3700ae74bdfc88d74b771b97971a24 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix error return value on sendmsg.

When the socket is in a bad state EBADFD is more appropriate then EINVAL.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f9dd11b03c5c3cd6bdf2e503400bbc922c898974 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix error return value on sendmsg.

When we try to send a message bigger than the outgoing MTU value
EMSGSIZE (message too long) should be returned.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
305682e8377b0f560d4b885c169a72e6a62331e9 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Make l2cap_streaming_send() void.

It doesn't make sense to have a return value since we always set it
to 0.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8b0dc6dc827fb71efd6c9dfb5c4172b7b5c96cee 22-Jun-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix l2cap_sock_connect error return.

Return a proper error value if socket is already connected.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
712132eb541e4a76afad97898dc0ce6b6c0032d8 22-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Improve ERTM local busy handling

Now we also check if can push skb userspace just after receive a new
skb instead of only wait the l2cap_busy_work wake up from time to time
to check the local busy condition.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
218bb9dfd21472128f86b38ad2eab123205c2991 21-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add backlog queue to ERTM code

backlog queue is the canonical mechanism to avoid race conditions due
interrupts in bottom half context. After the socket lock is released the
net core take care of push all skb in its backlog queue.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e0f66218b3a7d0bcf37ca95186123c257fda0ba5 21-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove the send_lock spinlock from ERTM

Using a lock to deal with the ERTM race condition - interruption with
new data from the hci layer - is wrong. We should use the native skb
backlog queue.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8cb8e6f1684be13b51f8429b15f39c140326b327 14-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't accept ConfigReq if we aren't in the BT_CONFIG state

If such event happens we shall reply with a Command Reject, because we are
not expecting any configure request.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
cf6c2c0b9f47ee3cd12684b905725c8376d52135 08-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Disconnect early if mode is not supported

When mode is mandatory we shall not send connect request and report this
to the userspace as well.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2ba13ed678775195e8255b4e503c59d48b615bd8 09-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove check for supported mode

Since now we have checks for the supported mode before on
l2cap_info_rsp we can remove the check for it here.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6c2ea7a8f5fea67fa20e5825401b8fce5a78dbf6 09-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Refuse ConfigRsp with different mode

If our mode is Basic Mode we have to refuse any ConfigRsp that proposes
a different mode.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
625477523b4e656fbcc5ec2a8ca7a1beb39b1caf 09-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Actively send request for Basic Mode

The Profile Tuning Suite requires that we send a RFC containing the
Basic Mode configuration when requesting Basic Mode.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
ae12d52efd492ee6634c34322302ac754ff8cde8 09-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Prefer Basic Mode on receipt of ConfigReq

If we choose to use Basic Mode then we have to refuse the received mode
and propose Basic Mode again.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
742e519b0db4a470008118b48f0baea6126e2122 09-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Disconnect the channel if we don't want the proposed mode

If the device is a STATE 2 then it should disconnect the channel if the
remote device propose a mode different from its mandatory mode.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
85eb53c6f719523dde9e0658823dffd2664d4d1c 03-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Change the way we set ERTM mode as mandatory

If the socket type is SOCK_STREAM we set Enhanced Retransmisson Mode or
Streaming Mode as mandatory. That means that we will close the channel
if the other side doesn't support or request the the mandatory mode.
Basic mode can't be set as mandatory.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
64988868637304330f7df20d08b965592312c531 10-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Tweaks to l2cap_send_i_or_rr_or_rnr() flow

l2cap_send_sframe() already set the F-bit if we set L2CAP_CONN_SEND_FBIT
and unset L2CAP_CONN_SEND_FBIT after send the F-bit.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0e98958d4f827f814444757e0376546b462dfe6f 19-Apr-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add debug output to ERTM code

Use the dynamic debug to output info about ERTM protocol stuff.
The following script can be used to enable debug for ERTM:

DEBUGFS="/sys/kernel/debug/dynamic_debug/control"

echo -n 'func l2cap_send_disconn_req +p' > $DEBUGFS
echo -n 'func l2cap_monitor_timeout +p' > $DEBUGFS
echo -n 'func l2cap_retrans_timeout +p' > $DEBUGFS
echo -n 'func l2cap_busy_work +p' > $DEBUGFS
echo -n 'func l2cap_push_rx_skb +p' > $DEBUGFS
echo -n 'func l2cap_data_channel_iframe +p' > $DEBUGFS
echo -n 'func l2cap_data_channel_rrframe +p' > $DEBUGFS
echo -n 'func l2cap_data_channel_rejframe +p' > $DEBUGFS
echo -n 'func l2cap_data_channel_srejframe +p' > $DEBUGFS
echo -n 'func l2cap_data_channel_rnrframe +p' > $DEBUGFS

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9b108fc0cf4e79c34a7d5626f5c2c4c529ef6d3f 20-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix ERTM error reporting to the userspace

If any error occurs during transfers we have to tell userspace that
something wrong happened.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4ea727ef9d507413f15da0de401d8a50b125649a 03-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix missing retransmission action with RR(P=1)

The Bluetooth SIG Profile Tuning Suite Software uses the CSA1 spec
to run the L2CAP tests. The new 3.0 spec has a missing
Retransmit-I-Frames action when the Remote side is Busy.
We still start the retransmission timer if Remote is Busy and unacked
frames > 0. We do everything we did before this change plus the
Retransmission of I-frames.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
260000896750690b774d4343294ae5cbff1423e5 12-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check packet FCS earlier

This way, if FCS is enabled and the packet is corrupted, we just drop it
without read it len, which could be corrupted.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
45d65c46acc39945219eeb3752367ee80ed82799 08-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check the tx_window size on setsockopt

We have to check if the proposed tx_window value is not greater that
maximum value supported.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
3cb123d1c03a0510d3c325bfaa971ce4df1e050d 29-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix handle of received P-bit

ERTM spec mandates that after receive a P-bit we shall send an F-bit in
response. This patch fixes this for retransmitted packets, on
retransmitting we were missing to check for a pending F-bit to be sent.
Also we were missing some annotation to send a F-bit.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2ece3684b4037ad2394de795d67abbe412ab5e2f 16-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Update buffer_seq before retransmit frames

Updating buffer_seq first make us able to ack the last I-frame received.
This is also a requirement of the Profile Tuning Suite software.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7fe9b298c98fdfecf3b0efb4c971b7696d091ae9 12-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Stop ack_timer if ERTM enters in Local Busy or SREJ_SENT

The ack_timer is implemation specific, disabling it in such situation
avoids some potencial errors in the ERTM protocol.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2d0a03460a8a0c611843500735096ff799aa8510 28-May-2010 Ron Shaffer <rshaffer@codeaurora.org> Bluetooth: Reassigned copyright to Code Aurora Forum

Qualcomm, Inc. has reassigned rights to Code Aurora Forum. Accordingly,
as files are modified by Code Aurora Forum members, the copyright
statement will be updated.

Signed-off-by: Ron Shaffer <rshaffer@codeaurora.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
32c2ece5eaec296482077dadc3edd5baa7bd1097 18-May-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add debugfs support for showing the blacklist

This patch adds a debugfs blacklist entry for each HCI device which can
be used to list the current content of the blacklist.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
f03585689fdff4ae256edd45a35bc2dd83d3684a 18-May-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Add blacklist support for incoming connections

In some circumstances it could be desirable to reject incoming
connections on the baseband level. This patch adds this feature through
two new ioctl's: HCIBLOCKADDR and HCIUNBLOCKADDR. Both take a simple
Bluetooth address as a parameter. BDADDR_ANY can be used with
HCIUNBLOCKADDR to remove all devices from the blacklist.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ci_sock.c
95ffa97827371ede501615d9bd048eb5b49e8fe1 19-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix L2CAP control bit field corruption

When resending an I-frame, ERTM was reusing the control bits from the last
time it was sent, that was causing a corruption in the new control field
due to it dirty fields.

This patches extracts only the SAR bits from the old field and reuse it to
resend the packet, the others bits should be reset and receive the
updated value.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c13ffa620f15cb28d18268a773464cf51550fa9f 14-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Proper shutdown ERTM when closing the channel

Fix a crash regarding the Monitor Timeout, it was running even after the
shutdown of the ACL connection, which doesn't make sense.

The same code also fixes another issue, before this patch L2CAP was sending
many Disconnections Requests while we have to send only one.

The issues are related to each other, a expired Monitor Timeout can
trigger a Disconnection Request and then we may have a crash if the link
was already deleted.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
51893f88dd916efead5e24a212c907b2cd35e160 09-Jun-2010 Nathan Holstein <nathan@lampreynetworks.com> Bluetooth: Fix bug with ERTM minimum packet length

ERTM and streaming mode L2CAP sockets have no minimum packet length. Only
basic mode connections have minimum length.

Instead, validate the packet containing all necessary control, FCS,
and SAR fields.

The patch fixes the drop of valid packets with length lower than 4.

Signed-off-by: Nathan Holstein <ngh@isomerica.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
bfbacc11550a785caf082f3ccfcd7ecf882e09a4 31-May-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Fix SREJ_QUEUE corruption in L2CAP

Since all TxSeq values are modulo, we shall not compare them directly. We
have to compare their offset inside the TxWindow instead.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6e2b6722abaa3f6042357e11f465488b7c12f94c 01-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bug in l2cap_ertm_send() behavior

This patch makes l2cap_ertm_send() similar to the Send-Data action of
the ERTM spec. We shall not check for RemoteBusy or WAIT_F state
inside l2cap_ertm_send().

Such checks were causing a bug in the retransmission logic of ERTM and
making ERTM stalls until the ACL is dropped.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
bc1b1f8bee63966649dd5ac7d10d31a6556bf19b 12-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Only check SAR bits if frame is an I-frame

The SAR bits doesn't make sense for an S-frame. It doesn't use SAR.

Checking SAR for a S-frames can lead to L2CAP errors, it could close
the channel with an invalid packet length, since we was removing the 2
of the of any frame that match SAR start bits, without check if it is
an I-frame.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8ff50ec04a7ecdbba6e0a5423cf6f2c5f7fc605e 11-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bug with ERTM vars increment

All ERTM operations regarding the txWindow should be modulo 64,
otherwise we confuse the ERTM logic and connections will break.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f6337c771126420c348b702e012262cfb5f0d56e 10-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix drop of packets with invalid req_seq/tx_seq

We shall not use an unsigned var since we are expecting negatives value
there. Using unsigned causes ERTM connection to close due to invalid
ReqSeq numbers.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0b31c85ce78d3646ac1e90d62969e7cd8cfd8b15 10-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove L2CAP Extended Features from Kconfig

This reverts commit 84fb0a6334af0ccad3544f6972c055d90fbb9fbe which adds
the L2CAP Extended Features to the Kconfig, that is actually not needed.
One can use other mechanisms to enable L2CAP Extended Features.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
2cap.c
fd059b9bd0af2e217f29d5a34e1c71039d26af8c 10-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove max_tx and tx_window module paramenters from L2CAP

We don't need these parameters anymore since we have socket options for
them.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
11fe883936980fe242869d671092a466cf1db3e3 21-Jul-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/vhost/net.c
net/bridge/br_device.c

Fix merge conflict in drivers/vhost/net.c with guidance from
Stephen Rothwell.

Revert the effects of net-2.6 commit 573201f36fd9c7c6d5218cdcd9948cee700b277d
since net-next-2.6 has fixes that make bridge netpoll work properly thus
we don't need it disabled.

Signed-off-by: David S. Miller <davem@davemloft.net>
045309820afe047920a50de25634dab46a1e851d 15-Jun-2010 Ville Tervo <ville.tervo@nokia.com> Bluetooth: Update sec_level/auth_type for already existing connections

Update auth level for already existing connections if it is lower
than required by new connection.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Reviewed-by: Emeltchenko Andrei <andrei.emeltchenko@nokia.com>
Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
da213f41cdd445d3df468f8fe7f24fe4f4c48508 18-Jun-2010 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Reset the security level after an authentication failure

When authentication fails for a connection the assumed security level
should be set back to BT_SECURITY_LOW so that subsequent connect
attempts over the same link don't falsely assume that security is
adequate enough.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e501d0553a7580fcc6654d7f58a5f061d31d00af 07-Jul-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Check L2CAP pending status before sending connect request

Due to race condition in L2CAP state machine L2CAP Connection Request
may be sent twice for SDP with the same source channel id. Problems
reported connecting to Apple products, some carkit, Blackberry phones.

...
2010-06-07 21:18:03.651031 < ACL data: handle 1 flags 0x02 dlen 12
L2CAP(s): Connect req: psm 1 scid 0x0040
2010-06-07 21:18:03.653473 > HCI Event: Number of Completed Packets (0x13) plen 5
handle 1 packets 1
2010-06-07 21:18:03.653808 > HCI Event: Auth Complete (0x06) plen 3
status 0x00 handle 1
2010-06-07 21:18:03.653869 < ACL data: handle 1 flags 0x02 dlen 12
L2CAP(s): Connect req: psm 1 scid 0x0040
...

Patch uses L2CAP_CONF_CONNECT_PEND flag to mark that L2CAP Connection
Request has been sent already.

Modified version of patch from Ville Tervo.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
597e608a8492d662736c9bc6aa507dbf1cadc17d 08-Jul-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
1a61a83ff59378a5613d8c706c4a660c353b62a8 18-Jun-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Bring back var 'i' increment

commit ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a accidentally added a
regression on the bnep code. Fixing it.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
bc10502dba37d3b210efd9f3867212298f13b78e 03-Jun-2010 Eric Dumazet <eric.dumazet@gmail.com> net: use __packed annotation

cleanup patch.

Use new __packed annotation in net/ and include/
(except netfilter)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
3fa21e07e6acefa31f974d57fba2b6920a7ebd1a 18-May-2010 Joe Perches <joe@perches.com> net: Remove unnecessary returns from void function()s

This patch removes from net/ (but not any netfilter files)
all the unnecessary return; statements that precede the
last closing brace of void functions.

It does not remove the returns that are immediately
preceded by a label as gcc doesn't like that.

Done via:
$ grep -rP --include=*.[ch] -l "return;\n}" net/ | \
xargs perl -i -e 'local $/ ; while (<>) { s/\n[ \t\n]+return;\n}/\n}/g; print; }'

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
2cap.c
fcomm/tty.c
co.c
2b0b05ddc04b6d45e71cd36405df512075786f1e 10-May-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issues where sk_sleep() helper is needed now

There were some left-overs that used sk->sk_sleep instead of the new
sk_sleep() helper.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7b767cad296d17cfe071734f71a3b7b479534c8c 09-Mar-2010 Tomas Winkler <tomas.winkler@intel.com> Bluetooth: Use strict_strtoul instead of simple_strtoul

Use strict_strtoul as suggested by checkpatch.pl for more strict input
checking.

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
f48fd9c8cd746fdb055a97249a209c77dca0f710 20-Mar-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Create per controller workqueue

Instead of having a global workqueue for all controllers, it makes
more sense to have a workqueue per controller.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
844c0972427ee5f661158160aaca10b22b3dda60 05-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix spec error in the RemoteBusy Logic

On the receipt of an RR(P=1) under RemoteBusy set to TRUE(on the RECV
state table) we have to call sendIorRRorRNR(F=1) and just after set
RemoteBusy to False. This leads to a freeze in the sending process since
it's not allowed send data with RemoteBusy set to true and no one
call SendPending-I-Frames after set RemoteBusy to false(The last action
for that event).

Actually sendIorRRorRNR() calls SendPending-I-Frames but at that moment
RemoteBusy is still True and we cannot send any frame, after, no one
calls SendPending-I-Frames again and the sending process stops.

The solution here is to set RemoteBusy to false inside
SendPending-I-Frames just before call SendPending-I-Frames. That will
make SendPending-I-Frames able to send frames. This solution is similar
to what RR(P=0)(F=0) on the RECV table and RR(P=1) on the SREJ_SENT
table do.

Actually doesn't make any sense call SendPending-I-Frames if we can send
any frame, i. e., RemoteBusy is True.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4178ba462a3e8ab5094e69606f01d9e95f2d5ea6 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Prevents buffer overflow on l2cap_ertm_reassembly_sdu()

The checks should be done before the the memcpy to avoid buffer
overflow.

Reported-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
dfc909befbfe967bd7f46ef33b6969c1b7f3cf42 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix race condition on l2cap_ertm_send()

l2cap_ertm_send() can be called both from user context and bottom half
context. The socket locks for that contexts are different, the user
context uses a mutex(which can sleep) and the second one uses a
spinlock_bh. That creates a race condition when we have interruptions on
both contexts at the same time.

The better way to solve this is to add a new spinlock to lock
l2cap_ertm_send() and the vars it access. The other solution was to defer
l2cap_ertm_send() with a workqueue, but we the sending process already
has one defer on the hci layer. It's not a good idea add another one.

The patch refactor the code to create l2cap_retransmit_frames(), then we
encapulate the lock of l2cap_ertm_send() for some call. It also changes
l2cap_retransmit_frame() to l2cap_retransmit_one_frame() to avoid
confusion

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6161c0382bbab883a634d284f7367a88bbe88534 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add wait_queue to wait ack of all sent packets

To guarantee that all packets we sent were received we need to wait for
theirs ack before shutdown the socket.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
1890d36bb556a27684ad29654a9898ab9a5f57ee 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Implement Local Busy Condition handling

Supports Local Busy condition handling through a waitqueue that wake ups
each 200ms and try to push the packets to the upper layer. If it can
push all the queue then it leaves the Local Busy state.

The patch modifies the behaviour of l2cap_ertm_reassembly_sdu() to
support retry of the push operation.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9b53350d3cf5b330c3261d89b5e62a2dc25c5653 01-May-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Completes the I-frame tx_seq check logic on RECV

Add checks for invalid tx_seq and fixes the duplicated tx_seq check.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
18778a63ddc83bc89bda3b119fb02eb121512a66 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Implement missing parts of the Invalid Frame Detection

There is a plenty of situation where ERTM shall close the channel, this
commit treats the cases regarding Invalid Frame Detection.
It create one reassembly SDU function for ERTM and other for Streaming
Mode to make the Invalid Frame Detection handling less complex.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f11d676da4059c7888efca810ab300b931736a26 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Refactor l2cap_retransmit_frame()

Make the code flow cleaner and changes the function to void.
It also fixes a potential NULL dereference with skb.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9a9c6a34416b3743c09c00f3d6708d9df3c21629 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Make hci_send_acl() void

hci_send_acl can't fail, so we can make it void. This patch changes
that and all the funcions that use hci_send_acl().
That change exposed a bug on sending connectionless data. We were not
reporting the lenght send back to the user space.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
2cap.c
ff12fd643334071084b6145cad3793bb6c956638 06-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix lockdep annotation on ERTM

A spin_lock_init() call was missing. :)

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9b16dc6551cbde65d0ac525af3c46efab53a2c46 06-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check if we really are in WAIT_F when F bit comes

F-bit set should be processed only if we are in the WAIT_F state.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
a2e12a2a312f816d5970b0c809d43b399fbfe90c 06-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove unneeded control vars

Trivial clean up.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0301ef04b5f49a95681694fc0d75af9441faa919 06-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove set of SrejSaveReqSeq under receipt of REJ frame

That action is not specified by the ERTM spec, so removing it.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
59203a21a56c53afeb6f45e059299e6f1437f30f 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix errors reported by checkpatch.pl

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
44651b85cc3a076147af5d181fc4833ef8debc59 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Don't set control bits to zero first

We can set the SAR bits in the control field directly.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
01760bdde9a92413b7fff928d08e19352bf09d82 01-May-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Close L2CAP channel on invalid ReqSeq

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
afefdbc4cf3b9d409d07e1e5264e7ff88bc48711 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix SDU reassembly under SREJ

The code was reusing the control var without its reinitialization.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0041ecfa3025d7612fdaab12b2f07c9c3c09f42f 01-May-2010 João Paulo Rechi Vita <jprvita@profusion.mobi> Bluetooth: Check if mode is supported on getsockopt

Add this check to getsockopt makes possible to fail early instead of
waiting until listen / connect.

Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
bd3c9e255e76ae232d417e3914ca5d80ca3e9485 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add SOCK_STREAM support to L2CAP

if enable_ertm is true and we have SOCK_STREAM the default mode will be
ERTM, otherwise Basic Mode.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
84fb0a6334af0ccad3544f6972c055d90fbb9fbe 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add Kconfig option for L2CAP Extended Features

The L2CAP Extended Features are still unstable and under development,
so we are adding them under the EXPERIMENTAL flag to get more feedback
on them. L2CAP Extended Features includes the Enhanced Retransmission
and Streaming Modes, Frame Check Sequence (FCS), and Segmentation and
Reassemby (SAR).

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
2cap.c
3b1a9f3fa6ad842991538da2c3b2e29e047b131f 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Optimize SREJ_QUEUE append

When the I-frame received is the expected, i.e., its tx_seq is equal to
expected_tx_seq and we are under a SREJ, we can just add it to the tail
of the list. Doing that we change the complexity from O(n) to O(1).

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
812e737e29a1d559e7bfbea675fdcfcbad9f5e1f 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix drop of acked packets on ERTM

l2cap_drop_acked_frames() was droping not sent packets, causing them to
be not transmitted.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0ee0d20855ae9271de3f6695f4cafc08ab2533bb 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix crash when monitor timeout expires

The code was crashing due to a invalid access to hci_conn after the
channel disconnect.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f6e6b16823de0aff31cb8ee8c098383e3aceec58 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix bug when retransmitting I-frames

If there is no frames to retransmit l2cap was crashing the kernel, now
we check if the queue is empty first.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
68d7f0ce911e41e463c45911be031cdf6a096fe8 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Enable option to configure Max Transmission value via sockopt

With the sockopt extension we can set a per-channel MaxTx value.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
369ba30264826f38eefc61b93688100be8adbd4d 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add module parameter for txWindow size on L2CAP

Very useful for testing purposes.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
[jprvita@profusion.mobi: improved parameter description]
Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
803020c6fa63aa738cfda3329c9675b42023e9d2 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Change acknowledgement to use the value of txWindow

Now that we can set the txWindow we need to change the acknowledgement
procedure to ack after each (pi->txWindow/6 + 1). The plus 1 is to avoid
the zero value.
It also renames pi->num_to_ack to a better name: pi->num_acked.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
14b5aa71ec506f4e38ca6a1dc02ecd668ecfd902 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add sockopt configuration for txWindow on L2CAP

Now we can set/get Transmission Window size via sockopt.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
855666cccc939d392316de17512e17a08b2fa05a 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Send Ack after clear the SREJ list

As specified by Bluetooth 3.0 spec we shall send an acknowledgment using
the Send-Ack() after clear the SREJ list.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
052897ca5019d9157ae09e5e84eee2a9ef5dccc6 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check the SDU size against the MTU value

If the SDU size is greater than the MTU something is wrong, so report
an error.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
[jprvita@profusion.mobi: set err to appropriate errno value]
Signed-off-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
10467e9e9b89272b25b56688bb276d0830e9ab9a 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add le16 macro to Retransmission and Monitor Timeouts values

Fix a possible problem with Big Endian machines.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
1c7621596d11b9c3e19eb88a818758dee4901c95 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix configuration of the MPS value

We were accepting values bigger than we can accept. This was leading
ERTM to drop packets because of wrong FCS checks.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7b1c0049be3aabc18831ada339dbcf41ba8c81fd 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Read RFC conf option on a successful Conf RSP

On Enhanced Retransmission Mode and Streaming Mode a entity can send, on
a successful Conf RSP, new values for the RFC fields. For example, the
entity can send txWindow and MPS values less than the value received on
a Conf REQ.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2fb862e215e53630066c677e06d7551fa38bf235 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Ignore Tx Window value with Streaming mode

Tx Window value shall not be used with Streaming Mode and the receiver
of the config Request shall ignore its value.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c1b4f43be01c2a363be021485dd18cca33cfab8a 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add timer to Acknowledge I-frames

We ack I-frames on each txWindow/5 I-frames received, but if the sender
stop to send I-frames and it's not a txWindow multiple we can leave some
frames unacked.
So I added a timer to ack I-frames on this case. The timer expires in
200ms.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
05fbd89dd4153341717b33d9e8ae8bd29db6c1c8 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Finish implementation for Rec RR (P=1) on ERTM

Now the code handles the case under SREJ_SENT state.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8abb52ee00c4b3f857269eb6b7145991bab869bf 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Remove duplicate use of __get_reqseq() macro on L2CAP

tx_seq var already has the value of __get_reqseq().

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6e3a59819fac19006fe4255b87928e5a12c54532 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Group the ack of I-frames into l2cap_data_channel_rrframe()

It also fix a bug: we weren't acknowledging I-frames when P=1.
Note that when F=1 we are acknowledging packets before setting
RemoteBusy to False. The spec says we should do that in the opposite
order, but acknowledment of packets doesn't care about RemoteBusy flag
so we can do that in the order we want.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
99b0d4b7b09edeacf4542bced5c01239375b51a9 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Handle all cases of receipt of RNR-frames into L2CAP

We weren't handling the receipt under SREJ_SENT state table.
It also introduce l2cap_send_srejtail(). It will be used in the nexts
commits too.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e072745f4adb01b909bd08a0cfc8f79348f4d2c6 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Split l2cap_data_channel_sframe()

Create a function for each type fo S-frame and avoid a lot of nested
code.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
73edaa9933219e25d6733b78d1e2c881025705e2 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Add Recv RR (P=0)(F=0) for SREJ_SENT state on ERTM

This finishes the implementation of Recv RR (P=0)(F=0) for the Enhanced
Retransmission Mode on L2CAP.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f0946ccfc7da403a46b7ff7cb2e3deffac108742 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move set of P-bit to l2cap_send_sframe()

Abstract the send of of P-bit and avoids code duplication like we
did with the setting of F-bit.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9e917af13d59182f95bbb5483dc0c4254dfb7944 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Implement SendAck() Action on ERTM.

Shall be used to ack received frames, It must decide type of
acknowledgment between a RR frame, a RNR frame or transmission of
pending I-frames.
It also modifies l2cap_ertm_send() to report the number of frames sent.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
36f2fd585f43199f006a3b5ff84e95815102cd31 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check if SDU size is greater than MTU on L2CAP

After reassembly the SDU we need to check his size. It can't overflow
the MTU size.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
277ffbe362823d18a17792fbd8e507010e666299 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Check the minimum {I,S}-frame size into L2CAP

All packets with size fewer than the minimum specified is dropped.
Note that the size of the l2cap basic header, FCS and SAR fields are
already subtracted of len at the moment of the size check.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
1d8f5d16913d74e428950ee02fe9ff7e6391c120 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Support case with F bit set under WAIT_F state.

On receipt of a F=1 under WAIT_F state ERTM shall stop monitor timer and
start retransmission timer (if there are unacked frames).

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
d5392c8f1e9faef089bb7cb66c3314da8bddd1fe 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Implement 'Send IorRRorRNR' event

After receive a RR with P bit set ERTM shall use this funcion to choose
what type of frame to reply with F bit = 1.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e8235c6bdd1c7ffbaa7eb8dcdbb46c51f1e5d72e 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Use a l2cap_pinfo struct instead l2cap_pi() macro

Trivial clean up.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
d1daa091e8612f3aab14d28b5836375fafe155e1 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix ACL MTU issue

ERTM and Streaming Modes was having problems when the ACL MTU is lower
than MPS. The 'minus 10' is to take in account the header and fcs
lenghts.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7dffe4210233a2860c3f41477c40b3252edf2b7d 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix expected_tx_seq calculation on L2CAP

All operation related to the txWindow should be modulo 64.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
faaebd192ec9c3febcab98149d1309199a5b886c 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Fix memory leak of S-frames into L2CAP

l2cap_data_channel do not free the S-frame, so we free it here.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c69163e9ed5048407cc84f439cbfecc53f6f7131 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Move specific Basic Mode code to the right place

Inside "case L2CAP_MODE_BASIC:" we don't need to check for sk_type and
L2CAP mode. So only the length check is fine.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
b9dbdbc1f4404cba2e64939c30c87d59c9796e4e 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Trivial clean ups to SCO

Remove extra braces and labels, break over column 80 lines, etc

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
co.c
0d861d8b8edd139a9b291cb262d08dec8dc3922d 01-May-2010 Gustavo F. Padovan <padovan@profusion.mobi> Bluetooth: Make hci_send_sco() void

It also removes an unneeded check for the MTU. The check is done before
on sco_send_frame()

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Reviewed-by: João Paulo Rechi Vita <jprvita@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
co.c
7ef527377b88ff05fb122a47619ea506c631c914 03-May-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
477fffb082920476cc26f238d65538ccb8d601e1 22-Apr-2010 Dan Carpenter <error27@gmail.com> bluetooth: handle l2cap_create_connless_pdu() errors

l2cap_create_connless_pdu() can sometimes return ERR_PTR(-ENOMEM) or
ERR_PTR(-EFAULT).

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
aa395145165cb06a0d0885221bbe0ce4a564391d 20-Apr-2010 Eric Dumazet <eric.dumazet@gmail.com> net: sk_sleep() helper

Define a new function to return the waitqueue of a "struct sock".

static inline wait_queue_head_t *sk_sleep(struct sock *sk)
{
return sk->sk_sleep;
}

Change all read occurrences of sk_sleep by a call to this function.

Needed for a future RCU conversion. sk_sleep wont be a field directly
available.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
nep/core.c
nep/netdev.c
mtp/cmtp.h
mtp/core.c
idp/core.c
idp/hidp.h
2cap.c
fcomm/sock.c
co.c
871039f02f8ec4ab2e5e9010718caa8e085786f1 11-Apr-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/stmmac/stmmac_main.c
drivers/net/wireless/wl12xx/wl1271_cmd.c
drivers/net/wireless/wl12xx/wl1271_main.c
drivers/net/wireless/wl12xx/wl1271_spi.c
net/core/ethtool.c
net/mac80211/scan.c
4a35ecf8bf1c4b039503fa554100fe85c761de76 07-Apr-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/bonding/bond_main.c
drivers/net/via-velocity.c
drivers/net/wireless/iwlwifi/iwl-agn.c
cb4361c1dc29cd870f664c004b1817106fbce0fa 06-Apr-2010 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (37 commits)
smc91c92_cs: fix the problem of "Unable to find hardware address"
r8169: clean up my printk uglyness
net: Hook up cxgb4 to Kconfig and Makefile
cxgb4: Add main driver file and driver Makefile
cxgb4: Add remaining driver headers and L2T management
cxgb4: Add packet queues and packet DMA code
cxgb4: Add HW and FW support code
cxgb4: Add register, message, and FW definitions
netlabel: Fix several rcu_dereference() calls used without RCU read locks
bonding: fix potential deadlock in bond_uninit()
net: check the length of the socket address passed to connect(2)
stmmac: add documentation for the driver.
stmmac: fix kconfig for crc32 build error
be2net: fix bug in vlan rx path for big endian architecture
be2net: fix flashing on big endian architectures
be2net: fix a bug in flashing the redboot section
bonding: bond_xmit_roundrobin() fix
drivers/net: Add missing unlock
net: gianfar - align BD ring size console messages
net: gianfar - initialize per-queue statistics
...
22bedad3ce112d5ca1eaf043d4990fa2ed698c87 01-Apr-2010 Jiri Pirko <jpirko@redhat.com> net: convert multicast list to list_head

Converts the list and the core manipulating with it to be the same as uc_list.

+uses two functions for adding/removing mc address (normal and "global"
variant) instead of a function parameter.
+removes dev_mcast.c completely.
+exposes netdev_hw_addr_list_* macros along with __hw_addr_* functions for
manipulation with lists on a sandbox (used in bonding and 80211 drivers)

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
6503d96168f891ffa3b70ae6c9698a1a722025a0 01-Apr-2010 Changli Gao <xiaosuo@gmail.com> net: check the length of the socket address passed to connect(2)

check the length of the socket address passed to connect(2).

Check the length of the socket address passed to connect(2). If the
length is invalid, -EINVAL will be returned.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
----
net/bluetooth/l2cap.c | 3 ++-
net/bluetooth/rfcomm/sock.c | 3 ++-
net/bluetooth/sco.c | 3 ++-
net/can/bcm.c | 3 +++
net/ieee802154/af_ieee802154.c | 3 +++
net/ipv4/af_inet.c | 5 +++++
net/netlink/af_netlink.c | 3 +++
7 files changed, 20 insertions(+), 3 deletions(-)
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
fcomm/sock.c
co.c
5a0e3ad6af8660be21ca98a971cd00f331318c05 24-Mar-2010 Tejun Heo <tj@kernel.org> include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.

percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.

http://userweb.kernel.org/~tj/misc/slabh-sweep.py

The script does the followings.

* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.

* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.

* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.

The conversion was done in the following steps.

1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.

2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.

3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.

4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.

5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.

6. percpu.h was updated not to include slab.h.

7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).

* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig

8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.

Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.

Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
f_bluetooth.c
nep/core.c
nep/netdev.c
nep/sock.c
mtp/sock.c
ci_sysfs.c
idp/sock.c
fcomm/core.c
c2c77ec83bdad17fb688557b5b3fdc36661dd1c6 19-Mar-2010 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Fix kernel crash on L2CAP stress tests

Added very simple check that req buffer has enough space to
fit configuration parameters. Shall be enough to reject packets
with configuration size more than req buffer.

Crash trace below

[ 6069.659393] Unable to handle kernel paging request at virtual address 02000205
[ 6069.673034] Internal error: Oops: 805 [#1] PREEMPT
...
[ 6069.727172] PC is at l2cap_add_conf_opt+0x70/0xf0 [l2cap]
[ 6069.732604] LR is at l2cap_recv_frame+0x1350/0x2e78 [l2cap]
...
[ 6070.030303] Backtrace:
[ 6070.032806] [<bf1c2880>] (l2cap_add_conf_opt+0x0/0xf0 [l2cap]) from
[<bf1c6624>] (l2cap_recv_frame+0x1350/0x2e78 [l2cap])
[ 6070.043823] r8:dc5d3100 r7:df2a91d6 r6:00000001 r5:df2a8000 r4:00000200
[ 6070.050659] [<bf1c52d4>] (l2cap_recv_frame+0x0/0x2e78 [l2cap]) from
[<bf1c8408>] (l2cap_recv_acldata+0x2bc/0x350 [l2cap])
[ 6070.061798] [<bf1c814c>] (l2cap_recv_acldata+0x0/0x350 [l2cap]) from
[<bf0037a4>] (hci_rx_task+0x244/0x478 [bluetooth])
[ 6070.072631] r6:dc647700 r5:00000001 r4:df2ab740
[ 6070.077362] [<bf003560>] (hci_rx_task+0x0/0x478 [bluetooth]) from
[<c006b9fc>] (tasklet_action+0x78/0xd8)
[ 6070.087005] [<c006b984>] (tasklet_action+0x0/0xd8) from [<c006c160>]

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <gustavo@padovan.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
aef7d97cc604309b66f6f45cce02cd734934cd4e 21-Mar-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Convert debug files to actually use debugfs instead of sysfs

Some of the debug files ended up wrongly in sysfs, because at that point
of time, debugfs didn't exist. Convert these files to use debugfs and
also seq_file. This patch converts all of these files at once and then
removes the exported symbol for the Bluetooth sysfs class.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
101545f6fef4a0a3ea8daf0b5b880df2c6a92a69 15-Mar-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix potential bad memory access with sysfs files

When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.

Based on initial patches from Neil Brown and Linus Torvalds

Reported-by: Neil Brown <neilb@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
ff6e2163f28a1094fb5ca5950fe2b43c3cf6bc7a 01-Mar-2010 Jiri Pirko <jpirko@redhat.com> net: convert multiple drivers to use netdev_for_each_mc_addr, part7

In mlx4, using char * to store mc address in private structure instead.

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
d89b218b801fd93ea95880f1c7fde348cbcc51c5 13-Mar-2010 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (108 commits)
bridge: ensure to unlock in error path in br_multicast_query().
drivers/net/tulip/eeprom.c: fix bogus "(null)" in tulip init messages
sky2: Avoid rtnl_unlock without rtnl_lock
ipv6: Send netlink notification when DAD fails
drivers/net/tg3.c: change the field used with the TG3_FLAG_10_100_ONLY constant
ipconfig: Handle devices which take some time to come up.
mac80211: Fix memory leak in ieee80211_if_write()
mac80211: Fix (dynamic) power save entry
ipw2200: use kmalloc for large local variables
ath5k: read eeprom IQ calibration values correctly for G mode
ath5k: fix I/Q calibration (for real)
ath5k: fix TSF reset
ath5k: use fixed antenna for tx descriptors
libipw: split ieee->networks into small pieces
mac80211: Fix sta_mtx unlocking on insert STA failure path
rt2x00: remove KSEG1ADDR define from rt2x00soc.h
net: add ColdFire support to the smc91x driver
asix: fix setting mac address for AX88772
ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.
net: Fix dev_mc_add()
...
28812fe11a21826ba4c97c6c7971a619987cd912 05-Jan-2010 Andi Kleen <andi@firstfloor.org> driver-core: Add attribute argument to class_attribute show/store

Passing the attribute to the low level IO functions allows all kinds
of cleanups, by sharing low level IO code without requiring
an own function for every piece of data.

Also drivers can extend the attributes with own data fields
and use that in the low level function.

This makes the class attributes the same as sysdev_class attributes
and plain attributes.

This will allow further cleanups in drivers.

Full tree sweep converting all users.

Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
d4612cb86ed8db8956b6b19435f8a30de6c67ffe 02-Mar-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use single_open() for inquiry cache within debugfs

The inquiry cache information in debugfs should be using seq_file support
and not allocating memory on the stack for the string. Since the usage of
these information is really seldom, using single_open() for it is good
enough.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
47871889c601d8199c51a4086f77eebd77c29b0b 01-Mar-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

Conflicts:
drivers/firmware/iscsi_ibft.c
f6e623a65cb301088bd04794043e82bfc996c512 15-Feb-2010 Johann Felix Soden <johfel@users.sourceforge.net> Bluetooth: Fix out of scope variable access in hci_sock_cmsg()

The pointer data can point to the variable ctv.
Access to data happens when ctv is already out of scope.

Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
705e5711b61e9622b2d88850f38c219014aa0780 16-Feb-2010 Stephen Coe <smcoe1@gmail.com> Bluetooth: Add SCO fallback for unsupported feature error

The Bluetooth SIG PTS test case: TC_AG_ACS_BV_10_I, rejects eSCO with
"Unsupported Feature or Parameter Value" (0x11). This patch adds case
for SCO fallback.

2007-09-20 12:20:37.787747 > HCI Event: Number of Completed Packets (0x13) plen 5
handle 38 packets 1
2007-09-20 12:20:37.842154 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 38 voice setting 0x0060
2007-09-20 12:20:37.847037 > HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2007-09-20 12:20:37.855233 > HCI Event: Max Slots Change (0x1b) plen 3
handle 38 slots 1
2007-09-20 12:20:39.913354 > HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x11 handle 38 bdaddr 00:16:93:01:01:7A type eSCO
Error: Unsupported Feature or Parameter Value
2007-09-20 12:20:39.922629 > HCI Event: Max Slots Change (0x1b) plen 3
handle 38 slots 5
2007-09-20 12:20:58.126886 < ACL data: handle 38 flags 0x02 dlen 8
L2CAP(d): cid 0x0041 len 4 [psm 0]
0000: 0b 53 01 b8 .S..
2007-09-20 12:20:58.130138 > HCI Event: Number of Completed Packets (0x13) plen 5
handle 38 packets 1

Signed-off-by: Stephen Coe <smcoe1@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
943da25d95c7e8fd8c39dbf09e030f5da46f5d85 13-Feb-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add controller types for BR/EDR and 802.11 AMP

With the Bluetooth 3.0 specification and the introduction of alternate
MAC/PHY (AMP) support, it is required to differentiate between primary
BR/EDR controllers and 802.11 AMP controllers. So introduce a special
type inside HCI device for differentiation.

For now all AMP controllers will be treated as raw devices until an
AMP manager has been implemented.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
ca325f698996c1a0770a67f41e7dc97a007d8bc2 08-Feb-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Convert inquiry cache to use debugfs instead of sysfs

The output of the inquiry cache is only useful for debugging purposes
and so move it into debugfs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
c13854cef4751000b968d4e8ac95796562d5b96f 08-Feb-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Convert controller hdev->type to hdev->bus

The hdev->type is misnamed and should be actually hdev->bus instead. So
convert it now.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
a85821fce2c100a6680511f9693b76f9717fbdee 25-Feb-2010 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (41 commits)
HID: usbhid: initialize interface pointers early enough
HID: extend mask for BUTTON usage page
HID: hid-ntrig: Single touch mode tap
HID: hid-ntrig: multitouch cleanup and fix
HID: n-trig: remove unnecessary tool switching
HID: hid-ntrig add multi input quirk and clean up
HID: usbhid: introduce timeout for stuck ctrl/out URBs
HID: magicmouse: coding style and probe failure fixes
HID: remove MODULE_VERSION from new drivers
HID: fix up Kconfig entry for MagicMouse
HID: add a device driver for the Apple Magic Mouse.
HID: Export hid_register_report
HID: Support for MosArt multitouch panel
HID: add pressure support for the Stantum multitouch panel
HID: fixed bug in single-touch emulation on the stantum panel
HID: fix typo in error message
HID: add mapping for "AL Network Chat" usage
HID: use multi input quirk for TouchPack touchscreen
HID: make full-fledged hid-bus drivers properly selectable
HID: make Wacom modesetting failures non-fatal
...
4cd24eaf0c6ee7f0242e34ee77ec899f255e66b5 08-Feb-2010 Jiri Pirko <jpirko@redhat.com> net: use netdev_mc_count and netdev_mc_empty when appropriate

This patch replaces dev->mc_count in all drivers (hopefully I didn't miss
anything). Used spatch and did small tweaks and conding style changes when
it was suitable.

Jirka

Signed-off-by: Jiri Pirko <jpirko@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
b1109bf085c8dd69537b7876ea83f914dd1fe46a 09-Feb-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
15c697ce1c5b408c5e20dcdc6aea2968d1125b75 05-Feb-2010 Michael Poole <mdpoole@troilus.org> Bluetooth: Keep a copy of each HID device's report descriptor

The report descriptor is read by user space (via the Service
Discovery Protocol), so it is only available during the ioctl
to connect. However, the HID probe function that needs the
descriptor might not be called until a specific module is
loaded. Keep a copy of the descriptor so it is available for
later use.

Signed-off-by: Michael Poole <mdpoole@troilus.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
idp/hidp.h
9c119ba54c0fcae72881948af3d37b47a2f8e1f9 04-Feb-2010 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
c390216b3e868b16d8154939f4b6f8c16dbd9a9f 13-Nov-2009 Nick Pelly <npelly@google.com> Bluetooth: Enter active mode before establishing a SCO link.

When in sniff mode with a long interval time (1.28s) it can take 4+ seconds
to establish a SCO link. Fix by requesting active mode before requesting
SCO connection. This improves SCO setup time to ~500ms.

Bluetooth headsets that use a long interval time, and exhibit the long
SCO connection time include Motorola H790, HX1 and H17. They have a
CSR 2.1 chipset.

Verified this behavior and fix with host Bluetooth chipsets: BCM4329 and
TI1271.

2009-10-13 14:17:46.183722 > HCI Event: Mode Change (0x14) plen 6
status 0x00 handle 1 mode 0x02 interval 2048
Mode: Sniff
2009-10-13 14:17:53.436285 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 1 voice setting 0x0060
2009-10-13 14:17:53.445593 > HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-10-13 14:17:57.788855 > HCI Event: Synchronous Connect Complete 0x2c) plen 17
status 0x00 handle 257 bdaddr 00:1A:0E:F1:A4:7F type eSCO
Air mode: CVSD

Signed-off-by: Nick Pelly <npelly@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
6c2718da59613d76013b501bf0f8bcf9d7794b2d 04-Feb-2010 Nick Pelly <npelly@google.com> Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket

When processing a RFCOMM UA frame when the socket is closed and we were
not the RFCOMM initiator would cause rfcomm_session_put() to be called
twice during rfcomm_process_rx(). This would cause a kernel panic in
rfcomm_session_close() then.

This could be easily reproduced during disconnect with devices such as
Motorola H270 that send RFCOMM UA followed quickly by L2CAP disconnect
request. This trace for this looks like:

2009-09-21 17:22:37.788895 < ACL data: handle 1 flags 0x02 dlen 8
L2CAP(d): cid 0x0041 len 4 [psm 3]
RFCOMM(s): DISC: cr 0 dlci 20 pf 1 ilen 0 fcs 0x7d
2009-09-21 17:22:37.906204 > HCI Event: Number of Completed Packets (0x13) plen 5
handle 1 packets 1
2009-09-21 17:22:37.933090 > ACL data: handle 1 flags 0x02 dlen 8
L2CAP(d): cid 0x0040 len 4 [psm 3]
RFCOMM(s): UA: cr 0 dlci 20 pf 1 ilen 0 fcs 0x57
2009-09-21 17:22:38.636764 < ACL data: handle 1 flags 0x02 dlen 8
L2CAP(d): cid 0x0041 len 4 [psm 3]
RFCOMM(s): DISC: cr 0 dlci 0 pf 1 ilen 0 fcs 0x9c
2009-09-21 17:22:38.744125 > HCI Event: Number of Completed Packets (0x13) plen 5
handle 1 packets 1
2009-09-21 17:22:38.763687 > ACL data: handle 1 flags 0x02 dlen 8
L2CAP(d): cid 0x0040 len 4 [psm 3]
RFCOMM(s): UA: cr 0 dlci 0 pf 1 ilen 0 fcs 0xb6
2009-09-21 17:22:38.783554 > ACL data: handle 1 flags 0x02 dlen 12
L2CAP(s): Disconn req: dcid 0x0040 scid 0x0041

Avoid calling rfcomm_session_put() twice by skipping this call
in rfcomm_recv_ua() if the socket is closed.

Signed-off-by: Nick Pelly <npelly@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
485f1eff73a7b932fd3abb0dfcf804e1a1f59025 04-Feb-2010 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix sleeping function in RFCOMM within invalid context

With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:

BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P 2.6.32 #31
Call Trace:
<IRQ> [<ffffffff81036455>] __might_sleep+0xf8/0xfa
[<ffffffff8138ef1d>] lock_sock_nested+0x29/0xc4
[<ffffffffa03921b3>] lock_sock+0xb/0xd [l2cap]
[<ffffffffa03948e6>] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
[<ffffffff8106adea>] ? clockevents_program_event+0x75/0x7e
[<ffffffff8106bea2>] ? tick_dev_program_event+0x37/0xa5
[<ffffffffa0394967>] l2cap_sock_release+0x27/0x67 [l2cap]
[<ffffffff8138c971>] sock_release+0x1a/0x67
[<ffffffffa03d2492>] rfcomm_session_del+0x34/0x53 [rfcomm]
[<ffffffffa03d24c5>] rfcomm_session_put+0x14/0x16 [rfcomm]
[<ffffffffa03d28b4>] rfcomm_session_timeout+0xe/0x1a [rfcomm]
[<ffffffff810554a8>] run_timer_softirq+0x1e2/0x29a
[<ffffffffa03d28a6>] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
[<ffffffff8104e0f6>] __do_softirq+0xfe/0x1c5
[<ffffffff8100e8ce>] ? timer_interrupt+0x1a/0x21
[<ffffffff8100cc4c>] call_softirq+0x1c/0x28
[<ffffffff8100e05b>] do_softirq+0x33/0x6b
[<ffffffff8104daf6>] irq_exit+0x36/0x85
[<ffffffff8100d7a9>] do_IRQ+0xa6/0xbd
[<ffffffff8100c493>] ret_from_intr+0x0/0xa
<EOI> [<ffffffff812585b3>] ? acpi_idle_enter_bm+0x269/0x294
[<ffffffff812585a9>] ? acpi_idle_enter_bm+0x25f/0x294
[<ffffffff81373ddc>] ? cpuidle_idle_call+0x97/0x107
[<ffffffff8100aca0>] ? cpu_idle+0x53/0xaa
[<ffffffff81429006>] ? rest_init+0x7a/0x7c
[<ffffffff8177bc8c>] ? start_kernel+0x389/0x394
[<ffffffff8177b29c>] ? x86_64_start_reservations+0xac/0xb0
[<ffffffff8177b384>] ? x86_64_start_kernel+0xe4/0xeb

To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: David John <davidjon@xenontk.org>
fcomm/core.c
1038a00b458997661bcd0e780a24dc280a8841fc 03-Feb-2010 Nick Pelly <npelly@google.com> Bluetooth: Fallback eSCO to SCO on error 0x1a (Unsupported Remote Feature)

General Motors carkits that use LGE BT chipsets return this error code
when an eSCO is attempted, despite advertising eSCO support.

2009-08-13 14:41:39.755518 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 1 voice setting 0x0060
2009-08-13 14:41:39.757563 > HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-08-13 14:41:39.789484 > HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x1a handle 257 bdaddr 00:1E:B2:23:5E:B3 type eSCO
Error: Unsupported Remote Feature / Unsupported LMP Feature

Signed-off-by: Jaikumar Ganesh <jaikumar@google.com>
Signed-off-by: Nick Pelly <npelly@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
d4bfa033ed84e0ae446eff445d107ffd5ee78df3 29-Jan-2010 Jiri Kosina <jkosina@suse.cz> HID: make raw reports possible for both feature and output reports

In commit 2da31939a42 ("Bluetooth: Implement raw output support for HIDP
layer"), support for Bluetooth hid_output_raw_report was added, but it
pushes the data to the intr socket instead of the ctrl one. This has been
fixed by 6bf8268f9a91f1 ("Bluetooth: Use the control channel for raw HID reports")

Still, it is necessary to distinguish whether the report in question should be
either FEATURE or OUTPUT. For this, we have to extend the generic HID API,
so that hid_output_raw_report() callback provides means to specify this
value so that it can be passed down to lower level hardware drivers (currently
Bluetooth and USB).

Based on original patch by Bastien Nocera <hadess@hadess.net>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
6bf8268f9a91f1065c99503161ebd061492bebe3 20-Jan-2010 Bastien Nocera <hadess@hadess.net> Bluetooth: Use the control channel for raw HID reports

In commit 2da31939a42f7a676a0bc5155d6a0a39ed8451f2, support
for Bluetooth hid_output_raw_report was added, but it pushes
the data to the interrupt channel instead of the contol one.

This patch makes hid_output_raw_report use the control channel
instead. Using the interrupt channel was a mistake.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
e420aba331f44de0eed6871441293a6124d566d1 23-Dec-2009 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Fix memory leak in L2CAP

Move skb_clone after error confition check so it is not going
potentially out of the scope.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcafde2e6d81aa7901f9b10e6a097592f0637b79 22-Dec-2009 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Remove double free of SKB pointer in L2CAP

Trivial fix for double free of SKB pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9a58a80a701bdb2d220cdab4914218df5b48d781 14-Jan-2010 Alexey Dobriyan <adobriyan@gmail.com> proc_fops: convert drivers/isdn/ to seq_file

Convert code away from ->read_proc/->write_proc interfaces. Switch to
proc_create()/proc_create_data() which make addition of proc entries
reliable wrt NULL ->proc_fops, NULL ->data and so on.

Problem with ->read_proc et al is described here commit
786d7e1612f0b0adb6046f19b906609e4fe8b1ba "Fix rmmod/read/write races in
/proc entries"

[akpm@linux-foundation.org: CONFIG_PROC_FS=n build fix]
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: Karsten Keil <keil@b1-systems.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
mtp/capi.c
b13f5860447a98daf0358a51fbff66154ac0663a 15-Dec-2009 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Fix L2CAP locking scheme regression

When locking was introduced the error path branch was not taken
into account. Error was found in sparse code checking. Kudos to
Jani Nikula.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
186ee8cf0130993dea8ab8867ff1af8a148f9ae6 15-Dec-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Ack L2CAP I-frames before retransmit missing packet

Moving the Ack to before l2cap_retransmit_frame() we can avoid the
case where txWindow is full and the packet can't be retransmited.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
186de9a33803c7ee20d9af75c9049b50e68a3a08 15-Dec-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix unset of RemoteBusy flag for L2CAP

RemoteBusy flag need to be unset before l2cap_ertm_send(), otherwise
l2cap_ertm_send() will return without sending packets because it checks
that flag before start sending.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
971beb83aeb2a309175682cf5683d64fd4591841 07-Dec-2009 Roel Kluin <roel.kluin@gmail.com> Bluetooth: Fix PTR_ERR return of wrong pointer in hidp_setup_hid()

Return the PTR_ERR of the correct pointer.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
4ef58d4e2ad1fa2a3e5bbf41af2284671fca8cf8 10-Dec-2009 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (42 commits)
tree-wide: fix misspelling of "definition" in comments
reiserfs: fix misspelling of "journaled"
doc: Fix a typo in slub.txt.
inotify: remove superfluous return code check
hdlc: spelling fix in find_pvc() comment
doc: fix regulator docs cut-and-pasteism
mtd: Fix comment in Kconfig
doc: Fix IRQ chip docs
tree-wide: fix assorted typos all over the place
drivers/ata/libata-sff.c: comment spelling fixes
fix typos/grammos in Documentation/edac.txt
sysctl: add missing comments
fs/debugfs/inode.c: fix comment typos
sgivwfb: Make use of ARRAY_SIZE.
sky2: fix sky2_link_down copy/paste comment error
tree-wide: fix typos "couter" -> "counter"
tree-wide: fix typos "offest" -> "offset"
fix kerneldoc for set_irq_msi()
spidev: fix double "of of" in comment
comment typo fix: sybsystem -> subsystem
...
d014d043869cdc591f3a33243d3481fa4479c2d0 07-Dec-2009 Jiri Kosina <jkosina@suse.cz> Merge branch 'for-next' into for-linus

Conflicts:

kernel/irq/chip.c
94e2bd688820aed72b4f8092f88c2ccf64e003de 16-Oct-2009 Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com> tree-wide: fix some typos and punctuation in comments

fix some typos and punctuation in comments

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
nep/core.c
eae38eede2e5f70d65f09327297bd698b0d3ea7e 05-Oct-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add RFCOMM option to use L2CAP ERTM mode

By default the RFCOMM layer would still use L2CAP basic mode. For testing
purposes this option enables RFCOMM to select enhanced retransmission
mode.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
5fbcd3d1a07e234583e17830e8aef47282c22141 05-Oct-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add L2CAP option for max transmit value

For testing purposes it is important to modify the max transmit value.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2ab25cdd7b54473dd42dcffc9872737de2517466 03-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix 'SendRRorRNR' to send the ReqSeq value

SendRRorRNR needs to acknowledge received I-frames (actually every packet
needs to acknowledge received I-frames by sending the proper packet
sequence number), so ReqSeq is set to the next I-frame number sequence to
be pulled by the reassembly function.
SendRRorRNR tells the remote side about local busy conditions, it sends
a Receiver Ready frame if local busy is false or a Receiver Not Ready
if local busy is true.
ReqSeq is the packet's field to send the number of the acknowledged
packets.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4ec10d9720ef78cd81d8bcc30a3238665744569f 03-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Implement RejActioned flag

RejActioned is used to prevent retransmission when a entity is on the
WAIT_F state, i.e., waiting for a frame with F-bit set due local busy
condition or a expired retransmission timer. (When these two events raise
they send a frame with the Poll bit set and enters in the WAIT_F state to
wait for a frame with the Final bit set.)
The local entity doesn't send I-frames(the data frames) until the receipt
of a frame with F-bit set. When that happens it also set RejActioned to false.
RejActioned is a mandatory feature of ERTM spec.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9f121a5a80b4417c6db5a35e26d2e79c29c3fc0d 03-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix sending ReqSeq on I-frames

As specified by ERTM spec an ERTM channel can acknowledge received
I-frames(the data frames) by sending an I-frame with the proper ReqSeq
value (i.e. ReqSeq is set to BufferSeq). Until now we aren't setting the
ReqSeq value on I-frame control bits. That way we can save sending
S-frames(Supervise frames) only to acknowledge receipt of I-frames. It
is very helpful to the full-duplex channel.
ReqSeq is the packet sequence number sent in an acknowledgement frame to
acknowledge receipt of frames up to (ReqSeq - 1).
BufferSeq controls the receiver buffer, it is used to delay
acknowledgement of new frames to not cause buffer overflow. BufferSeq
value is not increased until frames are pulled by reassembly function.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
889a3ca466018ab68363c3168993793bc2d984f1 03-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix unset of SrejActioned flag

SrejActioned is a flag that when set prevents local side to retransmit a
I-frame(the data frame) already retransmitted. The local entity can
retransmit again only when it receives a SREJ frame with the F-bit set.
SREJ frame - Selective Reject frame - is sent when an entity wants the
retransmission of a specific I-frame that was lost or corrupted.
This bug can put ERTM in an unknown state once the entity can't
retransmit.
A frame with the Final bit set is expected when the local side sends a
frame with the Poll bit set due to a local busy condition or a
retransmission timer expired. (Receipt of P-bit shall always be replied by
a frame with the F-bit set).
pi->conn_state keeps informations about many ERTM flags including
SrejActioned.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0565c1c24af94130b891f989fa608faddfadc52c 03-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Initialize variables and timers for both channel's sides

Fix ERTM's full-duplex channel to work as specified by ERTM spec. ERTM
needs to handle state vars, timers and counters to send and receive
I-frames(the data frames), i.e., for both sides of data communication.
We initialize all of them to the default values here.
Full-duplex channel is a mandatory feature of ERTM spec.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
cde9f807f003676862178a6f28b52c7d431511ed 03-Dec-2009 Vikram Kandukuri <vkandukuri@atheros.com> Bluetooth: Fix handling of BNEP setup connection requests

According to BNEP test specification the proper response should be sent
for a setup connection request message after the BNEP connection setup
has been completed.

Signed-off-by: Vikram Kandukuri <vikram.kandukuri@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
c78ae283145d3a8799b2fb01650166a66af3bff8 18-Nov-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Unobfuscate tasklet_schedule usage

The tasklet schedule function helpers are just an obfuscation. So remove
them and call the schedule functions directly.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ci_sock.c
76bca88012e1d27de794f32cc551d6314d38b6d9 18-Nov-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Turn hci_recv_frame into an exported function

For future simplification it is important that the hci_recv_frame
function is no longer an inline function. So move it into the module
itself and export it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
7e21addcd0ad87696c17409399e56e874931da57 18-Nov-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Return ENETDOWN when interface is down

Sending commands to a down interface results in a timeout while clearly
it should just return ENETDOWN. When using the ioctls this works fine,
but not when using the HCI sockets sendmsg interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
2da31939a42f7a676a0bc5155d6a0a39ed8451f2 26-Nov-2009 Jiri Kosina <jkosina@suse.cz> Bluetooth: Implement raw output support for HIDP layer

Implement raw output callback which is used by hidraw to send raw data to
the underlying device.

Without this patch, the userspace hidraw-based applications can't send
output reports to HID Bluetooth devices.

Reported-and-tested-by: Brian Gunn <bgunn@solekai.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
f64f9e719261a87818dd192a3a2352e5b20fbd0f 30-Nov-2009 Joe Perches <joe@perches.com> net: Move && and || to end of previous line

Not including net/atm/

Compiled tested x86 allyesconfig only
Added a > 80 column line or two, which I ignored.
Existing checkpatch plaints willfully, cheerfully ignored.

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
a2bfbc072e279ff81e6b336acff612b9bc2e5281 17-Nov-2009 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/can/Kconfig
68ae6639b6dff117ba37f648f1611a4629abadf0 18-Oct-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix regression with L2CAP configuration in Basic Mode

Basic Mode is the default mode of operation of a L2CAP entity. In
this case the RFC (Retransmission and Flow Control) configuration
option should not be used at all.

Normally remote L2CAP implementation should just ignore this option,
but it can cause various side effects with other Bluetooth stacks
that are not capable of handling unknown options.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
a0e55a32afc2130e5ae506755e4b8eb42a23b568 29-Sep-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Select Basic Mode as default for SOCK_SEQPACKET

The default mode for SOCK_SEQPACKET is Basic Mode. So when no
mode has been specified, Basic Mode shall be used.

This is important for current application to keep working as
expected and not cause a regression.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
93f19c9fc8c98bb6d2e9825115989603ffd5cd1f 02-Sep-2009 Andrei Emeltchenko <andrei.emeltchenko@nokia.com> Bluetooth: Set general bonding security for ACL by default

This patch fixes double pairing issues with Secure Simple
Paring support. It was observed that when pairing with SSP
enabled, that the confirmation will be asked twice.

http://www.spinics.net/lists/linux-bluetooth/msg02473.html

This also causes bug when initiating SSP connection from
Windows Vista.

The reason is because bluetoothd does not store link keys
since HCIGETAUTHINFO returns 0. Setting default to general
bonding fixes these issues.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
c84b3268da3b85c9d8a9e504e1001a14ed829e94 06-Nov-2009 Eric Paris <eparis@redhat.com> net: check kern before calling security subsystem

Before calling capable(CAP_NET_RAW) check if this operations is on behalf
of the kernel or on behalf of userspace. Do not do the security check if
it is on behalf of the kernel.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
3f378b684453f2a028eda463ce383370545d9cc9 06-Nov-2009 Eric Paris <eparis@redhat.com> net: pass kern to net_proto_family create function

The generic __sock_create function has a kern argument which allows the
security system to make decisions based on if a socket is being created by
the kernel or by userspace. This patch passes that flag to the
net_proto_family specific create function, so it can do the same thing.

Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
cfadf853f6cd9689f79a63ca960c6f9d6665314f 27-Oct-2009 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
drivers/net/sh_eth.c
45054dc1bf2367ccb0e7c0486037907cd9395f8b 18-Oct-2009 Dave Young <hidave.darkstar@gmail.com> bluetooth: static lock key fix

When shutdown ppp connection, lockdep waring about non-static key
will happen, it is caused by the lock is not initialized properly
at that time.

Fix with tuning the lock/skb_queue_head init order

[ 94.339261] INFO: trying to register non-static key.
[ 94.342509] the code is fine but needs lockdep annotation.
[ 94.342509] turning off the locking correctness validator.
[ 94.342509] Pid: 0, comm: swapper Not tainted 2.6.31-mm1 #2
[ 94.342509] Call Trace:
[ 94.342509] [<c0248fbe>] register_lock_class+0x58/0x241
[ 94.342509] [<c024b5df>] ? __lock_acquire+0xb57/0xb73
[ 94.342509] [<c024ab34>] __lock_acquire+0xac/0xb73
[ 94.342509] [<c024b7fa>] ? lock_release_non_nested+0x17b/0x1de
[ 94.342509] [<c024b662>] lock_acquire+0x67/0x84
[ 94.342509] [<c04cd1eb>] ? skb_dequeue+0x15/0x41
[ 94.342509] [<c054a857>] _spin_lock_irqsave+0x2f/0x3f
[ 94.342509] [<c04cd1eb>] ? skb_dequeue+0x15/0x41
[ 94.342509] [<c04cd1eb>] skb_dequeue+0x15/0x41
[ 94.342509] [<c054a648>] ? _read_unlock+0x1d/0x20
[ 94.342509] [<c04cd641>] skb_queue_purge+0x14/0x1b
[ 94.342509] [<fab94fdc>] l2cap_recv_frame+0xea1/0x115a [l2cap]
[ 94.342509] [<c024b5df>] ? __lock_acquire+0xb57/0xb73
[ 94.342509] [<c0249c04>] ? mark_lock+0x1e/0x1c7
[ 94.342509] [<f8364963>] ? hci_rx_task+0xd2/0x1bc [bluetooth]
[ 94.342509] [<fab95346>] l2cap_recv_acldata+0xb1/0x1c6 [l2cap]
[ 94.342509] [<f8364997>] hci_rx_task+0x106/0x1bc [bluetooth]
[ 94.342509] [<fab95295>] ? l2cap_recv_acldata+0x0/0x1c6 [l2cap]
[ 94.342509] [<c02302c4>] tasklet_action+0x69/0xc1
[ 94.342509] [<c022fbef>] __do_softirq+0x94/0x11e
[ 94.342509] [<c022fcaf>] do_softirq+0x36/0x5a
[ 94.342509] [<c022fe14>] irq_exit+0x35/0x68
[ 94.342509] [<c0204ced>] do_IRQ+0x72/0x89
[ 94.342509] [<c02038ee>] common_interrupt+0x2e/0x34
[ 94.342509] [<c024007b>] ? pm_qos_add_requirement+0x63/0x9d
[ 94.342509] [<c038e8a5>] ? acpi_idle_enter_bm+0x209/0x238
[ 94.342509] [<c049d238>] cpuidle_idle_call+0x5c/0x94
[ 94.342509] [<c02023f8>] cpu_idle+0x4e/0x6f
[ 94.342509] [<c0534153>] rest_init+0x53/0x55
[ 94.342509] [<c0781894>] start_kernel+0x2f0/0x2f5
[ 94.342509] [<c0781091>] i386_start_kernel+0x91/0x96

Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Tested-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
f74c77cb1124a11acf69c98d10c0fdc22f322664 18-Oct-2009 Dave Young <hidave.darkstar@gmail.com> bluetooth: scheduling while atomic bug fix

Due to driver core changes dev_set_drvdata will call kzalloc which should be
in might_sleep context, but hci_conn_add will be called in atomic context

Like dev_set_name move dev_set_drvdata to work queue function.

oops as following:

Oct 2 17:41:59 darkstar kernel: [ 438.001341] BUG: sleeping function called from invalid context at mm/slqb.c:1546
Oct 2 17:41:59 darkstar kernel: [ 438.001345] in_atomic(): 1, irqs_disabled(): 0, pid: 2133, name: sdptool
Oct 2 17:41:59 darkstar kernel: [ 438.001348] 2 locks held by sdptool/2133:
Oct 2 17:41:59 darkstar kernel: [ 438.001350] #0: (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.+.}, at: [<faa1d2f5>] lock_sock+0xa/0xc [l2cap]
Oct 2 17:41:59 darkstar kernel: [ 438.001360] #1: (&hdev->lock){+.-.+.}, at: [<faa20e16>] l2cap_sock_connect+0x103/0x26b [l2cap]
Oct 2 17:41:59 darkstar kernel: [ 438.001371] Pid: 2133, comm: sdptool Not tainted 2.6.31-mm1 #2
Oct 2 17:41:59 darkstar kernel: [ 438.001373] Call Trace:
Oct 2 17:41:59 darkstar kernel: [ 438.001381] [<c022433f>] __might_sleep+0xde/0xe5
Oct 2 17:41:59 darkstar kernel: [ 438.001386] [<c0298843>] __kmalloc+0x4a/0x15a
Oct 2 17:41:59 darkstar kernel: [ 438.001392] [<c03f0065>] ? kzalloc+0xb/0xd
Oct 2 17:41:59 darkstar kernel: [ 438.001396] [<c03f0065>] kzalloc+0xb/0xd
Oct 2 17:41:59 darkstar kernel: [ 438.001400] [<c03f04ff>] device_private_init+0x15/0x3d
Oct 2 17:41:59 darkstar kernel: [ 438.001405] [<c03f24c5>] dev_set_drvdata+0x18/0x26
Oct 2 17:41:59 darkstar kernel: [ 438.001414] [<fa51fff7>] hci_conn_init_sysfs+0x40/0xd9 [bluetooth]
Oct 2 17:41:59 darkstar kernel: [ 438.001422] [<fa51cdc0>] ? hci_conn_add+0x128/0x186 [bluetooth]
Oct 2 17:41:59 darkstar kernel: [ 438.001429] [<fa51ce0f>] hci_conn_add+0x177/0x186 [bluetooth]
Oct 2 17:41:59 darkstar kernel: [ 438.001437] [<fa51cf8a>] hci_connect+0x3c/0xfb [bluetooth]
Oct 2 17:41:59 darkstar kernel: [ 438.001442] [<faa20e87>] l2cap_sock_connect+0x174/0x26b [l2cap]
Oct 2 17:41:59 darkstar kernel: [ 438.001448] [<c04c8df5>] sys_connect+0x60/0x7a
Oct 2 17:41:59 darkstar kernel: [ 438.001453] [<c024b703>] ? lock_release_non_nested+0x84/0x1de
Oct 2 17:41:59 darkstar kernel: [ 438.001458] [<c028804b>] ? might_fault+0x47/0x81
Oct 2 17:41:59 darkstar kernel: [ 438.001462] [<c028804b>] ? might_fault+0x47/0x81
Oct 2 17:41:59 darkstar kernel: [ 438.001468] [<c033361f>] ? __copy_from_user_ll+0x11/0xce
Oct 2 17:41:59 darkstar kernel: [ 438.001472] [<c04c9419>] sys_socketcall+0x82/0x17b
Oct 2 17:41:59 darkstar kernel: [ 438.001477] [<c020329d>] syscall_call+0x7/0xb

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
3b885787ea4112eaa80945999ea0901bf742707f 12-Oct-2009 Neil Horman <nhorman@tuxdriver.com> net: Generalize socket rx gap / receive queue overflow cmsg

Create a new socket level option to report number of queue overflows

Recently I augmented the AF_PACKET protocol to report the number of frames lost
on the socket receive queue between any two enqueued frames. This value was
exported via a SOL_PACKET level cmsg. AFter I completed that work it was
requested that this feature be generalized so that any datagram oriented socket
could make use of this option. As such I've created this patch, It creates a
new SOL_SOCKET level option called SO_RXQ_OVFL, which when enabled exports a
SOL_SOCKET level cmsg that reports the nubmer of times the sk_receive_queue
overflowed between any two given frames. It also augments the AF_PACKET
protocol to take advantage of this new feature (as it previously did not touch
sk->sk_drops, which this patch uses to record the overflow count). Tested
successfully by me.

Notes:

1) Unlike my previous patch, this patch simply records the sk_drops value, which
is not a number of drops between packets, but rather a total number of drops.
Deltas must be computed in user space.

2) While this patch currently works with datagram oriented protocols, it will
also be accepted by non-datagram oriented protocols. I'm not sure if thats
agreeable to everyone, but my argument in favor of doing so is that, for those
protocols which aren't applicable to this option, sk_drops will always be zero,
and reporting no drops on a receive queue that isn't used for those
non-participating protocols seems reasonable to me. This also saves us having
to code in a per-protocol opt in mechanism.

3) This applies cleanly to net-next assuming that commit
977750076d98c7ff6cbda51858bb5a5894a9d9ab (my af packet cmsg patch) is reverted

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
fcomm/sock.c
ec1b4cf74c81bfd0fbe5bf62bafc86c45917e72f 05-Oct-2009 Stephen Hemminger <shemminger@vyatta.com> net: mark net_proto_ops as const

All usages of structure net_proto_ops should be declared const.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
b7058842c940ad2c08dd829b21e5c92ebe3b8758 01-Oct-2009 David S. Miller <davem@davemloft.net> net: Make setsockopt() optlen be unsigned.

This provides safety against negative optlen at the type
level instead of depending upon (sometimes non-trivial)
checks against this sprinkled all over the the place, in
each and every implementation.

Based upon work done by Arjan van de Ven and feedback
from Linus Torvalds.

Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
2cap.c
fcomm/sock.c
co.c
50223e486cabdcf7e540e519da1f26bab3084e5d 22-Sep-2009 Linus Torvalds <torvalds@linux-foundation.org> Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
HID: Remove duplicate Kconfig entry
HID: consolidate connect and disconnect into core code
HID: fix non-atomic allocation in hid_input_report
c4c259bcc27c4242b012106afdba183622b1735f 15-Sep-2009 Jiri Kosina <jkosina@suse.cz> HID: consolidate connect and disconnect into core code

HID core registers input, hidraw and hiddev devices, but leaves
unregistering it up to the individual driver, which is not really nice.
Let's move all the logic to the core.

Reported-by: Marcel Holtmann <marcel@holtmann.org>
Reported-by: Brian Rogers <brian@xyzw.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
a4dbd6740df0872cdf0a86841f75beec8381964d 24-Jun-2009 David Brownell <dbrownell@users.sourceforge.net> driver model: constify attribute groups

Let attribute group vectors be declared "const". We'd
like to let most attribute metadata live in read-only
sections... this is a start.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ci_sysfs.c
384912ed194e43c03ad1cdaa09b0b1e488c34d46 31-Aug-2009 Marcel Holtmann <marcel@holtmann.org> net: Add DEVTYPE support for Ethernet based devices

The Ethernet framing is used for a lot of devices these days. Most
prominent are WiFi and WiMAX based devices. However for userspace
application it is important to classify these devices correctly and
not only see them as Ethernet devices. The daemons like HAL, DeviceKit
or even NetworkManager with udev support tries to do the classification
in userspace with a lot trickery and extra system calls. This is not
good and actually reaches its limitations. Especially since the kernel
does know the type of the Ethernet device it is pretty stupid.

To solve this problem the underlying device type needs to be set and
then the value will be exported as DEVTYPE via uevents and available
within udev.

# cat /sys/class/net/wlan0/uevent
DEVTYPE=wlan
INTERFACE=wlan0
IFINDEX=5

This is similar to subsystems like USB and SCSI that distinguish
between hosts, devices, disks, partitions etc.

The new SET_NETDEV_DEVTYPE() is a convenience helper to set the actual
device type. All device types are free form, but for convenience the
same strings as used with RFKILL are choosen.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
6fef4c0c8eeff7de13007a5f56113475444a253d 31-Aug-2009 Stephen Hemminger <shemminger@vyatta.com> netdev: convert pseudo-devices to netdev_tx_t

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
7e7430908c3ccaf71f0851050c8ccaf9ecfb3b56 26-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add support for L2CAP 'Send RRorRNR' action

When called, 'Send RRorRNR' should send a RNR frame if local device is
busy or a RR frame otherwise.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2246b2f1b43f3fbd128e72b129dcbbd3202cc592 26-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Handle L2CAP case when the remote receiver is busy

Implement all issues related to RemoteBusy in the RECV state table.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
ca42a613c92d131ff02d5714419d58c36c3459f3 26-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Acknowledge L2CAP packets when receiving RR-frames (F-bit=1)

Implement the Recv ReqSeqAndFBit event when a RR frame with F bit set is
received.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
cbe86b98a6aceefe943ada1471eb52fd9ac4c504 25-Aug-2009 Randy Dunlap <randy.dunlap@oracle.com> Bluetooth: Add missing selection of CONFIG_CRC16 for L2CAP layer

Fix net/bluetooth/l2cap.c build errors:

l2cap.c:(.text+0x126035): undefined reference to `crc16'
l2cap.c:(.text+0x126323): undefined reference to `crc16'
l2cap.c:(.text+0x12668e): undefined reference to `crc16'
l2cap.c:(.text+0x12683b): undefined reference to `crc16'
l2cap.c:(.text+0x126956): undefined reference to `crc16'
net/built-in.o:l2cap.c:(.text+0x129041): more undefined references to `crc16' follow

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
1b7bf4edca0fdbad70c44e139f4cfebd6759de81 24-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Use proper *_unaligned_le{16,32} helpers for L2CAP

Simplify more conversions to the right endian with the proper helpers.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e686219a64fee9be9ce438dc3f040cd71ddd168a 24-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add locking scheme to L2CAP timeout callbacks

Avoid race conditions when accessing the L2CAP socket from within the
timeout handlers.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
9e726b17422bade75fba94e625cd35fd1353e682 15-Jul-2009 Luiz Augusto von Dentz <luiz.dentz@openbossa.org> Bluetooth: Fix rejected connection not disconnecting ACL link

When using DEFER_SETUP on a RFCOMM socket, a SABM frame triggers
authorization which when rejected send a DM response. This is fine
according to the RFCOMM spec:

the responding implementation may replace the "proper" response
on the Multiplexer Control channel with a DM frame, sent on the
referenced DLCI to indicate that the DLCI is not open, and that
the responder would not grant a request to open it later either.

But some stacks doesn't seems to cope with this leaving DLCI 0 open after
receiving DM frame.

To fix it properly a timer was introduced to rfcomm_session which is used
to set a timeout when the last active DLC of a session is unlinked, this
will give the remote stack some time to reply with a proper DISC frame on
DLCI 0 avoiding both sides sending DISC to each other on stacks that
follow the specification and taking care of those who don't by taking
down DLCI 0.

Signed-off-by: Luiz Augusto von Dentz <luiz.dentz@openbossa.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
ef54fd937fbd5ebaeb023818524565bd526a5f36 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Full support for receiving L2CAP SREJ frames

Support for receiving of SREJ frames as specified by the state table.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8f17154f1f70fcc6faa31ac82164fcf7f0599f38 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add support for L2CAP SREJ exception

When L2CAP loses an I-frame we send a SREJ frame to the transmitter side
requesting the lost packet. This patch implement all Recv I-frame events
on SREJ_SENT state table except the ones that deal with SendRej (the REJ
exception at receiver side is yet not implemented).

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcc203c30d72dde82692f6b761a80e5ca5fdd8fa 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add support for FCS option to L2CAP

Implement CRC16 check for L2CAP packets. FCS is used by Streaming Mode and
Enhanced Retransmission Mode and is a extra check for the packet content.

Using CRC16 is the default, L2CAP won't use FCS only when both side send
a "No FCS" request.

Initially based on a patch from Nathan Holstein <nathan@lampreynetworks.com>

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6840ed0770d79b9bb0800e5e026a067040ef18f5 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Enable Streaming Mode for L2CAP

Streaming Mode is helpful for the Bluetooth streaming based profiles, such
as A2DP. It doesn't have any error control or flow control.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e90bac061b17cd81bd0df30606c64f4543bf5ca0 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add support for Retransmission and Monitor Timers

L2CAP uses retransmission and monitor timers to inquiry the other side
about unacked I-frames. After sending each I-frame we (re)start the
retransmission timer. If it expires, we start a monitor timer that send a
S-frame with P bit set and wait for S-frame with F bit set. If monitor
timer expires, try again, at a maximum of L2CAP_DEFAULT_MAX_TX.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
30afb5b2aa83adf4f69e5090d48e1bb04b64c58a 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Initial support for retransmission of packets with REJ frames

When receiving an I-frame with unexpected txSeq, receiver side start the
recovery procedure by sending a REJ S-frame to the transmitter side. So
the transmitter can re-send the lost I-frame.

This patch just adds a basic support for retransmission, it doesn't
mean that ERTM now has full support for packet retransmission.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c74e560cd0101455f1889515e1527e4c2e266113 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add support for Segmentation and Reassembly of SDUs

ERTM should use Segmentation and Reassembly to break down a SDU in many
PDUs on sending data to the other side.

On sending packets we queue all 'segments' until end of segmentation and
just the add them to the queue for sending. On receiving we create a new
SKB with the SDU reassembled.

Initially based on a patch from Nathan Holstein <nathan@lampreynetworks.com>

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
1c2acffb76d4bc5fd27c4ea55cc27ad8ead10f9a 21-Aug-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add initial support for ERTM packets transfers

This patch adds support for ERTM transfers, without retransmission, with
txWindow up to 63 and with acknowledgement of packets received. Now the
packets are queued before call l2cap_do_send(), so packets couldn't be
sent at the time we call l2cap_sock_sendmsg(). They will be sent in
an asynchronous way on later calls of l2cap_ertm_send(). Besides if an
error occurs on calling l2cap_do_send() we disconnect the channel.

Initially based on a patch from Nathan Holstein <nathan@lampreynetworks.com>

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
22121fc9152ca8f25a2d790860832ccb6a414c4d 23-Jul-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Create separate l2cap_send_disconn_req() function

The code for sending a disconnect request was repeated several times
within L2CAP source code. So move this into its own function.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f2fcfcd670257236ebf2088bbdf26f6a8ef459fe 04-Jul-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Add configuration support for ERTM and Streaming mode

Add support to config_req and config_rsp to configure ERTM and Streaming
mode. If the remote device specifies ERTM or Streaming mode, then the
same mode is proposed. Otherwise ERTM or Basic mode is used. And in case
of a state 2 device, the remote device should propose the same mode. If
not, then the channel gets disconnected.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
65c7c4918450f8c4545ccb02a9c7a3d77e073535 03-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add L2CAP RFC option if ERTM is enabled

When trying to establish a connection with Enhanced Retransmission mode
enabled, the RFC option needs to be added to the configuration.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c6b03cf986eab00e20d0dbc852b233bb83472138 03-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Allow setting of L2CAP ERTM via socket option

To enable Enhanced Retransmission mode it needs to be set via a socket
option. A different mode can be set on a socket, but on listen() and
connect() the mode is checked and ERTM is only allowed if it is enabled
via the module parameter.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
44dd46de325c4d47abfd1361e5d84a548edb8e42 03-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add module option to enable L2CAP ERTM support

Since the Enhanced Retransmission mode for L2CAP is still under heavy
development disable it by default and provide a module option to enable
it manually for testing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
52d18347dfb61519aa0f58fe1759edd3ad8c4e36 22-Aug-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Coding style cleanup from previous rfcomm_init bug fix

The rfcomm_init bug fix went into the kernel premature before it got fully
reviewed and acknowledged by the Bluetooth maintainer. So fix up the coding
style now.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
a6a67efd7088702fdbbb780c5a3f8e1a74e77b63 26-Jul-2009 Thomas Gleixner <tglx@linutronix.de> Bluetooth: Convert hdev->req_lock to a mutex

hdev->req_lock is used as mutex so make it a mutex.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
edad63886993d18ab800c49f6587a93432ef8b35 22-Aug-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Let HIDP grab the device reference for connections

The core exports the hci_conn_hold_device() and hci_conn_put_device()
functions for device reference of connections. Use this to ensure that
the uevents from the parent are send after the child ones.

Based on a report by Brian Rogers <brian@xyzw.org>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
idp/hidp.h
9eba32b86d17ef87131fa0bce43c614904ab5781 22-Aug-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add extra device reference counting for connections

The device model itself has no real usable reference counting at the
moment and this causes problems if parents are deleted before their
children. The device model itself handles the memory details of this
correctly, but the uevent order is not consistent. This causes various
problems for systems like HAL or even X.

So until device_put() does a proper cleanup, the device for Bluetooth
connection will be protected with an extra reference counting to ensure
the correct order of uevents when connections are terminated.

This is not an automatic feature. Higher Bluetooth layers like HIDP or
BNEP should grab this new reference to ensure that their uevents are
send before the ones from the parent device.

Based on a report by Brian Rogers <brian@xyzw.org>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
364f63519d94442ed373ac7da79033c8282df46a 22-Aug-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Disconnect HIDRAW devices on disconnect

Currently the HID subsystem will create HIDRAW devices for the transport
driver, but it will not disconnect them. Until the HID subsytem gets
fixed, ensure that HIDRAW and HIDDEV devices are disconnected when the
Bluetooth HID device gets removed.

Based on a patch from Brian Rogers <brian@xyzw.org>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
981b1414d78a7a42cab48b97d4de54a62d61db88 01-Jul-2009 Vikram Kandukuri <vkandukuri@atheros.com> Bluetooth: Fix missing scheduling when VIRTUAL_CABLE_UNPLUG is received

There is a test case in PTS tool; PTS will send the VIRTUAL_CABLE_UNPLUG
command to IUT. Then IUT should disconnect the channel and kill the HID
session when it receives the command. The VIRTUAL_CABLE_UNPLUG command
is parsed by HID transport, but it is not scheduled to do so. Add a
call to hidp_schedule() to kill the session.

Signed-off-by: Jothikumar Mothilal <jothikumar.mothilal@atheros.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
fd0b3ff707dc1f7837079044bd4eca7ed505f70d 16-Jun-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add proper shutdown support to SCO sockets

The SCO sockets for Bluetooth audio setup and streaming are missing the
shutdown implementation. This hasn't been a problem so far, but with a
more deeper integration with PulseAudio it is important to shutdown SCO
sockets properly.

Also the Headset profile 1.2 has more detailed qualification tests that
require that SCO and RFCOMM channels are terminated in the right order. A
proper shutdown function is necessary for this.

Based on a report by Johan Hedberg <johan.hedberg@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Johan Hedberg <johan.hedberg@nokia.com>
co.c
aa11d958d1a6572eda08214d7c6a735804fe48a5 13-Aug-2009 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
arch/microblaze/include/asm/socket.h
36cbd3dcc10384f813ec0814255f576c84f2bcd4 05-Aug-2009 Jan Engelhardt <jengelh@medozas.de> net: mark read-only arrays as const

String literals are constant, and usually, we can also tag the array
of pointers const too, moving it to the .rodata section.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
af0d3b103bcfa877343ee338de12002cd50c9ee5 03-Aug-2009 Dave Young <hidave.darkstar@gmail.com> bluetooth: rfcomm_init bug fix

rfcomm tty may be used before rfcomm_tty_driver initilized,
The problem is that now socket layer init before tty layer, if userspace
program do socket callback right here then oops will happen.

reporting in:
http://marc.info/?l=linux-bluetooth&m=124404919324542&w=2

make 3 changes:
1. remove #ifdef in rfcomm/core.c,
make it blank function when rfcomm tty not selected in rfcomm.h

2. tune the rfcomm_init error patch to ensure
tty driver initilized before rfcomm socket usage.

3. remove __exit for rfcomm_cleanup_sockets
because above change need call it in a __init function.

Reported-by: Oliver Hartkopp <oliver@hartkopp.net>
Tested-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
fcomm/sock.c
6ed106549d17474ca17a16057f4c0ed4eba5a7ca 23-Jun-2009 Patrick McHardy <kaber@trash.net> net: use NETDEV_TX_OK instead of 0 in ndo_start_xmit() functions

This patch is the result of an automatic spatch transformation to convert
all ndo_start_xmit() return values of 0 to NETDEV_TX_OK.

Some occurences are missed by the automatic conversion, those will be
handled in a seperate patch.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/netdev.c
31e6d363abcd0d05766c82f1a9c905a4c974a199 18-Jun-2009 Eric Dumazet <eric.dumazet@gmail.com> net: correct off-by-one write allocations reports

commit 2b85a34e911bf483c27cfdd124aeb1605145dc80
(net: No more expensive sock_hold()/sock_put() on each tx)
changed initial sk_wmem_alloc value.

We need to take into account this offset when reporting
sk_wmem_alloc to user, in PROC_FS files or various
ioctls (SIOCOUTQ/TIOCOUTQ)

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
1a097181ee8b0c492c021eb3dbaa5f9cd813ad0e 14-Jun-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix Kconfig issue with RFKILL integration

Since the re-write of the RFKILL subsystem it is no longer good to just
select RFKILL, but it is important to add a proper depends on rule.

Based on a report by Alexander Beregalov <a.beregalov@gmail.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
config
bb400801c2f40bbd9a688818323ad09abfc4e581 11-Jun-2009 David S. Miller <davem@davemloft.net> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-next-2.6
611b30f74b5d8ca036a9923b3bf6e0ee10a21a53 08-Jun-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add native RFKILL soft-switch support for all devices

With the re-write of the RFKILL subsystem it is now possible to easily
integrate RFKILL soft-switch support into the Bluetooth subsystem. All
Bluetooth devices will now get automatically RFKILL support.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
b4324b5dc5b62ba76372e1bf8927230cf744df66 07-Jun-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove pointless endian conversion helpers

The Bluetooth source uses some endian conversion helpers, that in the end
translate to kernel standard routines. So remove this obfuscation since it
is fully pointless.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcomm/core.c
47ec1dcd696d56a7c396e5838516a566ecd4b03d 03-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add basic constants for L2CAP ERTM support and use them

This adds the basic constants required to add support for L2CAP Enhanced
Retransmission feature.

Based on a patch from Nathan Holstein <nathan@lampreynetworks.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
af05b30bcb65da3ed488af54ee92e96bebe0be5e 20-Apr-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Fix errors and warnings in L2CAP reported by checkpatch.pl

This patch fixes the errors without changing the l2cap.o binary:

text data bss dec hex filename
18059 568 0 18627 48c3 l2cap.o.after
18059 568 0 18627 48c3 l2cap.o.before

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
44d0e48e8a1fa174edf11e03dc70bd6a146b2a40 20-Apr-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Remove unnecessary variable initialization

The initial value of err is not used until it is set to -ENOMEM. So just
remove the initialization completely.

Based on a patch from Gustavo F. Padovan <gustavo@las.ic.unicamp.br>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
589d27464846c7cb758f93d9ee380c8ff05a161c 20-Apr-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Use macro for L2CAP hint mask on receiving config request

Using the L2CAP_CONF_HINT macro is easier to understand than using a
hardcoded 0x80 value.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8db4dc46dcff7568896aa1eae4bd07620ce3dd93 20-Apr-2009 Gustavo F. Padovan <gustavo@las.ic.unicamp.br> Bluetooth: Use macros for L2CAP channel identifiers

Use macros instead of hardcoded numbers to make the L2CAP source code
more readable.

Signed-off-by: Gustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4e329972052c3649367b91de783f6293b8653cb2 07-Jun-2009 Tilman Schmidt <tilman@imap.cc> isdn: rename capi_ctr_reseted() to capi_ctr_down()

Change the name of the Kernel CAPI exported function capi_ctr_reseted()
to something representing its purpose better.

Impact: renaming, no functional change
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Signed-off-by: David S. Miller <davem@davemloft.net>
mtp/capi.c
4c713189485dbea875aecd1990daed74908e181d 27-May-2009 Dave Young <hidave.darkstar@gmail.com> Bluetooth: Remove useless flush_work() causing lockdep warnings

The calls to flush_work() are pointless in a single thread workqueue
and they are actually causing a lockdep warning.

=============================================
[ INFO: possible recursive locking detected ]
2.6.30-rc6-02911-gbb803cf #16
---------------------------------------------
bluetooth/2518 is trying to acquire lock:
(bluetooth){+.+.+.}, at: [<c0130c14>] flush_work+0x28/0xb0

but task is already holding lock:
(bluetooth){+.+.+.}, at: [<c0130424>] worker_thread+0x149/0x25e

other info that might help us debug this:
2 locks held by bluetooth/2518:
#0: (bluetooth){+.+.+.}, at: [<c0130424>] worker_thread+0x149/0x25e
#1: (&conn->work_del){+.+...}, at: [<c0130424>] worker_thread+0x149/0x25e

stack backtrace:
Pid: 2518, comm: bluetooth Not tainted 2.6.30-rc6-02911-gbb803cf #16
Call Trace:
[<c03d64d9>] ? printk+0xf/0x11
[<c0140d96>] __lock_acquire+0x7ce/0xb1b
[<c0141173>] lock_acquire+0x90/0xad
[<c0130c14>] ? flush_work+0x28/0xb0
[<c0130c2e>] flush_work+0x42/0xb0
[<c0130c14>] ? flush_work+0x28/0xb0
[<f8b84966>] del_conn+0x1c/0x84 [bluetooth]
[<c0130469>] worker_thread+0x18e/0x25e
[<c0130424>] ? worker_thread+0x149/0x25e
[<f8b8494a>] ? del_conn+0x0/0x84 [bluetooth]
[<c0133843>] ? autoremove_wake_function+0x0/0x33
[<c01302db>] ? worker_thread+0x0/0x25e
[<c013355a>] kthread+0x45/0x6b
[<c0133515>] ? kthread+0x0/0x6b
[<c01034a7>] kernel_thread_helper+0x7/0x10

Based on a report by Oliver Hartkopp <oliver@hartkopp.net>

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Tested-by: Oliver Hartkopp <oliver@hartkopp.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
3d7a9d1c7ee251a04095d43eec5a3f4ff3f710a8 09-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't trigger disconnect timeout for security mode 3 pairing

A remote device in security mode 3 that tries to connect will require
the pairing during the connection setup phase. The disconnect timeout
is now triggered within 10 milliseconds and causes the pairing to fail.

If a connection is not fully established and a PIN code request is
received, don't trigger the disconnect timeout. The either successful
or failing connection complete event will make sure that the timeout
is triggered at the right time.

The biggest problem with security mode 3 is that many Bluetooth 2.0
device and before use a temporary security mode 3 for dedicated
bonding.

Based on a report by Johan Hedberg <johan.hedberg@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Johan Hedberg <johan.hedberg@nokia.com>
ci_event.c
1b0336bb36f88976f1210a65b62f6a3e9578ee7b 09-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't use hci_acl_connect_cancel() for incoming connections

The connection setup phase takes around 2 seconds or longer and in
that time it is possible that the need for an ACL connection is no
longer present. If that happens then, the connection attempt will
be canceled.

This only applies to outgoing connections, but currently it can also
be triggered by incoming connection. Don't call hci_acl_connect_cancel()
on incoming connection since these have to be either accepted or rejected
in this state. Once they are successfully connected they need to be
fully disconnected anyway.

Also remove the wrong hci_acl_disconn() call for SCO and eSCO links
since at this stage they can't be disconnected either, because the
connection handle is still unknown.

Based on a report by Johan Hedberg <johan.hedberg@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Johan Hedberg <johan.hedberg@nokia.com>
ci_conn.c
384943ec1bb462e410390ad8f108ff1474cd882d 09-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix wrong module refcount when connection setup fails

The module refcount is increased by hci_dev_hold() call in hci_conn_add()
and decreased by hci_dev_put() call in del_conn(). In case the connection
setup fails, hci_dev_put() is never called.

Procedure to reproduce the issue:

# hciconfig hci0 up
# lsmod | grep btusb -> "used by" refcount = 1

# hcitool cc <non-exisiting bdaddr> -> will get timeout

# lsmod | grep btusb -> "used by" refcount = 2
# hciconfig hci0 down
# lsmod | grep btusb -> "used by" refcount = 1
# rmmod btusb -> ERROR: Module btusb is in use

The hci_dev_put() call got moved into del_conn() with the 2.6.25 kernel
to fix an issue with hci_dev going away before hci_conn. However that
change was wrong and introduced this problem.

When calling hci_conn_del() it has to call hci_dev_put() after freeing
the connection details. This handling should be fully symmetric. The
execution of del_conn() is done in a work queue and needs it own calls
to hci_dev_hold() and hci_dev_put() to ensure that the hci_dev stays
until the connection cleanup has been finished.

Based on a report by Bing Zhao <bzhao@marvell.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Bing Zhao <bzhao@marvell.com>
ci_conn.c
ci_sysfs.c
457ca7bb6bdf39d0832d3f88c65fa367a3b20de6 05-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Move dev_set_name() to a context that can sleep

Setting the name of a sysfs device has to be done in a context that can
actually sleep. It allocates its memory with GFP_KERNEL. Previously it
was a static (size limited) string and that got changed to accommodate
longer device names. So move the dev_set_name() just before calling
device_add() which is executed in a work queue.

This fixes the following error:

[ 110.012125] BUG: sleeping function called from invalid context at mm/slub.c:1595
[ 110.012135] in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
[ 110.012141] 2 locks held by swapper/0:
[ 110.012145] #0: (hci_task_lock){++.-.+}, at: [<ffffffffa01f822f>] hci_rx_task+0x2f/0x2d0 [bluetooth]
[ 110.012173] #1: (&hdev->lock){+.-.+.}, at: [<ffffffffa01fb9e2>] hci_event_packet+0x72/0x25c0 [bluetooth]
[ 110.012198] Pid: 0, comm: swapper Tainted: G W 2.6.30-rc4-g953cdaa #1
[ 110.012203] Call Trace:
[ 110.012207] <IRQ> [<ffffffff8023eabd>] __might_sleep+0x14d/0x170
[ 110.012228] [<ffffffff802cfbe1>] __kmalloc+0x111/0x170
[ 110.012239] [<ffffffff803c2094>] kvasprintf+0x64/0xb0
[ 110.012248] [<ffffffff803b7a5b>] kobject_set_name_vargs+0x3b/0xa0
[ 110.012257] [<ffffffff80465326>] dev_set_name+0x76/0xa0
[ 110.012273] [<ffffffffa01fb9e2>] ? hci_event_packet+0x72/0x25c0 [bluetooth]
[ 110.012289] [<ffffffffa01ffc1d>] hci_conn_add_sysfs+0x3d/0x70 [bluetooth]
[ 110.012303] [<ffffffffa01fba2c>] hci_event_packet+0xbc/0x25c0 [bluetooth]
[ 110.012312] [<ffffffff80516eb0>] ? sock_def_readable+0x80/0xa0
[ 110.012328] [<ffffffffa01fee0c>] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth]
[ 110.012343] [<ffffffff80516eb0>] ? sock_def_readable+0x80/0xa0
[ 110.012347] [<ffffffff805e88c5>] ? _read_unlock+0x75/0x80
[ 110.012354] [<ffffffffa01fee0c>] ? hci_send_to_sock+0xfc/0x1c0 [bluetooth]
[ 110.012360] [<ffffffffa01f8403>] hci_rx_task+0x203/0x2d0 [bluetooth]
[ 110.012365] [<ffffffff80250ab5>] tasklet_action+0xb5/0x160
[ 110.012369] [<ffffffff8025116c>] __do_softirq+0x9c/0x150
[ 110.012372] [<ffffffff805e850f>] ? _spin_unlock+0x3f/0x80
[ 110.012376] [<ffffffff8020cbbc>] call_softirq+0x1c/0x30
[ 110.012380] [<ffffffff8020f01d>] do_softirq+0x8d/0xe0
[ 110.012383] [<ffffffff80250df5>] irq_exit+0xc5/0xe0
[ 110.012386] [<ffffffff8020e71d>] do_IRQ+0x9d/0x120
[ 110.012389] [<ffffffff8020c3d3>] ret_from_intr+0x0/0xf
[ 110.012391] <EOI> [<ffffffff80431832>] ? acpi_idle_enter_bm+0x264/0x2a6
[ 110.012399] [<ffffffff80431828>] ? acpi_idle_enter_bm+0x25a/0x2a6
[ 110.012403] [<ffffffff804f50d5>] ? cpuidle_idle_call+0xc5/0x130
[ 110.012407] [<ffffffff8020a4b4>] ? cpu_idle+0xc4/0x130
[ 110.012411] [<ffffffff805d2268>] ? rest_init+0x88/0xb0
[ 110.012416] [<ffffffff807e2fbd>] ? start_kernel+0x3b5/0x412
[ 110.012420] [<ffffffff807e2281>] ? x86_64_start_reservations+0x91/0xb5
[ 110.012424] [<ffffffff807e2394>] ? x86_64_start_kernel+0xef/0x11b

Based on a report by Davide Pesavento <davidepesa@gmail.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Hugo Mildenberger <hugo.mildenberger@namir.de>
Tested-by: Bing Zhao <bzhao@marvell.com>
ci_sysfs.c
a67e899cf38ae542d1a028ccd021f9189f76fb74 03-May-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix issue with sysfs handling for connections

Due to a semantic changes in flush_workqueue() the current approach of
synchronizing the sysfs handling for connections doesn't work anymore. The
whole approach is actually fully broken and based on assumptions that are
no longer valid.

With the introduction of Simple Pairing support, the creation of low-level
ACL links got changed. This change invalidates the reason why in the past
two independent work queues have been used for adding/removing sysfs
devices. The adding of the actual sysfs device is now postponed until the
host controller successfully assigns an unique handle to that link. So
the real synchronization happens inside the controller and not the host.

The only left-over problem is that some internals of the sysfs device
handling are not initialized ahead of time. This leaves potential access
to invalid data and can cause various NULL pointer dereferences. To fix
this a new function makes sure that all sysfs details are initialized
when an connection attempt is made. The actual sysfs device is only
registered when the connection has been successfully established. To
avoid a race condition with the registration, the check if a device is
registered has been moved into the removal work.

As an extra protection two flush_work() calls are left in place to
make sure a previous add/del work has been completed first.

Based on a report by Marc Pignat <marc.pignat@hevs.ch>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Justin P. Mattock <justinmattock@gmail.com>
Tested-by: Roger Quadros <ext-roger.quadros@nokia.com>
Tested-by: Marc Pignat <marc.pignat@hevs.ch>
ci_conn.c
ci_sysfs.c
3fdca1e1370ffe89980927cdef0583bebcd8caaf 28-Apr-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix connection establishment with low security requirement

The Bluetooth 2.1 specification introduced four different security modes
that can be mapped using Legacy Pairing and Simple Pairing. With the
usage of Simple Pairing it is required that all connections (except
the ones for SDP) are encrypted. So even the low security requirement
mandates an encrypted connection when using Simple Pairing. When using
Legacy Pairing (for Bluetooth 2.0 devices and older) this is not required
since it causes interoperability issues.

To support this properly the low security requirement translates into
different host controller transactions depending if Simple Pairing is
supported or not. However in case of Simple Pairing the command to
switch on encryption after a successful authentication is not triggered
for the low security mode. This patch fixes this and actually makes
the logic to differentiate between Simple Pairing and Legacy Pairing
a lot simpler.

Based on a report by Ville Tervo <ville.tervo@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
052b30b0a8eec8db5b18ad49effdf2a9ba4c1e1a 26-Apr-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add different pairing timeout for Legacy Pairing

The Bluetooth stack uses a reference counting for all established ACL
links and if no user (L2CAP connection) is present, the link will be
terminated to save power. The problem part is the dedicated pairing
when using Legacy Pairing (Bluetooth 2.0 and before). At that point
no user is present and pairing attempts will be disconnected within
10 seconds or less. In previous kernel version this was not a problem
since the disconnect timeout wasn't triggered on incoming connections
for the first time. However this caused issues with broken host stacks
that kept the connections around after dedicated pairing. When the
support for Simple Pairing got added, the link establishment procedure
needed to be changed and now causes issues when using Legacy Pairing

When using Simple Pairing it is possible to do a proper reference
counting of ACL link users. With Legacy Pairing this is not possible
since the specification is unclear in some areas and too many broken
Bluetooth devices have already been deployed. So instead of trying to
deal with all the broken devices, a special pairing timeout will be
introduced that increases the timeout to 60 seconds when pairing is
triggered.

If a broken devices now puts the stack into an unforeseen state, the
worst that happens is the disconnect timeout triggers after 120 seconds
instead of 4 seconds. This allows successful pairings with legacy and
broken devices now.

Based on a report by Johan Hedberg <johan.hedberg@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
f3784d834c71689336fa272df420b45345cb6b84 23-Apr-2009 Roger Quadros <ext-roger.quadros@nokia.com> Bluetooth: Ensure that HCI sysfs add/del is preempt safe

Use a different work_struct variables for add_conn() and del_conn() and
use single work queue instead of two for adding and deleting connections.

It eliminates the following error on a preemptible kernel:

[ 204.358032] Unable to handle kernel NULL pointer dereference at virtual address 0000000c
[ 204.370697] pgd = c0004000
[ 204.373443] [0000000c] *pgd=00000000
[ 204.378601] Internal error: Oops: 17 [#1] PREEMPT
[ 204.383361] Modules linked in: vfat fat rfcomm sco l2cap sd_mod scsi_mod iphb pvr2d drm omaplfb ps
[ 204.438537] CPU: 0 Not tainted (2.6.28-maemo2 #1)
[ 204.443664] PC is at klist_put+0x2c/0xb4
[ 204.447601] LR is at klist_put+0x18/0xb4
[ 204.451568] pc : [<c0270f08>] lr : [<c0270ef4>] psr: a0000113
[ 204.451568] sp : cf1b3f10 ip : cf1b3f10 fp : cf1b3f2c
[ 204.463104] r10: 00000000 r9 : 00000000 r8 : bf08029c
[ 204.468353] r7 : c7869200 r6 : cfbe2690 r5 : c78692c8 r4 : 00000001
[ 204.474945] r3 : 00000001 r2 : cf1b2000 r1 : 00000001 r0 : 00000000
[ 204.481506] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 204.488861] Control: 10c5387d Table: 887fc018 DAC: 00000017
[ 204.494628] Process btdelconn (pid: 515, stack limit = 0xcf1b22e0)

Signed-off-by: Roger Quadros <ext-roger.quadros@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
9499237a1c42a27fbcc7ed1d59e34df2b574cdfb 19-Apr-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add workaround for wrong HCI event in eSCO setup

The Broadcom chips with 2.1 firmware handle the fallback case to a SCO
link wrongly when setting up eSCO connections.

< HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
handle 11 voice setting 0x0060
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Connect Complete (0x03) plen 11
status 0x00 handle 1 bdaddr 00:1E:3A:xx:xx:xx type SCO encrypt 0x01

The Link Manager negotiates the fallback to SCO, but then sends out
a Connect Complete event. This is wrong and the Link Manager should
actually send a Synchronous Connection Complete event if the Setup
Synchronous Connection has been used. Only the remote side is allowed
to use Connect Complete to indicate the missing support for eSCO in
the host stack.

This patch adds a workaround for this which clearly should not be
needed, but reality is that broken Broadcom devices are deployed.

Based on a report by Ville Tervo <ville.tervo@nokia.com>

Signed-off-by: Marcel Holtman <marcel@holtmann.org>
ci_event.c
732547f96ea2442965a24e0ed529d285321a0fff 19-Apr-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fallback from eSCO to SCO on unspecified error

Some Bluetooth chips (like the ones from Texas Instruments) don't do
proper eSCO negotiations inside the Link Manager. They just return an
error code and in case of the Kyocera ED-8800 headset it is just a
random error.

< HCI Command: Setup Synchronous Connection 0x01|0x0028) plen 17
handle 1 voice setting 0x0060
> HCI Event: Command Status (0x0f) plen 4
Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
> HCI Event: Synchronous Connect Complete (0x2c) plen 17
status 0x1f handle 257 bdaddr 00:14:0A:xx:xx:xx type eSCO
Error: Unspecified Error

In these cases it is up to the host stack to fallback to a SCO setup
and so retry with SCO parameters.

Based on a report by Nick Pelly <npelly@google.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e2139b32726e5dd184974c785ea3f62026590801 26-Mar-2009 Johan Hedberg <johan.hedberg@nokia.com> Bluetooth: Fix removing of RFCOMM DLC timer with DEFER_SETUP

There is a missing call to rfcomm_dlc_clear_timer in the case that
DEFER_SETUP is used and so the connection gets disconnected after the
timeout even if it was successfully accepted previously.

This patch adds a call to rfcomm_dlc_clear_timer to rfcomm_dlc_accept
which will get called when the user accepts the connection by calling
read() on the socket.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
0f043a81ebe84be3576667f04fdda481609e3816 01-Apr-2009 Alexey Dobriyan <adobriyan@gmail.com> proc tty: remove struct tty_operations::read_proc

struct tty_operations::proc_fops took it's place and there is one less
create_proc_read_entry() user now!

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fcomm/tty.c
08abe18af1f78ee80c3c3a5ac47c3e0ae0beadf6 26-Mar-2009 David S. Miller <davem@davemloft.net> Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

Conflicts:
drivers/net/wimax/i2400m/usb-notif.c
ffa6a7054d172a2f57248dff2de600ca795c5656 04-Mar-2009 Cornelia Huck <cornelia.huck@de.ibm.com> Driver core: Fix device_move() vs. dpm list ordering, v2

dpm_list currently relies on the fact that child devices will
be registered after their parents to get a correct suspend
order. Using device_move() however destroys this assumption, as
an already registered device may be moved under a newly registered
one.

This patch adds a new argument to device_move(), allowing callers
to specify how dpm_list should be adapted.

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ci_sysfs.c
fcomm/tty.c
7585b97a48180f754ebdade1be94092e36bef365 25-Feb-2009 Wei Yongjun <yjwei@cn.fujitsu.com> Bluetooth: Remove some pointless conditionals before kfree_skb()

Remove some pointless conditionals before kfree_skb().

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mtp/core.c
ci_core.c
2cap.c
2ae9a6be5f476f3512839a4d11a8f432bfd2914c 21-Feb-2009 Dave Young <hidave.darkstar@gmail.com> Bluetooth: Move hci_conn_del_sysfs() back to avoid device destruct too early

The following commit introduce a regression:

commit 7d0db0a373195385a2e0b19d1f5e4b186fdcffac
Author: Marcel Holtmann <marcel@holtmann.org>
Date: Mon Jul 14 20:13:51 2008 +0200

[Bluetooth] Use a more unique bus name for connections

I get panic as following (by netconsole):

[ 2709.344034] usb 5-1: new full speed USB device using uhci_hcd and address 4
[ 2709.505776] usb 5-1: configuration #1 chosen from 1 choice
[ 2709.569207] Bluetooth: Generic Bluetooth USB driver ver 0.4
[ 2709.570169] usbcore: registered new interface driver btusb
[ 2845.742781] BUG: unable to handle kernel paging request at 6b6b6c2f
[ 2845.742958] IP: [<c015515c>] __lock_acquire+0x6c/0xa80
[ 2845.743087] *pde = 00000000
[ 2845.743206] Oops: 0002 [#1] SMP
[ 2845.743377] last sysfs file: /sys/class/bluetooth/hci0/hci0:6/type
[ 2845.743742] Modules linked in: btusb netconsole snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss rfcomm l2cap bluetooth vfat fuse snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm pl2303 snd_timer psmouse usbserial snd 3c59x e100 serio_raw soundcore i2c_i801 intel_agp mii agpgart snd_page_alloc rtc_cmos rtc_core thermal processor rtc_lib button thermal_sys sg evdev
[ 2845.743742]
[ 2845.743742] Pid: 0, comm: swapper Not tainted (2.6.29-rc5-smp #54) Dell DM051
[ 2845.743742] EIP: 0060:[<c015515c>] EFLAGS: 00010002 CPU: 0
[ 2845.743742] EIP is at __lock_acquire+0x6c/0xa80
[ 2845.743742] EAX: 00000046 EBX: 00000046 ECX: 6b6b6b6b EDX: 00000002
[ 2845.743742] ESI: 6b6b6b6b EDI: 00000000 EBP: c064fd14 ESP: c064fcc8
[ 2845.743742] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ 2845.743742] Process swapper (pid: 0, ti=c064e000 task=c05d1400 task.ti=c064e000)
[ 2845.743742] Stack:
[ 2845.743742] c05d1400 00000002 c05d1400 00000001 00000002 00000000 f65388dc c05d1400
[ 2845.743742] 6b6b6b6b 00000292 c064fd0c c0153732 00000000 00000000 00000001 f700fa50
[ 2845.743742] 00000046 00000000 00000000 c064fd40 c0155be6 00000000 00000002 00000001
[ 2845.743742] Call Trace:
[ 2845.743742] [<c0153732>] ? trace_hardirqs_on_caller+0x72/0x1c0
[ 2845.743742] [<c0155be6>] ? lock_acquire+0x76/0xa0
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c046c885>] ? _spin_lock_irqsave+0x45/0x80
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1f94>] ? skb_queue_purge+0x14/0x20
[ 2845.743742] [<f8171f5a>] ? hci_conn_del+0x10a/0x1c0 [bluetooth]
[ 2845.743742] [<f81399c9>] ? l2cap_disconn_ind+0x59/0xb0 [l2cap]
[ 2845.743742] [<f81795ce>] ? hci_conn_del_sysfs+0x8e/0xd0 [bluetooth]
[ 2845.743742] [<f8175758>] ? hci_event_packet+0x5f8/0x31c0 [bluetooth]
[ 2845.743742] [<c03dfe19>] ? sock_def_readable+0x59/0x80
[ 2845.743742] [<c046c14d>] ? _read_unlock+0x1d/0x20
[ 2845.743742] [<f8178aa9>] ? hci_send_to_sock+0xe9/0x1d0 [bluetooth]
[ 2845.743742] [<c015388b>] ? trace_hardirqs_on+0xb/0x10
[ 2845.743742] [<f816fa6a>] ? hci_rx_task+0x2ba/0x490 [bluetooth]
[ 2845.743742] [<c0133661>] ? tasklet_action+0x31/0xc0
[ 2845.743742] [<c013367c>] ? tasklet_action+0x4c/0xc0
[ 2845.743742] [<c0132eb7>] ? __do_softirq+0xa7/0x170
[ 2845.743742] [<c0116dec>] ? ack_apic_level+0x5c/0x1c0
[ 2845.743742] [<c0132fd7>] ? do_softirq+0x57/0x60
[ 2845.743742] [<c01333dc>] ? irq_exit+0x7c/0x90
[ 2845.743742] [<c01055bb>] ? do_IRQ+0x4b/0x90
[ 2845.743742] [<c01333d5>] ? irq_exit+0x75/0x90
[ 2845.743742] [<c010392c>] ? common_interrupt+0x2c/0x34
[ 2845.743742] [<c010a14f>] ? mwait_idle+0x4f/0x70
[ 2845.743742] [<c0101c05>] ? cpu_idle+0x65/0xb0
[ 2845.743742] [<c045731e>] ? rest_init+0x4e/0x60
[ 2845.743742] Code: 0f 84 69 02 00 00 83 ff 07 0f 87 1e 06 00 00 85 ff 0f 85 08 05 00 00 8b 4d cc 8b 49 04 85 c9 89 4d d4 0f 84 f7 04 00 00 8b 75 d4 <f0> ff 86 c4 00 00 00 89 f0 e8 56 a9 ff ff 85 c0 0f 85 6e 03 00
[ 2845.743742] EIP: [<c015515c>] __lock_acquire+0x6c/0xa80 SS:ESP 0068:c064fcc8
[ 2845.743742] ---[ end trace 4c985b38f022279f ]---
[ 2845.743742] Kernel panic - not syncing: Fatal exception in interrupt
[ 2845.743742] ------------[ cut here ]------------
[ 2845.743742] WARNING: at kernel/smp.c:329 smp_call_function_many+0x151/0x200()
[ 2845.743742] Hardware name: Dell DM051
[ 2845.743742] Modules linked in: btusb netconsole snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss rfcomm l2cap bluetooth vfat fuse snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm pl2303 snd_timer psmouse usbserial snd 3c59x e100 serio_raw soundcore i2c_i801 intel_agp mii agpgart snd_page_alloc rtc_cmos rtc_core thermal processor rtc_lib button thermal_sys sg evdev
[ 2845.743742] Pid: 0, comm: swapper Tainted: G D 2.6.29-rc5-smp #54
[ 2845.743742] Call Trace:
[ 2845.743742] [<c012e076>] warn_slowpath+0x86/0xa0
[ 2845.743742] [<c015041b>] ? trace_hardirqs_off+0xb/0x10
[ 2845.743742] [<c0146384>] ? up+0x14/0x40
[ 2845.743742] [<c012e661>] ? release_console_sem+0x31/0x1e0
[ 2845.743742] [<c046c8ab>] ? _spin_lock_irqsave+0x6b/0x80
[ 2845.743742] [<c015041b>] ? trace_hardirqs_off+0xb/0x10
[ 2845.743742] [<c046c900>] ? _read_lock_irqsave+0x40/0x80
[ 2845.743742] [<c012e7f2>] ? release_console_sem+0x1c2/0x1e0
[ 2845.743742] [<c0146384>] ? up+0x14/0x40
[ 2845.743742] [<c015041b>] ? trace_hardirqs_off+0xb/0x10
[ 2845.743742] [<c046a3d7>] ? __mutex_unlock_slowpath+0x97/0x160
[ 2845.743742] [<c046a563>] ? mutex_trylock+0xb3/0x180
[ 2845.743742] [<c046a4a8>] ? mutex_unlock+0x8/0x10
[ 2845.743742] [<c015b991>] smp_call_function_many+0x151/0x200
[ 2845.743742] [<c010a1a0>] ? stop_this_cpu+0x0/0x40
[ 2845.743742] [<c015ba61>] smp_call_function+0x21/0x30
[ 2845.743742] [<c01137ae>] native_smp_send_stop+0x1e/0x50
[ 2845.743742] [<c012e0f5>] panic+0x55/0x110
[ 2845.743742] [<c01065a8>] oops_end+0xb8/0xc0
[ 2845.743742] [<c010668f>] die+0x4f/0x70
[ 2845.743742] [<c011a8c9>] do_page_fault+0x269/0x610
[ 2845.743742] [<c011a660>] ? do_page_fault+0x0/0x610
[ 2845.743742] [<c046cbaf>] error_code+0x77/0x7c
[ 2845.743742] [<c015515c>] ? __lock_acquire+0x6c/0xa80
[ 2845.743742] [<c0153732>] ? trace_hardirqs_on_caller+0x72/0x1c0
[ 2845.743742] [<c0155be6>] lock_acquire+0x76/0xa0
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c046c885>] _spin_lock_irqsave+0x45/0x80
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1aad>] skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1f94>] skb_queue_purge+0x14/0x20
[ 2845.743742] [<f8171f5a>] hci_conn_del+0x10a/0x1c0 [bluetooth]
[ 2845.743742] [<f81399c9>] ? l2cap_disconn_ind+0x59/0xb0 [l2cap]
[ 2845.743742] [<f81795ce>] ? hci_conn_del_sysfs+0x8e/0xd0 [bluetooth]
[ 2845.743742] [<f8175758>] hci_event_packet+0x5f8/0x31c0 [bluetooth]
[ 2845.743742] [<c03dfe19>] ? sock_def_readable+0x59/0x80
[ 2845.743742] [<c046c14d>] ? _read_unlock+0x1d/0x20
[ 2845.743742] [<f8178aa9>] ? hci_send_to_sock+0xe9/0x1d0 [bluetooth]
[ 2845.743742] [<c015388b>] ? trace_hardirqs_on+0xb/0x10
[ 2845.743742] [<f816fa6a>] hci_rx_task+0x2ba/0x490 [bluetooth]
[ 2845.743742] [<c0133661>] ? tasklet_action+0x31/0xc0
[ 2845.743742] [<c013367c>] tasklet_action+0x4c/0xc0
[ 2845.743742] [<c0132eb7>] __do_softirq+0xa7/0x170
[ 2845.743742] [<c0116dec>] ? ack_apic_level+0x5c/0x1c0
[ 2845.743742] [<c0132fd7>] do_softirq+0x57/0x60
[ 2845.743742] [<c01333dc>] irq_exit+0x7c/0x90
[ 2845.743742] [<c01055bb>] do_IRQ+0x4b/0x90
[ 2845.743742] [<c01333d5>] ? irq_exit+0x75/0x90
[ 2845.743742] [<c010392c>] common_interrupt+0x2c/0x34
[ 2845.743742] [<c010a14f>] ? mwait_idle+0x4f/0x70
[ 2845.743742] [<c0101c05>] cpu_idle+0x65/0xb0
[ 2845.743742] [<c045731e>] rest_init+0x4e/0x60
[ 2845.743742] ---[ end trace 4c985b38f02227a0 ]---
[ 2845.743742] ------------[ cut here ]------------
[ 2845.743742] WARNING: at kernel/smp.c:226 smp_call_function_single+0x8e/0x110()
[ 2845.743742] Hardware name: Dell DM051
[ 2845.743742] Modules linked in: btusb netconsole snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss rfcomm l2cap bluetooth vfat fuse snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_pcm pl2303 snd_timer psmouse usbserial snd 3c59x e100 serio_raw soundcore i2c_i801 intel_agp mii agpgart snd_page_alloc rtc_cmos rtc_core thermal processor rtc_lib button thermal_sys sg evdev
[ 2845.743742] Pid: 0, comm: swapper Tainted: G D W 2.6.29-rc5-smp #54
[ 2845.743742] Call Trace:
[ 2845.743742] [<c012e076>] warn_slowpath+0x86/0xa0
[ 2845.743742] [<c012e000>] ? warn_slowpath+0x10/0xa0
[ 2845.743742] [<c015041b>] ? trace_hardirqs_off+0xb/0x10
[ 2845.743742] [<c0146384>] ? up+0x14/0x40
[ 2845.743742] [<c012e661>] ? release_console_sem+0x31/0x1e0
[ 2845.743742] [<c046c8ab>] ? _spin_lock_irqsave+0x6b/0x80
[ 2845.743742] [<c015041b>] ? trace_hardirqs_off+0xb/0x10
[ 2845.743742] [<c046c900>] ? _read_lock_irqsave+0x40/0x80
[ 2845.743742] [<c012e7f2>] ? release_console_sem+0x1c2/0x1e0
[ 2845.743742] [<c0146384>] ? up+0x14/0x40
[ 2845.743742] [<c015b7be>] smp_call_function_single+0x8e/0x110
[ 2845.743742] [<c010a1a0>] ? stop_this_cpu+0x0/0x40
[ 2845.743742] [<c026d23f>] ? cpumask_next_and+0x1f/0x40
[ 2845.743742] [<c015b95a>] smp_call_function_many+0x11a/0x200
[ 2845.743742] [<c010a1a0>] ? stop_this_cpu+0x0/0x40
[ 2845.743742] [<c015ba61>] smp_call_function+0x21/0x30
[ 2845.743742] [<c01137ae>] native_smp_send_stop+0x1e/0x50
[ 2845.743742] [<c012e0f5>] panic+0x55/0x110
[ 2845.743742] [<c01065a8>] oops_end+0xb8/0xc0
[ 2845.743742] [<c010668f>] die+0x4f/0x70
[ 2845.743742] [<c011a8c9>] do_page_fault+0x269/0x610
[ 2845.743742] [<c011a660>] ? do_page_fault+0x0/0x610
[ 2845.743742] [<c046cbaf>] error_code+0x77/0x7c
[ 2845.743742] [<c015515c>] ? __lock_acquire+0x6c/0xa80
[ 2845.743742] [<c0153732>] ? trace_hardirqs_on_caller+0x72/0x1c0
[ 2845.743742] [<c0155be6>] lock_acquire+0x76/0xa0
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c046c885>] _spin_lock_irqsave+0x45/0x80
[ 2845.743742] [<c03e1aad>] ? skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1aad>] skb_dequeue+0x1d/0x70
[ 2845.743742] [<c03e1f94>] skb_queue_purge+0x14/0x20
[ 2845.743742] [<f8171f5a>] hci_conn_del+0x10a/0x1c0 [bluetooth]
[ 2845.743742] [<f81399c9>] ? l2cap_disconn_ind+0x59/0xb0 [l2cap]
[ 2845.743742] [<f81795ce>] ? hci_conn_del_sysfs+0x8e/0xd0 [bluetooth]
[ 2845.743742] [<f8175758>] hci_event_packet+0x5f8/0x31c0 [bluetooth]
[ 2845.743742] [<c03dfe19>] ? sock_def_readable+0x59/0x80
[ 2845.743742] [<c046c14d>] ? _read_unlock+0x1d/0x20
[ 2845.743742] [<f8178aa9>] ? hci_send_to_sock+0xe9/0x1d0 [bluetooth]
[ 2845.743742] [<c015388b>] ? trace_hardirqs_on+0xb/0x10
[ 2845.743742] [<f816fa6a>] hci_rx_task+0x2ba/0x490 [bluetooth]
[ 2845.743742] [<c0133661>] ? tasklet_action+0x31/0xc0
[ 2845.743742] [<c013367c>] tasklet_action+0x4c/0xc0
[ 2845.743742] [<c0132eb7>] __do_softirq+0xa7/0x170
[ 2845.743742] [<c0116dec>] ? ack_apic_level+0x5c/0x1c0
[ 2845.743742] [<c0132fd7>] do_softirq+0x57/0x60
[ 2845.743742] [<c01333dc>] irq_exit+0x7c/0x90
[ 2845.743742] [<c01055bb>] do_IRQ+0x4b/0x90
[ 2845.743742] [<c01333d5>] ? irq_exit+0x75/0x90
[ 2845.743742] [<c010392c>] common_interrupt+0x2c/0x34
[ 2845.743742] [<c010a14f>] ? mwait_idle+0x4f/0x70
[ 2845.743742] [<c0101c05>] cpu_idle+0x65/0xb0
[ 2845.743742] [<c045731e>] rest_init+0x4e/0x60
[ 2845.743742] ---[ end trace 4c985b38f02227a1 ]---
[ 2845.743742] Rebooting in 3 seconds..

My logitec bluetooth mouse trying connect to pc, but
pc side reject the connection again and again. then panic happens.

The reason is due to hci_conn_del_sysfs now called in hci_event_packet,
the del work is done in a workqueue, so it's possible done before
skb_queue_purge called.

I move the hci_conn_del_sysfs after skb_queue_purge just as that before
marcel's commit.

Remove the hci_conn_del_sysfs in hci_conn_hash_flush as well due to
hci_conn_del will deal with the work.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2526d3d8b2f671a7d36cc486af984052cd5a690f 20-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Permit BT_SECURITY also for L2CAP raw sockets

Userspace pairing code can be simplified if it doesn't have to fall
back to using L2CAP_LM in the case of L2CAP raw sockets. This patch
allows the BT_SECURITY socket option to be used for these sockets.

Signed-off-by: Johan Hedberg <johan.hedberg@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
37e62f5516cfb210e64fe53457932df4341b0ad1 17-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix RFCOMM usage of in-kernel L2CAP sockets

The CID value of L2CAP sockets need to be set to zero. All userspace
applications do this via memset() on the sockaddr_l2 structure. The
RFCOMM implementation uses in-kernel L2CAP sockets and so it has to
make sure that l2_cid is set to zero.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
2a517ca687232adc8f14893730644da712010ffc 16-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Disallow usage of L2CAP CID setting for now

In the future the L2CAP layer will have full support for fixed channels
and right now it already can export the channel assignment, but for the
functions bind() and connect() the usage of only CID 0 is allowed. This
allows an easy detection if the kernel supports fixed channels or not,
because otherwise it would impossible for application to tell.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8bf4794174659b06d43cc5e290cd384757374613 16-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Change RFCOMM to use BT_CONNECT2 for BT_DEFER_SETUP

When BT_DEFER_SETUP is enabled on a RFCOMM socket, then switch its
current state from BT_OPEN to BT_CONNECT2. This gives the Bluetooth
core a unified way to handle L2CAP and RFCOMM sockets. The BT_CONNECT2
state is designated for incoming connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
d5f2d2be68876f65dd051b978a7b66265fde9ffd 16-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix poll() misbehavior when using BT_DEFER_SETUP

When BT_DEFER_SETUP has been enabled on a Bluetooth socket it keeps
signaling POLLIN all the time. This is a wrong behavior. The POLLIN
should only be signaled if the client socket is in BT_CONNECT2 state
and the parent has been BT_DEFER_SETUP enabled.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
96a3183322cba1a2846771b067c99b9d6f481263 12-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set authentication requirement before requesting it

The authentication requirement got only updated when the security level
increased. This is a wrong behavior. The authentication requirement is
read by the Bluetooth daemon to make proper decisions when handling the
IO capabilities exchange. So set the value that is currently expected by
the higher layers like L2CAP and RFCOMM.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
00ae4af91d8c5b6814e2bb3bfaaf743845f989eb 12-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix authentication requirements for L2CAP security check

The L2CAP layer can trigger the authentication via an ACL connection or
later on to increase the security level. When increasing the security
level it didn't use the same authentication requirements when triggering
a new ACL connection. Make sure that exactly the same authentication
requirements are used. The only exception here are the L2CAP raw sockets
which are only used for dedicated bonding.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
2950f21acb0f6b8fcd964485c2ebf1e06545ac20 12-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Ask upper layers for HCI disconnect reason

Some of the qualification tests demand that in case of failures in L2CAP
the HCI disconnect should indicate a reason why L2CAP fails. This is a
bluntly layer violation since multiple L2CAP connections could be using
the same ACL and thus forcing a disconnect reason is not a good idea.

To comply with the Bluetooth test specification, the disconnect reason
is now stored in the L2CAP connection structure and every time a new
L2CAP channel is added it will set back to its default. So only in the
case where the L2CAP channel with the disconnect reason is really the
last one, it will propagated to the HCI layer.

The HCI layer has been extended with a disconnect indication that allows
it to ask upper layers for a disconnect reason. The upper layer must not
support this callback and in that case it will nicely default to the
existing behavior. If an upper layer like L2CAP can provide a disconnect
reason that one will be used to disconnect the ACL or SCO link.

No modification to the ACL disconnect timeout have been made. So in case
of Linux to Linux connection the initiator will disconnect the ACL link
before the acceptor side can signal the specific disconnect reason. That
is perfectly fine since Linux doesn't make use of this value anyway. The
L2CAP layer has a perfect valid error code for rejecting connection due
to a security violation. It is unclear why the Bluetooth specification
insists on having specific HCI disconnect reason.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap.c
co.c
f29972de8e7476706ab3c01304a505e7c95d9040 12-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add CID field to L2CAP socket address structure

In preparation for L2CAP fixed channel support, the CID value of a
L2CAP connection needs to be accessible via the socket interface. The
CID is the connection identifier and exists as source and destination
value. So extend the L2CAP socket address structure with this field and
change getsockname() and getpeername() to fill it in.

The bind() and connect() functions have been modified to handle L2CAP
socket address structures of variable sizes. This makes them future
proof if additional fields need to be added.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
e1027a7c69700301d14db03d2e049ee60c4f92df 09-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Request L2CAP fixed channel list if available

If the extended features mask indicates support for fixed channels,
request the list of available fixed channels. This also enables the
fixed channel features bit so remote implementations can request
information about it. Currently only the signal channel will be
listed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
435fef20acfc48f46476abad55b0cd3aa47b8365 09-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't enforce authentication for L2CAP PSM 1 and 3

The recommendation for the L2CAP PSM 1 (SDP) is to not use any kind
of authentication or encryption. So don't trigger authentication
for incoming and outgoing SDP connections.

For L2CAP PSM 3 (RFCOMM) there is no clear requirement, but with
Bluetooth 2.1 the initiator is required to enable authentication
and encryption first and this gets enforced. So there is no need
to trigger an additional authentication step. The RFCOMM service
security will make sure that a secure enough link key is present.

When the encryption gets enabled after the SDP connection setup,
then switch the security level from SDP to low security.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6a8d3010b313d99adbb28f1826fac0234395bb26 06-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix double L2CAP connection request

If the remote L2CAP server uses authentication pending stage and
encryption is enabled it can happen that a L2CAP connection request is
sent twice due to a race condition in the connection state machine.

When the remote side indicates any kind of connection pending, then
track this state and skip sending of L2CAP commands for this period.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
984947dc64f82bc6cafa4d84ba1a139718f634a8 06-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix race condition with L2CAP information request

When two L2CAP connections are requested quickly after the ACL link has
been established there exists a window for a race condition where a
connection request is sent before the information response has been
received. Any connection request should only be sent after an exchange
of the extended features mask has been finished.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
657e17b03c80bec817975984d221bef716f83558 06-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Set authentication requirements if not available

When no authentication requirements are selected, but an outgoing or
incoming connection has requested any kind of security enforcement,
then set these authentication requirements.

This ensures that the userspace always gets informed about the
authentication requirements (if available). Only when no security
enforcement has happened, the kernel will signal invalid requirements.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
0684e5f9fb9e3f7e168ab831dfca693bcb44805b 09-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Use general bonding whenever possible

When receiving incoming connection to specific services, always use
general bonding. This ensures that the link key gets stored and can be
used for further authentications.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap.c
fcomm/core.c
efc7688b557dd1be10eead7399b315efcb1dbc74 06-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add SCO fallback for eSCO connection attempts

When attempting to setup eSCO connections it can happen that some link
manager implementations fail to properly negotiate the eSCO parameters
and thus fail the eSCO setup. Normally the link manager is responsible
for the negotiation of the parameters and actually fallback to SCO if
no agreement can be reached. In cases where the link manager is just too
stupid, then at least try to establish a SCO link if eSCO fails.

For the Bluetooth devices with EDR support this includes handling packet
types of EDR basebands. This is particular tricky since for the EDR the
logic of enabling/disabling one specific packet type is turned around.
This fix contains an extra bitmask to disable eSCO EDR packet when
trying to fallback to a SCO connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
255c76014af74165428e7aa16414b857e2bdccf2 04-Feb-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Don't check encryption for L2CAP raw sockets

For L2CAP sockets with medium and high security requirement a missing
encryption will enforce the closing of the link. For the L2CAP raw
sockets this is not needed, so skip that check.

This fixes a crash when pairing Bluetooth 2.0 (and earlier) devices
since the L2CAP state machine got confused and then locked up the whole
system.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
6e1031a40029492c10509e8c3dcac9b611438ccb 03-Feb-2009 Jaikumar Ganesh <jaikumar@google.com> Bluetooth: When encryption is dropped, do not send RFCOMM packets

During a role change with pre-Bluetooth 2.1 devices, the remote side drops
the encryption of the RFCOMM connection. We allow a grace period for the
encryption to be re-established, before dropping the connection. During
this grace period, the RFCOMM_SEC_PENDING flag is set. Check this flag
before sending RFCOMM packets.

Signed-off-by: Jaikumar Ganesh <jaikumar@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
dd2efd03b49d56ae795c71335bc7358022514c32 31-Jan-2009 Dave Young <hidave.darkstar@gmail.com> Bluetooth: Remove CONFIG_DEBUG_LOCK_ALLOC ifdefs

Due to lockdep changes, the CONFIG_DEBUG_LOCK_ALLOC ifdef is not needed
now. So just remove it here.

The following commit fixed the !lockdep build warnings:

commit e8f6fbf62de37cbc2e179176ac7010d5f4396b67
Author: Ingo Molnar <mingo@elte.hu>
Date: Wed Nov 12 01:38:36 2008 +0000

lockdep: include/linux/lockdep.h - fix warning in net/bluetooth/af_bluetooth.c

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
5f9018af004fa8635bbbe3ab2dc61e8a686edfaa 16-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Update version numbers

With the support for the enhanced security model and the support for
deferring connection setup, it is a good idea to increase various
version numbers.

This is purely cosmetic and has no effect on the behavior, but can
be really helpful when debugging problems in different kernel versions.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
2cap.c
fcomm/core.c
0588d94fd7e414367a7ae517569d2222441c255f 16-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Restrict application of socket options

The new socket options should only be evaluated for SOL_BLUETOOTH level
and not for every other level. Previously this causes some minor issues
when detecting if a kernel with certain features is available.

Also restrict BT_SECURITY to SOCK_SEQPACKET for L2CAP and SOCK_STREAM for
the RFCOMM protocol.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcomm/sock.c
f62e4323ab43c59e7cd7f72c1eb392d7c767ce5a 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Disconnect L2CAP connections without encryption

For L2CAP connections with high security setting, the link will be
immediately dropped when the encryption gets disabled. For L2CAP
connections with medium security there will be grace period where
the remote device has the chance to re-enable encryption. If it
doesn't happen then the link will also be disconnected.

The requirement for the grace period with medium security comes from
Bluetooth 2.0 and earlier devices that require role switching.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8c84b83076b5062f59b6167cdda90d9e5124aa71 16-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Pause RFCOMM TX when encryption drops

A role switch with devices following the Bluetooth pre-2.1 standards
or without Encryption Pause and Resume support is not possible if
encryption is enabled. Most newer headsets require the role switch,
but also require that the connection is encrypted.

For connections with a high security mode setting, the link will be
immediately dropped. When the connection uses medium security mode
setting, then a grace period is introduced where the TX is halted and
the remote device gets a change to re-enable encryption after the
role switch. If not re-enabled the link will be dropped.

Based on initial work by Ville Tervo <ville.tervo@nokia.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
9f2c8a03fbb3048cf38b158f87aa0c3c09bca084 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Replace RFCOMM link mode with security level

Change the RFCOMM internals to use the new security levels and remove
the link mode details.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/sock.c
2af6b9d518ddfbc4d6990d5f9c9b1a05341c1cef 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Replace L2CAP link mode with security level

Change the L2CAP internals to use the new security levels and remove
the link mode details.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
8c1b235594fbab9a13240a1dac12ea9fd99b6440 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add enhanced security model for Simple Pairing

The current security model is based around the flags AUTH, ENCRYPT and
SECURE. Starting with support for the Bluetooth 2.1 specification this is
no longer sufficient. The different security levels are now defined as
SDP, LOW, MEDIUM and SECURE.

Previously it was possible to set each security independently, but this
actually doesn't make a lot of sense. For Bluetooth the encryption depends
on a previous successful authentication. Also you can only update your
existing link key if you successfully created at least one before. And of
course the update of link keys without having proper encryption in place
is a security issue.

The new security levels from the Bluetooth 2.1 specification are now
used internally. All old settings are mapped to the new values and this
way it ensures that old applications still work. The only limitation
is that it is no longer possible to set authentication without also
enabling encryption. No application should have done this anyway since
this is actually a security issue. Without encryption the integrity of
the authentication can't be guaranteed.

As default for a new L2CAP or RFCOMM connection, the LOW security level
is used. The only exception here are the service discovery sessions on
PSM 1 where SDP level is used. To have similar security strength as with
a Bluetooth 2.0 and before combination key, the MEDIUM level should be
used. This is according to the Bluetooth specification. The MEDIUM level
will not require any kind of man-in-the-middle (MITM) protection. Only
the HIGH security level will require this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
2cap.c
fcomm/core.c
co.c
c89b6e6bda4c8021195778f47567d0cc9dbfe7ec 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix SCO state handling for incoming connections

When the remote device supports only SCO connections, on receipt of
the HCI_EV_CONN_COMPLETE event packet, the connect state is changed to
BT_CONNECTED, but the socket state is not updated. Hence, the connect()
call times out even though the SCO connection has been successfully
established.

Based on a report by Jaikumar Ganesh <jaikumar@google.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
71aeeaa1fd88fe7446391e0553336f0e0c2cfe6a 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Reject incoming SCO connections without listeners

All SCO and eSCO connection are auto-accepted no matter if there is a
corresponding listening socket for them. This patch changes this and
connection requests for SCO and eSCO without any socket are rejected.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
co.c
f66dc81f44d918ee1aa1a9d821bb2f25c7592bc0 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for deferring L2CAP connection setup

In order to decide if listening L2CAP sockets should be accept()ed
the BD_ADDR of the remote device needs to be known. This patch adds
a socket option which defines a timeout for deferring the actual
connection setup.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
bb23c0ab824653be4aa7dfca15b07b3059717004 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add support for deferring RFCOMM connection setup

In order to decide if listening RFCOMM sockets should be accept()ed
the BD_ADDR of the remote device needs to be known. This patch adds
a socket option which defines a timeout for deferring the actual
connection setup.

The connection setup is done after reading from the socket for the
first time. Until then writing to the socket returns ENOTCONN.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/sock.c
c4f912e155504e94dd4f3d63c378dab0ff03dbda 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Add global deferred socket parameter

The L2CAP and RFCOMM applications require support for authorization
and the ability of rejecting incoming connection requests. The socket
interface is not really able to support this.

This patch does the ground work for a socket option to defer connection
setup. Setting this option allows calling of accept() and then the
first read() will trigger the final connection setup. Calling close()
would reject the connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
d58daf42d29a3a4a4d4be46cf47ceee096789680 15-Jan-2009 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Preparation for usage of SOL_BLUETOOTH

The socket option levels SOL_L2CAP, SOL_RFOMM and SOL_SCO are currently
in use by various Bluetooth applications. Going forward the common
option level SOL_BLUETOOTH should be used. This patch prepares the clean
split of the old and new option levels while keeping everything backward
compatibility.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcomm/sock.c
co.c
91aa35a5aa3540223066bf6b51c935418c63a35d 15-Jan-2009 Victor Shcherbatyuk <victor.shcherbatyuk@tomtom.com> Bluetooth: Fix issue with return value of rfcomm_sock_sendmsg()

In case of connection failures the rfcomm_sock_sendmsg() should return
an error and not a 0 value.

Signed-off-by: Victor Shcherbatyuk <victor.shcherbatyuk@tomtom.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
b4d7f0a46bc0e30514b1779caff0fce6e424c4b5 08-Jan-2009 Stephen Hemminger <shemminger@vyatta.com> bluetooth: driver API update

Convert to net_device_ops and use internal net_device_stats in bnep
device.

Note: no need for bnep_net_ioctl since if ioctl is not set, then
dev_ifsioc handles it by returning -EOPNOTSUPP

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
nep/core.c
nep/netdev.c
6332178d91ca1a9dbd99bd97cabbcf965d178e9f 24-Dec-2008 David S. Miller <davem@davemloft.net> Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:

drivers/net/ppp_generic.c
1b08534e562dae7b084326f8aa8cc12a4c1b6593 19-Dec-2008 Wei Yongjun <yjwei@cn.fujitsu.com> net: Fix module refcount leak in kernel_accept()

The kernel_accept() does not hold the module refcount of newsock->ops->owner,
so we need __module_get(newsock->ops->owner) code after call kernel_accept()
by hand.
In sunrpc, the module refcount is missing to hold. So this cause kernel panic.

Used following script to reproduct:

while [ 1 ];
do
mount -t nfs4 192.168.0.19:/ /mnt
touch /mnt/file
umount /mnt
lsmod | grep ipv6
done

This patch fixed the problem by add __module_get(newsock->ops->owner) to
kernel_accept(). So we do not need to used __module_get(newsock->ops->owner)
in every place when used kernel_accept().

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
037322abe6141e32e1b1dea86a9405d52c99be5d 15-Dec-2008 Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> bt/rfcomm/tty: join error paths

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
e19caae7177fcc732ae1b47135e39f577352adb2 09-Dec-2008 David S. Miller <davem@davemloft.net> bluetooth: Fix unused var warning properly in rfcomm_sock_ioctl().

As Stephen Rothwell points out, we don't want 'sock' here but
rather we really do want 'sk'.

This local var is protected by all sorts of bluetooth debugging
kconfig vars, but BT_DBG() is just a straight pr_debug() call
which is unconditional.

pr_debug() evaluates it's args only if either DEBUG or
CONFIG_DYNAMIC_PRINTK_DEBUG is defined.

Solving this inside of the BT_DBG() macro is non-trivial since
it's varargs. And these ifdefs are ugly.

So, just mark this 'sk' thing __maybe_unused and kill the ifdefs.

Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
6cf1a0f856bcb5423bfb4121b2dfeaa3ba7b1ff2 09-Dec-2008 David S. Miller <davem@davemloft.net> bluetooth: Fix rfcomm_sock_ioctl() build failure with debugging enabled.

It's 'sock' not 'sk'.

Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
9a5df92374d65e2886b92e98dd7d873c533a83ff 30-Nov-2008 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix RFCOMM release oops when device is still in use

It turns out that the following sequence of actions will reproduce the
oops:

1. Create a new RFCOMM device (using RFCOMMCREATEDEV ioctl)
2. (Try to) open the device
3. Release the RFCOMM device (using RFCOMMRELEASEDEV ioctl)

At this point, the "/dev/rfcomm*" device is still in use, but it is gone
from the internal list, so the device id can be reused.

4. Create a new RFCOMM device with the same device id as before

And now kobject will complain that the TTY already exists.

(See http://lkml.org/lkml/2008/7/13/89 for a reproducible test-case.)

This patch attempts to correct this by only removing the device from the
internal list of devices at the final unregister stage, so that the id
won't get reused until the device has been completely destructed.

This should be safe as the RFCOMM_TTY_RELEASED bit will be set for the
device and prevent the device from being reopened after it has been
released.

Based on a report from Vegard Nossum <vegard.nossum@gmail.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
2e792995e4cb425422dc379c3618447c462756a8 30-Nov-2008 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix format arguments warning

Newer GCC versions are a little bit picky about how to deal with format
arguments:

net/bluetooth/hci_sysfs.c: In function ‘hci_register_sysfs’:
net/bluetooth/hci_sysfs.c:418: warning: format not a string literal and no format arguments

It is simple enough to fix and makes the compiler happy.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
a418b893a6af11ae73c762ed5b76c1bad6dc19d8 30-Nov-2008 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Enable per-module dynamic debug messages

With the introduction of CONFIG_DYNAMIC_PRINTK_DEBUG it is possible to
allow debugging without having to recompile the kernel. This patch turns
all BT_DBG() calls into pr_debug() to support dynamic debug messages.

As a side effect all CONFIG_BT_*_DEBUG statements are now removed and
some broken debug entries have been fixed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
nep/bnep.h
nep/core.c
nep/netdev.c
nep/sock.c
mtp/capi.c
mtp/core.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
idp/core.c
idp/sock.c
2cap.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
7a9d4020533b5c0c615b6de3be154c9ff30b8cc9 30-Nov-2008 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Send HCI Reset command by default on device initialization

The Bluetooth subsystem was not using the HCI Reset command when doing
device initialization. The Bluetooth 1.0b specification was ambiguous
on how the device firmware was suppose to handle it. Almost every device
was triggering a transport reset at the same time. In case of USB this
ended up in disconnects from the bus.

All modern Bluetooth dongles handle this perfectly fine and a lot of
them actually require that HCI Reset is sent. If not then they are
either stuck in their HID Proxy mode or their internal structures for
inquiry and paging are not correctly setup.

To handle old and new devices smoothly the Bluetooth subsystem contains
a quirk to force the HCI Reset on initialization. However maintaining
such a quirk becomes more and more complicated. This patch turns the
logic around and lets the old devices disable the HCI Reset command.

The only device where the HCI_QUIRK_NO_RESET is still needed are the
original Digianswer devices and dongles with an early CSR firmware.

CSR reported that they fixed this for version 12 firmware. The last
official release of version 11 firmware is build ID 115. The first
version 12 candidate was build ID 117.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_core.c
db7aa1c203d477351ed1b8f394b40d9df06ddfc4 30-Nov-2008 Marcel Holtmann <marcel@holtmann.org> Bluetooth: Fix warnings for bt_key_strings and bt_slock_key_strings

After adding proper lockdep annotations for Bluetooth protocols the case
when lockdep is disabled produced two compiler warnings:

net/bluetooth/af_bluetooth.c:60: warning: ‘bt_key_strings’ defined but not used
net/bluetooth/af_bluetooth.c:71: warning: ‘bt_slock_key_strings’ defined but not used

Fix both of them by adding a CONFIG_DEBUG_LOCK_ALLOC conditional around
them and re-arranging the code a little bit.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
c6bf514c6e0171c5b731beffaa0c4463e2335f3d 30-Nov-2008 Vegard Nossum <vegard.nossum@gmail.com> Bluetooth: Fix leak of uninitialized data to userspace

struct hci_dev_list_req {
__u16 dev_num;
struct hci_dev_req dev_req[0]; /* hci_dev_req structures */
};

sizeof(struct hci_dev_list_req) == 4, so the two bytes immediately
following "dev_num" will never be initialized. When this structure
is copied to userspace, these uninitialized bytes are leaked.

Fix by using kzalloc() instead of kmalloc(). Found using kmemcheck.

Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
45555c0ed436b8b06eeaa5c524a3377e6d24fb45 26-Nov-2008 Ingo Molnar <mingo@elte.hu> bluetooth: fix warning in net/bluetooth/rfcomm/sock.c

fix this warning:

net/bluetooth/rfcomm/sock.c: In function ‘rfcomm_sock_ioctl’:
net/bluetooth/rfcomm/sock.c:795: warning: unused variable ‘sk’

perhaps BT_DEBUG() should be improved to do printf format checking
instead of the #ifdef, but that looks quite intrusive: each bluetooth
.c file undefines the macro.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/sock.c
524ad0a79126efabf58d0a49eace6155ab5b4549 13-Nov-2008 Wang Chen <wangchen@cn.fujitsu.com> netdevice: safe convert to netdev_priv() #part-4

We have some reasons to kill netdev->priv:
1. netdev->priv is equal to netdev_priv().
2. netdev_priv() wraps the calculation of netdev->priv's offset, obviously
netdev_priv() is more flexible than netdev->priv.
But we cann't kill netdev->priv, because so many drivers reference to it
directly.

This patch is a safe convert for netdev->priv to netdev_priv(netdev).
Since all of the netdev->priv is only for read.
But it is too big to be sent in one mail.
I split it to 4 parts and make every part smaller than 100,000 bytes,
which is max size allowed by vger.

Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
nep/netdev.c
fb28ad35906af2f042c94e2f9c0f898ef9acfa37 10-Nov-2008 Kay Sievers <kay.sievers@vrfy.org> net: struct device - replace bus_id with dev_name(), dev_set_name()

Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Kay Sievers <kay.sievers@vrfy.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
d2ad3ca88da02baeccd5216780f1fe983c6953ba 04-Nov-2008 David S. Miller <davem@davemloft.net> net/: Kill now superfluous ->last_rx stores.

The generic packet receive code takes care of setting
netdev->last_rx when necessary, for the sake of the
bonding ARP monitor.

Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
b225ee5bed70254a100896c473e6dd8c2be45c18 17-Oct-2008 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
net: Remove CONFIG_KMOD from net/ (towards removing CONFIG_KMOD entirely)
ipv4: Add a missing rcu_assign_pointer() in routing cache.
[netdrvr] ibmtr: PCMCIA IBMTR is ok on 64bit
xen-netfront: Avoid unaligned accesses to IP header
lmc: copy_*_user under spinlock
[netdrvr] myri10ge, ixgbe: remove broken select INTEL_IOATDMA
95a5afca4a8d2e1cb77e1d4bc6ff9f718dc32f7a 17-Oct-2008 Johannes Berg <johannes@sipsolutions.net> net: Remove CONFIG_KMOD from net/ (towards removing CONFIG_KMOD entirely)

Some code here depends on CONFIG_KMOD to not try to load
protocol modules or similar, replace by CONFIG_MODULES
where more than just request_module depends on CONFIG_KMOD
and and also use try_then_request_module in ebtables.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
93c10132a7ac160df3175b53f7ee857625412165 27-Jun-2008 Jiri Slaby <jirislaby@gmail.com> HID: move connect quirks

Move connecting from usbhid to the hid layer and fix also hidp in
that manner.
This removes all the ignore/force hidinput/hiddev connecting quirks.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
8c19a51591d06f5226499972567f528cf6066bb7 18-Jun-2008 Jiri Slaby <jirislaby@gmail.com> HID: move apple quirks

Move them from the core code to a separate driver.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
d458a9dfc4de24870b8c747484b1988726534bee 16-May-2008 Jiri Slaby <jirislaby@gmail.com> HID: move ignore quirks

Move ignore quirks from usbhid-quirks into hid-core code. Also don't output
warning when ENODEV is error code in usbhid and try ordinal input in hidp
when that error is returned.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
c500c9714011edab021591340042787722db9cf0 16-May-2008 Jiri Slaby <jirislaby@gmail.com> HID: hid, make parsing event driven

Next step for complete hid bus, this patch includes:
- call parser either from probe or from hid-core if there is no probe.
- add ll_driver structure and centralize some stuff there (open, close...)
- split and merge usb_hid_configure and hid_probe into several functions
to allow hooks/fixes between them

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
idp/hidp.h
85cdaf524b7ddab627e7d15405693f2511ef7505 16-May-2008 Jiri Slaby <jirislaby@gmail.com> HID: make a bus from hid code

Make a bus from hid core. This is the first step for converting all the
quirks and separate almost-drivers into real drivers attached to this bus.

It's implemented to change behaviour in very tiny manner, so that no driver
needs to be changed this time.

Also add generic drivers for both usb and bt into usbhid or hidp
respectively which will bind all non-blacklisted device. Those blacklisted
will be either grabbed by special drivers or by nobody if they are broken at
the very rude base.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
idp/core.c
7c6a329e444725f24c02192ac493d8a7cd9fa638 12-Sep-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix regression from using default link policy

To speed up the Simple Pairing connection setup, the support for the
default link policy has been enabled. This is in contrast to settings
the link policy on every connection setup. Using the default link policy
is the preferred way since there is no need to dynamically change it for
every connection.

For backward compatibility reason and to support old userspace the
HCISETLINKPOL ioctl has been switched over to using hci_request() to
issue the HCI command for setting the default link policy instead of
just storing it in the HCI device structure.

However the hci_request() can only be issued when the device is
brought up. If used on a device that is registered, but still down
it will timeout and fail. This is problematic since the command is
put on the TX queue and the Bluetooth core tries to submit it to
hardware that is not ready yet. The timeout for these requests is
10 seconds and this causes a significant regression when setting up
a new device.

The userspace can perfectly handle a failure of the HCISETLINKPOL
ioctl and will re-submit it later, but the 10 seconds delay causes
a problem. So in case hci_request() is called on a device that is
still down, just fail it with ENETDOWN to indicate what happens.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
e7c29cb16c833441fd2160642bb13025f4e7ac70 09-Sep-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Reject L2CAP connections on an insecure ACL link

The Security Mode 4 of the Bluetooth 2.1 specification has strict
authentication and encryption requirements. It is the initiators job
to create a secure ACL link. However in case of malicious devices, the
acceptor has to make sure that the ACL is encrypted before allowing
any kind of L2CAP connection. The only exception here is the PSM 1 for
the service discovery protocol, because that is allowed to run on an
insecure ACL link.

Previously it was enough to reject a L2CAP connection during the
connection setup phase, but with Bluetooth 2.1 it is forbidden to
do any L2CAP protocol exchange on an insecure link (except SDP).

The new hci_conn_check_link_mode() function can be used to check the
integrity of an ACL link. This functions also takes care of the cases
where Security Mode 4 is disabled or one of the devices is based on
an older specification.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_conn.c
2cap.c
09ab6f4c2376a0fc31abde1e2991513f900ea825 09-Sep-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Enforce correct authentication requirements

With the introduction of Security Mode 4 and Simple Pairing from the
Bluetooth 2.1 specification it became mandatory that the initiator
requires authentication and encryption before any L2CAP channel can
be established. The only exception here is PSM 1 for the service
discovery protocol (SDP). It is meant to be used without any encryption
since it contains only public information. This is how Bluetooth 2.0
and before handle connections on PSM 1.

For Bluetooth 2.1 devices the pairing procedure differentiates between
no bonding, general bonding and dedicated bonding. The L2CAP layer
wrongly uses always general bonding when creating new connections, but it
should not do this for SDP connections. In this case the authentication
requirement should be no bonding and the just-works model should be used,
but in case of non-SDP connection it is required to use general bonding.

If the new connection requires man-in-the-middle (MITM) protection, it
also first wrongly creates an unauthenticated link key and then later on
requests an upgrade to an authenticated link key to provide full MITM
protection. With Simple Pairing the link key generation is an expensive
operation (compared to Bluetooth 2.0 and before) and doing this twice
during a connection setup causes a noticeable delay when establishing
a new connection. This should be avoided to not regress from the expected
Bluetooth 2.0 connection times. The authentication requirements are known
up-front and so enforce them.

To fulfill these requirements the hci_connect() function has been extended
with an authentication requirement parameter that will be stored inside
the connection information and can be retrieved by userspace at any
time. This allows the correct IO capabilities exchange and results in
the expected behavior.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
2cap.c
co.c
f1c08ca559387ab30992055596d54061dfa022b1 09-Sep-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix reference counting during ACL config stage

The ACL config stage keeps holding a reference count on incoming
connections when requesting the extended features. This results in
keeping an ACL link up without any users. The problem here is that
the Bluetooth specification doesn't define an ownership of the ACL
link and thus it can happen that the implementation on the initiator
side doesn't care about disconnecting unused links. In this case the
acceptor needs to take care of this.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
63fbd24e5102eecfc9d049ed7f4be7f9a25f814f 18-Aug-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Consolidate maintainers information

The Bluetooth entries for the MAINTAINERS file are a little bit too
much. Consolidate them into two entries. One for Bluetooth drivers and
another one for the Bluetooth subsystem.

Also the MODULE_AUTHOR should indicate the current maintainer of the
module and actually not the original author. Fix all Bluetooth modules
to provide current maintainer information.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
nep/core.c
2cap.c
fcomm/core.c
co.c
90855d7b725d764d6d70503bcc1b494cf10ddc98 18-Aug-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix userspace breakage due missing class links

The Bluetooth adapters and connections are best presented via a class
in sysfs. The removal of the links inside the Bluetooth class broke
assumptions by userspace programs on how to find attached adapters.

This patch creates adapters and connections as part of the Bluetooth
class, but it uses different device types to distinguish them. The
userspace programs can now easily navigate in the sysfs device tree.

The unused platform device and bus have been removed to keep the
code simple and clean.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
28111eb2f5087c5aa5ec3697388f6c7d354b2ad8 07-Aug-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add parameters to control BNEP header compression

The Bluetooth qualification for PAN demands testing with BNEP header
compression disabled. This is actually pretty stupid and the Linux
implementation outsmarts the test system since it compresses whenever
possible. So to pass qualification two need parameters have been added
to control the compression of source and destination headers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
16be63fd1670000b96b76cb55b6f1bead21b4c4b 27-May-2008 Greg Kroah-Hartman <gregkh@suse.de> bluetooth: remove improper bluetooth class symlinks.

Don't create symlinks in a class to a device that is not owned by the
class. If the bluetooth subsystem really wants to point to all of the
devices it controls, it needs to create real devices, not fake symlinks.

Cc: Maxim Krasnyansky <maxk@qualcomm.com>
Cc: Kay Sievers <kay.sievers@vrfy.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ci_sysfs.c
db6d8c7a4027b48d797b369a53f8470aaeed7063 21-Jul-2008 Linus Torvalds <torvalds@linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (1232 commits)
iucv: Fix bad merging.
net_sched: Add size table for qdiscs
net_sched: Add accessor function for packet length for qdiscs
net_sched: Add qdisc_enqueue wrapper
highmem: Export totalhigh_pages.
ipv6 mcast: Omit redundant address family checks in ip6_mc_source().
net: Use standard structures for generic socket address structures.
ipv6 netns: Make several "global" sysctl variables namespace aware.
netns: Use net_eq() to compare net-namespaces for optimization.
ipv6: remove unused macros from net/ipv6.h
ipv6: remove unused parameter from ip6_ra_control
tcp: fix kernel panic with listening_get_next
tcp: Remove redundant checks when setting eff_sacks
tcp: options clean up
tcp: Fix MD5 signatures for non-linear skbs
sctp: Update sctp global memory limit allocations.
sctp: remove unnecessary byteshifting, calculate directly in big-endian
sctp: Allow only 1 listening socket with SO_REUSEADDR
sctp: Do not leak memory on multiple listen() calls
sctp: Support ipv6only AF_INET6 sockets.
...
a352def21a642133758b868c71bee12ab34ad5c5 16-Jul-2008 Alan Cox <alan@redhat.com> tty: Ldisc revamp

Move the line disciplines towards a conventional ->ops arrangement. For
the moment the actual 'tty_ldisc' struct in the tty is kept as part of
the tty struct but this can then be changed if it turns out that when it
all settles down we want to refcount ldiscs separately to the tty.

Pull the ldisc code out of /proc and put it with our ldisc code.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fcomm/tty.c
407d819cf0fd54c6fc1138a509225696aecafd15 19-Jul-2008 David S. Miller <davem@davemloft.net> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6
b1235d79611e78a07629b4cbe53291c9cffd1834 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Allow security for outgoing L2CAP connections

When requested the L2CAP layer will now enforce authentication and
encryption on outgoing connections. The usefulness of this feature
is kinda limited since it will not allow proper connection ownership
tracking until the authentication procedure has been finished. This
is a limitation of Bluetooth 2.0 and before and can only be fixed by
using Simple Pairing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7cb127d5b0e7af7a0afd23785722ca3edab4ceff 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add option to disable eSCO connection creation

It has been reported that some eSCO capable headsets are not able to
connect properly. The real reason for this is unclear at the moment. So
for easier testing add a module parameter to disable eSCO connection
creation.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
co.c
ec8dab36e0738d3059980d144e34f16a26bbda7d 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Signal user-space for HIDP and BNEP socket errors

When using the HIDP or BNEP kernel support, the user-space needs to
know if the connection has been terminated for some reasons. Wake up
the application if that happens. Otherwise kernel and user-space are
no longer on the same page and weird behaviors can happen.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
idp/core.c
a0c22f226502be6eab37a1d9bf6fb0fadf551376 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Move pending packets from RFCOMM socket to TTY

When an incoming RFCOMM socket connection gets converted into a TTY,
it can happen that packets are lost. This mainly happens with the
Handsfree profile where the remote side starts sending data right
away. The problem is that these packets are in the socket receive
queue. So when creating the TTY make sure to copy all pending packets
from the socket receive queue to a private queue inside the TTY.

To make this actually work, the flow control on the newly created TTY
will be disabled and only enabled again when the TTY is opened by an
application. And right before that, the pending packets will be put
into the TTY flip buffer.

Signed-off-by: Denis Kenzior <denis.kenzior@trolltech.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/tty.c
8b6b3da765af9600b5edd8e3e84a20523e975884 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Store remote modem status for RFCOMM TTY

When switching a RFCOMM socket to a TTY, the remote modem status might
be needed later. Currently it is lost since the original configuration
is done via the socket interface. So store the modem status and reply
it when the socket has been converted to a TTY.

Signed-off-by: Denis Kenzior <denis.kenzior@trolltech.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/tty.c
ca37bdd53b5af06d00e792f2415b93206aa2a541 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Use non-canonical TTY by default for RFCOMM

While the RFCOMM TTY emulation can act like a real serial port, in
reality it is not used like this. So to not mess up stupid applications,
use the non-canonical mode by default.

Signed-off-by: Denis Kenzior <denis.kenzior@trolltech.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
78c6a1744fafc3a396f85c1970eb78839b55af74 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Update Bluetooth core version number

With all the Bluetooth 2.1 changes and the support for Simple Pairing,
it is important to update the Bluetooth core version number.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
7d0db0a373195385a2e0b19d1f5e4b186fdcffac 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Use a more unique bus name for connections

When attaching Bluetooth low-level connections to the bus, the bus name
is constructed from the remote address since at that time the connection
handle is not assigned yet. This has worked so far, but also caused a
lot of troubles. It is better to postpone the creation of the sysfs
entry to the time when the connection actually has been established
and then use its connection handle as unique identifier.

This also fixes the case where two different adapters try to connect
to the same remote device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
ci_sysfs.c
43cbeee9f9b26300275e4e2d55ed1607f8c5f760 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add support for TIOCOUTQ and TIOCINQ ioctls

Almost every protocol family supports the TIOCOUTQ and TIOCINQ ioctls
and even Bluetooth could make use of them. When implementing audio
streaming and integration with GStreamer or PulseAudio they will allow
a better timing and synchronization.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
3241ad820dbb172021e0268b5611031991431626 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO

Enable the common timestamp functionality that the network subsystem
provides for L2CAP, RFCOMM and SCO sockets. It is possible to either
use SO_TIMESTAMP or the IOCTLs to retrieve the timestamp of the
current packet.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
2cap.c
fcomm/sock.c
co.c
40be492fe4fab829951681860c2bb26fa1d5fe4a 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Export details about authentication requirements

With the Simple Pairing support, the authentication requirements are
an explicit setting during the bonding process. Track and enforce the
requirements and allow higher layers like L2CAP and RFCOMM to increase
them if needed.

This patch introduces a new IOCTL that allows to query the current
authentication requirements. It is also possible to detect Simple
Pairing support in the kernel this way.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_sock.c
2cap.c
fcomm/core.c
f8558555f31e177e2644f3c8116801c3e5c29974 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Initiate authentication during connection establishment

With Bluetooth 2.1 and Simple Pairing the requirement is that any new
connection needs to be authenticated and that encryption has been
switched on before allowing L2CAP to use it. So make sure that all
the requirements are fulfilled and otherwise drop the connection with
a minimal disconnect timeout of 10 milliseconds.

This change only affects Bluetooth 2.1 devices and Simple Pairing
needs to be enabled locally and in the remote host stack. The previous
changes made sure that these information are discovered before any
kind of authentication and encryption is triggered.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
769be974d0c7b4fe1a52f9cdaad22259b60953f7 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Use ACL config stage to retrieve remote features

The Bluetooth technology introduces new features on a regular basis
and for some of them it is important that the hardware on both sides
support them. For features like Simple Pairing it is important that
the host stacks on both sides have switched this feature on. To make
valid decisions, a config stage during ACL link establishment has been
introduced that retrieves remote features and if needed also the remote
extended features (known as remote host features) before signalling
this link as connected.

This change introduces full reference counting of incoming and outgoing
ACL links and the Bluetooth core will disconnect both if no owner of it
is present. To better handle interoperability during the pairing phase
the disconnect timeout for incoming connections has been increased to
10 seconds. This is five times more than for outgoing connections.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
a8bd28baf21b9ee6b8486666b771283e566c0d31 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Export remote Simple Pairing mode via sysfs

Since the remote Simple Pairing mode is stored together with the
inquiry cache, it makes sense to show it together with the other
information.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
41a96212b3b7b3cd59e8e8d33e6dabf0e21d9778 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Track status of remote Simple Pairing mode

The Simple Pairing process can only be used if both sides have the
support enabled in the host stack. The current Bluetooth specification
has three ways to detect this support.

If an Extended Inquiry Result has been sent during inquiry then it
is safe to assume that Simple Pairing is enabled. It is not allowed
to enable Extended Inquiry without Simple Pairing. During the remote
name request phase a notification with the remote host supported
features will be sent to indicate Simple Pairing support. Also the
second page of the remote extended features can indicate support for
Simple Pairing.

For all three cases the value of remote Simple Pairing mode is stored
in the inquiry cache for later use.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
333140b57fa7867bc92e5ee879b6ac4ef5e1d867 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Track status of Simple Pairing mode

The Simple Pairing feature is optional and needs to be enabled by the
host stack first. The Linux kernel relies on the Bluetooth daemon to
either enable or disable it, but at any time it needs to know the
current state of the Simple Pairing mode. So track any changes made
by external entities and store the current mode in the HCI device
structure.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0493684ed2397e111574f343534d8e4ec440dfa5 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Disable disconnect timer during Simple Pairing

During the Simple Pairing process the HCI disconnect timer must be
disabled. The way to do this is by holding a reference count of the
HCI connection. The Simple Pairing process on both sides starts with
an IO Capabilities Request and ends with Simple Pairing Complete.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
c7bdd5026d28d178238bd794c61612602a54d55e 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Update class of device value whenever possible

The class of device value can only be retrieved via inquiry or during
an incoming connection request. Outgoing connections can't ask for the
class of device. To compensate for this the value is stored and copied
via the inquiry cache, but currently only updated via inquiry. This
update should also happen during an incoming connection request.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
f383f2750af19fe6f820edf40d8729f9741c5b37 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Some cleanups for HCI event handling

Some minor cosmetic cleanups to the HCI event handling to make the
code easier to read and understand.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e4e8e37c42bdaaefcb84eeaef0dc1bc3f696f8f6 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Make use of the default link policy settings

The Bluetooth specification supports the default link policy settings
on a per host controller basis. For every new connection the link
manager would then use these settings. It is better to use this instead
of bothering the controller on every connection setup to overwrite the
default settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
a8746417e864da1ed36dd2432a399fbeb843c2a0 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Track connection packet type changes

The connection packet type can be changed after the connection has been
established and thus needs to be properly tracked to ensure that the
host stack has always correct and valid information about it.

On incoming connections the Bluetooth core switches the supported packet
types to the configured list for this controller. However the usefulness
of this feature has been questioned a lot. The general consent is that
every Bluetooth host stack should enable as many packet types as the
hardware actually supports and leave the decision to the link manager
software running on the Bluetooth chip.

When running on Bluetooth 2.0 or later hardware, don't change the packet
type for incoming connections anymore. This hardware likely supports
Enhanced Data Rate and thus leave it completely up to the link manager
to pick the best packet type.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
9dc0a3afc08d6c20c284994dcd84531787d00ec2 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Support the case when headset falls back to SCO link

When trying to establish an eSCO link between two devices then it can
happen that the remote device falls back to a SCO link. Currently this
case is not handled correctly and the message dispatching will break
since it is looking for eSCO packets. So in case the configured link
falls back to SCO overwrite the link type with the correct value.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
ae29319649b80ed9d28d7b4f164e3f5f75020fc8 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Update authentication status after successful encryption

The authentication status is not communicated to both parties. This is
actually a flaw in the Bluetooth specification. Only the requesting side
really knows if the authentication was successful or not. This piece of
information is however needed on the other side to know if it has to
trigger the authentication procedure or not. Worst case is that both
sides will request authentication at different times, but this should
be avoided since it costs extra time when setting up a new connection.

For Bluetooth encryption it is required to authenticate the link first
and the encryption status is communicated to both sides. So when a link
is switched to encryption it is possible to update the authentication
status since it implies an authenticated link.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
9719f8afce34d3d04e884873a8a5e3483e30974c 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Disconnect when encryption gets disabled

The Bluetooth specification allows to enable or disable the encryption
of an ACL link at any time by either the peer or the remote device. If
a L2CAP or RFCOMM connection requested an encrypted link, they will now
disconnect that link if the encryption gets disabled. Higher protocols
that don't care about encryption (like SDP) are not affected.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
fcomm/core.c
77db1980565626471a980f0d2d17299e4bd5e7a5 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Enforce security for outgoing RFCOMM connections

Recent tests with various Bluetooth headsets have shown that some of
them don't enforce authentication and encryption when connecting. All
of them leave it up to the host stack to enforce it. Non of them should
allow unencrypted connections, but that is how it is. So in case the
link mode settings require authentication and/or encryption it will now
also be enforced on outgoing RFCOMM connections. Previously this was
only done for incoming connections.

This support has a small drawback from a protocol level point of view
since the host stack can't really tell with 100% certainty if a remote
side is already authenticated or not. So if both sides are configured
to enforce authentication it will be requested twice. Most Bluetooth
chips are caching this information and thus no extra authentication
procedure has to be triggered over-the-air, but it can happen.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fcomm/sock.c
79d554a6976a295aa9212172b218f29ca71c3b3d 14-Jul-2008 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Change retrieval of L2CAP features mask

Getting the remote L2CAP features mask is really important, but doing
this as less intrusive as possible is tricky. To play nice with older
systems and Bluetooth qualification testing, the features mask is now
only retrieved in two specific cases and only once per lifetime of an
ACL link.

When trying to establish a L2CAP connection and the remote features mask
is unknown, the L2CAP information request is sent when the ACL link goes
into connected state. This applies only to outgoing connections and also
only for the connection oriented channels.

The second case is when a connection request has been received. In this
case a connection response with the result pending and the information
request will be send. After receiving an information response or if the
timeout gets triggered, the normal connection setup process with security
setup will be initiated.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0b040829952d84bf2a62526f0e24b624e0699447 11-Jun-2008 Adrian Bunk <bunk@kernel.org> net: remove CVS keywords

This patch removes CVS keywords that weren't updated for a long time
from comments.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
nep/core.c
nep/netdev.c
nep/sock.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
537d59af73d894750cff14f90fe2b6d77fbab15b 02-Jun-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth: rfcomm_dev_state_change deadlock fix

There's logic in __rfcomm_dlc_close:
rfcomm_dlc_lock(d);
d->state = BT_CLOSED;
d->state_changed(d, err);
rfcomm_dlc_unlock(d);

In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to
take the dlc lock, then we will deadlock.

Here fixed it by unlock dlc before rfcomm_dev_get in
rfcomm_dev_state_change.

why not unlock just before rfcomm_dev_put? it's because there's
another problem. rfcomm_dev_get/rfcomm_dev_del will take
rfcomm_dev_lock, but in rfcomm_dev_add the lock order is :
rfcomm_dev_lock --> dlc lock

so I unlock dlc before the taken of rfcomm_dev_lock.

Actually it's a regression caused by commit
1905f6c736cb618e07eca0c96e60e3c024023428 ("bluetooth :
__rfcomm_dlc_close lock fix"), the dlc state_change could be two
callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I
missed the rfcomm_sk_state_change that time.

Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in
commit 4c8411f8c115def968820a4df6658ccfd55d7f1a ("bluetooth: fix
locking bug in the rfcomm socket cleanup handling") but he missed the
rfcomm_dev_state_change lock issue.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
4c8411f8c115def968820a4df6658ccfd55d7f1a 29-May-2008 Arjan van de Ven <arjan@linux.intel.com> bluetooth: fix locking bug in the rfcomm socket cleanup handling

in net/bluetooth/rfcomm/sock.c, rfcomm_sk_state_change() does the
following operation:

if (parent && sock_flag(sk, SOCK_ZAPPED)) {
/* We have to drop DLC lock here, otherwise
* rfcomm_sock_destruct() will dead lock. */
rfcomm_dlc_unlock(d);
rfcomm_sock_kill(sk);
rfcomm_dlc_lock(d);
}
}

which is fine, since rfcomm_sock_kill() will call sk_free() which will call
rfcomm_sock_destruct() which takes the rfcomm_dlc_lock()... so far so good.

HOWEVER, this assumes that the rfcomm_sk_state_change() function always gets
called with the rfcomm_dlc_lock() taken. This is the case for all but one
case, and in that case where we don't have the lock, we do a double unlock
followed by an attempt to take the lock, which due to underflow isn't
going anywhere fast.

This patch fixes this by moving the stragling case inside the lock, like
the other usages of the same call are doing in this code.

This was found with the help of the www.kerneloops.org project, where this
deadlock was observed 51 times at this point in time:
http://www.kerneloops.org/search.php?search=rfcomm_sock_destruct

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
83985319393973f280ca2a797047780a7955cf19 03-May-2008 Harvey Harrison <harvey.harrison@gmail.com> bluetooth: use get/put_unaligned_* helpers

Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
ci_event.c
ci_sock.c
2cap.c
e1ec1b8ccdf0df6000faa8c2d985ca5f94157e5a 03-Apr-2008 David S. Miller <davem@davemloft.net> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:

drivers/net/s2io.c
1905f6c736cb618e07eca0c96e60e3c024023428 02-Apr-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth : __rfcomm_dlc_close lock fix

Lockdep warning will be trigged while rfcomm connection closing.

The locks taken in rfcomm_dev_add:
rfcomm_dev_lock --> d->lock

In __rfcomm_dlc_close:
d->lock --> rfcomm_dev_lock (in rfcomm_dev_state_change)

There's two way to fix it, one is in rfcomm_dev_add we first locking
d->lock then the rfcomm_dev_lock

The other (in this patch), remove the locking of d->lock for
rfcomm_dev_state_change because just locking "d->state = BT_CLOSED;"
is enough.

[ 295.002046] =======================================================
[ 295.002046] [ INFO: possible circular locking dependency detected ]
[ 295.002046] 2.6.25-rc7 #1
[ 295.002046] -------------------------------------------------------
[ 295.002046] krfcommd/2705 is trying to acquire lock:
[ 295.002046] (rfcomm_dev_lock){-.--}, at: [<f89a090a>] rfcomm_dev_state_change+0x6a/0xd0 [rfcomm]
[ 295.002046]
[ 295.002046] but task is already holding lock:
[ 295.002046] (&d->lock){--..}, at: [<f899c533>] __rfcomm_dlc_close+0x43/0xd0 [rfcomm]
[ 295.002046]
[ 295.002046] which lock already depends on the new lock.
[ 295.002046]
[ 295.002046]
[ 295.002046] the existing dependency chain (in reverse order) is:
[ 295.002046]
[ 295.002046] -> #1 (&d->lock){--..}:
[ 295.002046] [<c0149b23>] check_prev_add+0xd3/0x200
[ 295.002046] [<c0149ce5>] check_prevs_add+0x95/0xe0
[ 295.002046] [<c0149f6f>] validate_chain+0x23f/0x320
[ 295.002046] [<c014b7b1>] __lock_acquire+0x1c1/0x760
[ 295.002046] [<c014c349>] lock_acquire+0x79/0xb0
[ 295.002046] [<c03d6b99>] _spin_lock+0x39/0x80
[ 295.002046] [<f89a01c0>] rfcomm_dev_add+0x240/0x360 [rfcomm]
[ 295.002046] [<f89a047e>] rfcomm_create_dev+0x6e/0xe0 [rfcomm]
[ 295.002046] [<f89a0823>] rfcomm_dev_ioctl+0x33/0x60 [rfcomm]
[ 295.002046] [<f899facc>] rfcomm_sock_ioctl+0x2c/0x50 [rfcomm]
[ 295.002046] [<c0363d38>] sock_ioctl+0x118/0x240
[ 295.002046] [<c0194196>] vfs_ioctl+0x76/0x90
[ 295.002046] [<c0194446>] do_vfs_ioctl+0x56/0x140
[ 295.002046] [<c0194569>] sys_ioctl+0x39/0x60
[ 295.002046] [<c0104faa>] syscall_call+0x7/0xb
[ 295.002046] [<ffffffff>] 0xffffffff
[ 295.002046]
[ 295.002046] -> #0 (rfcomm_dev_lock){-.--}:
[ 295.002046] [<c0149a84>] check_prev_add+0x34/0x200
[ 295.002046] [<c0149ce5>] check_prevs_add+0x95/0xe0
[ 295.002046] [<c0149f6f>] validate_chain+0x23f/0x320
[ 295.002046] [<c014b7b1>] __lock_acquire+0x1c1/0x760
[ 295.002046] [<c014c349>] lock_acquire+0x79/0xb0
[ 295.002046] [<c03d6639>] _read_lock+0x39/0x80
[ 295.002046] [<f89a090a>] rfcomm_dev_state_change+0x6a/0xd0 [rfcomm]
[ 295.002046] [<f899c548>] __rfcomm_dlc_close+0x58/0xd0 [rfcomm]
[ 295.002046] [<f899d44f>] rfcomm_recv_ua+0x6f/0x120 [rfcomm]
[ 295.002046] [<f899e061>] rfcomm_recv_frame+0x171/0x1e0 [rfcomm]
[ 295.002046] [<f899e357>] rfcomm_run+0xe7/0x550 [rfcomm]
[ 295.002046] [<c013c18c>] kthread+0x5c/0xa0
[ 295.002046] [<c0105c07>] kernel_thread_helper+0x7/0x10
[ 295.002046] [<ffffffff>] 0xffffffff
[ 295.002046]
[ 295.002046] other info that might help us debug this:
[ 295.002046]
[ 295.002046] 2 locks held by krfcommd/2705:
[ 295.002046] #0: (rfcomm_mutex){--..}, at: [<f899e2eb>] rfcomm_run+0x7b/0x550 [rfcomm]
[ 295.002046] #1: (&d->lock){--..}, at: [<f899c533>] __rfcomm_dlc_close+0x43/0xd0 [rfcomm]
[ 295.002046]
[ 295.002046] stack backtrace:
[ 295.002046] Pid: 2705, comm: krfcommd Not tainted 2.6.25-rc7 #1
[ 295.002046] [<c0128a38>] ? printk+0x18/0x20
[ 295.002046] [<c014927f>] print_circular_bug_tail+0x6f/0x80
[ 295.002046] [<c0149a84>] check_prev_add+0x34/0x200
[ 295.002046] [<c0149ce5>] check_prevs_add+0x95/0xe0
[ 295.002046] [<c0149f6f>] validate_chain+0x23f/0x320
[ 295.002046] [<c014b7b1>] __lock_acquire+0x1c1/0x760
[ 295.002046] [<c014c349>] lock_acquire+0x79/0xb0
[ 295.002046] [<f89a090a>] ? rfcomm_dev_state_change+0x6a/0xd0 [rfcomm]
[ 295.002046] [<c03d6639>] _read_lock+0x39/0x80
[ 295.002046] [<f89a090a>] ? rfcomm_dev_state_change+0x6a/0xd0 [rfcomm]
[ 295.002046] [<f89a090a>] rfcomm_dev_state_change+0x6a/0xd0 [rfcomm]
[ 295.002046] [<f899c548>] __rfcomm_dlc_close+0x58/0xd0 [rfcomm]
[ 295.002046] [<f899d44f>] rfcomm_recv_ua+0x6f/0x120 [rfcomm]
[ 295.002046] [<f899e061>] rfcomm_recv_frame+0x171/0x1e0 [rfcomm]
[ 295.002046] [<c014abd9>] ? trace_hardirqs_on+0xb9/0x130
[ 295.002046] [<c03d6e89>] ? _spin_unlock_irqrestore+0x39/0x70
[ 295.002046] [<f899e357>] rfcomm_run+0xe7/0x550 [rfcomm]
[ 295.002046] [<c03d4559>] ? __sched_text_start+0x229/0x4c0
[ 295.002046] [<c0120000>] ? cpu_avg_load_per_task+0x20/0x30
[ 295.002046] [<f899e270>] ? rfcomm_run+0x0/0x550 [rfcomm]
[ 295.002046] [<c013c18c>] kthread+0x5c/0xa0
[ 295.002046] [<c013c130>] ? kthread+0x0/0xa0
[ 295.002046] [<c0105c07>] kernel_thread_helper+0x7/0x10
[ 295.002046] =======================

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
fcomm/tty.c
68845cb2c82275efd7390026bba70c320ca6ef86 02-Apr-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth : use lockdep sub-classes for diffrent bluetooth protocol

'rfcomm connect' will trigger lockdep warnings which is caused by
locking diffrent kinds of bluetooth sockets at the same time.

So using sub-classes per AF_BLUETOOTH sub-type for lockdep.

Thanks for the hints from dave jones.

---
> From: Dave Jones <davej@codemonkey.org.uk>
> Date: Thu, 27 Mar 2008 12:21:56 -0400
>
> > Mar 27 08:10:57 localhost kernel: Pid: 3611, comm: obex-data-serve Not tainted 2.6.25-0.121.rc5.git4.fc9 #1
> > Mar 27 08:10:57 localhost kernel: [__lock_acquire+2287/3089] __lock_acquire+0x8ef/0xc11
> > Mar 27 08:10:57 localhost kernel: [sched_clock+8/11] ? sched_clock+0x8/0xb
> > Mar 27 08:10:57 localhost kernel: [lock_acquire+106/144] lock_acquire+0x6a/0x90
> > Mar 27 08:10:57 localhost kernel: [<f8bd9321>] ? l2cap_sock_bind+0x29/0x108 [l2cap]
> > Mar 27 08:10:57 localhost kernel: [lock_sock_nested+182/198] lock_sock_nested+0xb6/0xc6
> > Mar 27 08:10:57 localhost kernel: [<f8bd9321>] ? l2cap_sock_bind+0x29/0x108 [l2cap]
> > Mar 27 08:10:57 localhost kernel: [security_socket_post_create+22/27] ? security_socket_post_create+0x16/0x1b
> > Mar 27 08:10:57 localhost kernel: [__sock_create+388/472] ? __sock_create+0x184/0x1d8
> > Mar 27 08:10:57 localhost kernel: [<f8bd9321>] l2cap_sock_bind+0x29/0x108 [l2cap]
> > Mar 27 08:10:57 localhost kernel: [kernel_bind+10/13] kernel_bind+0xa/0xd
> > Mar 27 08:10:57 localhost kernel: [<f8dad3d7>] rfcomm_dlc_open+0xc8/0x294 [rfcomm]
> > Mar 27 08:10:57 localhost kernel: [lock_sock_nested+187/198] ? lock_sock_nested+0xbb/0xc6
> > Mar 27 08:10:57 localhost kernel: [<f8dae18c>] rfcomm_sock_connect+0x8b/0xc2 [rfcomm]
> > Mar 27 08:10:57 localhost kernel: [sys_connect+96/125] sys_connect+0x60/0x7d
> > Mar 27 08:10:57 localhost kernel: [__lock_acquire+1370/3089] ? __lock_acquire+0x55a/0xc11
> > Mar 27 08:10:57 localhost kernel: [sys_socketcall+140/392] sys_socketcall+0x8c/0x188
> > Mar 27 08:10:57 localhost kernel: [syscall_call+7/11] syscall_call+0x7/0xb
---

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
d5fb2962c6157495e1365e4f30568ed3830d35a7 29-Mar-2008 Robert P. J. Day <rpjday@crashcourse.ca> bluetooth: replace deprecated RW_LOCK_UNLOCKED macros

The older RW_LOCK_UNLOCKED macros defeat lockdep state tracing so
replace them with the newer __RW_LOCK_UNLOCKED macros.

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
2cap.c
fcomm/sock.c
co.c
3b1e0a655f8eba44ab1ee2a1068d169ccfb853b9 25-Mar-2008 YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> [NET] NETNS: Omit sock->sk_net without CONFIG_NET_NS.

Introduce per-sock inlines: sock_net(), sock_net_set()
and per-inet_timewait_sock inlines: twsk_net(), twsk_net_set().
Without CONFIG_NET_NS, no namespace other than &init_net exists.
Let's explicitly define them to help compiler optimizations.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
2cap.c
fcomm/sock.c
co.c
a4e2acf01a7e5fcd960fc332335ca10313641f4b 06-Mar-2008 Tobias Klauser <tklauser@distanz.ch> bluetooth: make bnep_sock_cleanup() return void

bnep_sock_cleanup() always returns 0 and its return value isn't used
anywhere in the code.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
nep/sock.c
04005dd9ae7bf1031408869c33df96149ebb1086 06-Mar-2008 Tobias Klauser <tklauser@distanz.ch> bluetooth: Make hci_sock_cleanup() return void

hci_sock_cleanup() always returns 0 and its return value isn't used
anywhere in the code.

Compile-tested with 'make allyesconfig && make net/bluetooth/bluetooth.ko'

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
147e2d59833e994cc99341806a88b9e59be41391 06-Mar-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth: hci_core: defer hci_unregister_sysfs()

Alon Bar-Lev reports:

Feb 16 23:41:33 alon1 usb 3-1: configuration #1 chosen from 1 choice
Feb 16 23:41:33 alon1 BUG: unable to handle kernel NULL pointer
dereference at virtual address 00000008
Feb 16 23:41:33 alon1 printing eip: c01b2db6 *pde = 00000000
Feb 16 23:41:33 alon1 Oops: 0000 [#1] PREEMPT
Feb 16 23:41:33 alon1 Modules linked in: ppp_deflate zlib_deflate
zlib_inflate bsd_comp ppp_async rfcomm l2cap hci_usb vmnet(P)
vmmon(P) tun radeon drm autofs4 ipv6 aes_generic crypto_algapi
ieee80211_crypt_ccmp nf_nat_irc nf_nat_ftp nf_conntrack_irc
nf_conntrack_ftp ipt_MASQUERADE iptable_nat nf_nat ipt_REJECT
xt_tcpudp ipt_LOG xt_limit xt_state nf_conntrack_ipv4 nf_conntrack
iptable_filter ip_tables x_tables snd_pcm_oss snd_mixer_oss
snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device
bluetooth ppp_generic slhc ioatdma dca cfq_iosched cpufreq_powersave
cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_table uinput
fan af_packet nls_cp1255 nls_iso8859_1 nls_utf8 nls_base pcmcia
snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm nsc_ircc snd_timer
ipw2200 thinkpad_acpi irda snd ehci_hcd yenta_socket uhci_hcd
psmouse ieee80211 soundcore intel_agp hwmon rsrc_nonstatic pcspkr
e1000 crc_ccitt snd_page_alloc i2c_i801 ieee80211_crypt pcmcia_core
agpgart thermal bat!
tery nvram rtc sr_mod ac sg firmware_class button processor cdrom
unix usbcore evdev ext3 jbd ext2 mbcache loop ata_piix libata sd_mod
scsi_mod
Feb 16 23:41:33 alon1
Feb 16 23:41:33 alon1 Pid: 4, comm: events/0 Tainted: P
(2.6.24-gentoo-r2 #1)
Feb 16 23:41:33 alon1 EIP: 0060:[<c01b2db6>] EFLAGS: 00010282 CPU: 0
Feb 16 23:41:33 alon1 EIP is at sysfs_get_dentry+0x26/0x80
Feb 16 23:41:33 alon1 EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX:
f48a2210
Feb 16 23:41:33 alon1 ESI: f72eb900 EDI: f4803ae0 EBP: f4803ae0 ESP:
f7c49efc
Feb 16 23:41:33 alon1 hcid[7004]: HCI dev 0 registered
Feb 16 23:41:33 alon1 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Feb 16 23:41:33 alon1 Process events/0 (pid: 4, ti=f7c48000
task=f7c3efc0 task.ti=f7c48000)
Feb 16 23:41:33 alon1 Stack: f7cb6140 f4822668 f7e71e10 c01b304d
ffffffff ffffffff fffffffe c030ba9c
Feb 16 23:41:33 alon1 f7cb6140 f4822668 f6da6720 f7cb6140 f4822668
f6da6720 c030ba8e c01ce20b
Feb 16 23:41:33 alon1 f6e9dd00 c030ba8e f6da6720 f6e9dd00 f6e9dd00
00000000 f4822600 00000000
Feb 16 23:41:33 alon1 Call Trace:
Feb 16 23:41:33 alon1 [<c01b304d>] sysfs_move_dir+0x3d/0x1f0
Feb 16 23:41:33 alon1 [<c01ce20b>] kobject_move+0x9b/0x120
Feb 16 23:41:33 alon1 [<c0241711>] device_move+0x51/0x110
Feb 16 23:41:33 alon1 [<f9aaed80>] del_conn+0x0/0x70 [bluetooth]
Feb 16 23:41:33 alon1 [<f9aaed99>] del_conn+0x19/0x70 [bluetooth]
Feb 16 23:41:33 alon1 [<c012c1a1>] run_workqueue+0x81/0x140
Feb 16 23:41:33 alon1 [<c02c0c88>] schedule+0x168/0x2e0
Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
Feb 16 23:41:33 alon1 [<c012c9cb>] worker_thread+0x9b/0xf0
Feb 16 23:41:33 alon1 [<c012fc70>] autoremove_wake_function+0x0/0x50
Feb 16 23:41:33 alon1 [<c012c930>] worker_thread+0x0/0xf0
Feb 16 23:41:33 alon1 [<c012f962>] kthread+0x42/0x70
Feb 16 23:41:33 alon1 [<c012f920>] kthread+0x0/0x70
Feb 16 23:41:33 alon1 [<c0104c2f>] kernel_thread_helper+0x7/0x18
Feb 16 23:41:33 alon1 =======================
Feb 16 23:41:33 alon1 Code: 26 00 00 00 00 57 89 c7 a1 50 1b 3a c0
56 53 8b 70 38 85 f6 74 08 8b 0e 85 c9 74 58 ff 06 8b 56 50 39 fa 74
47 89 fb eb 02 89 c3 <8b> 43 08 39 c2 75 f7 8b 46 08 83 c0 68 e8 98
e7 10 00 8b 43 10
Feb 16 23:41:33 alon1 EIP: [<c01b2db6>] sysfs_get_dentry+0x26/0x80
SS:ESP 0068:f7c49efc
Feb 16 23:41:33 alon1 ---[ end trace aae864e9592acc1d ]---

Defer hci_unregister_sysfs because hci device could be destructed
while hci conn devices still there.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Tested-by: Stefan Seyfried <seife@suse.de>
Acked-by: Alon Bar-Lev <alon.barlev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
8e8440f53593b5f9c695f18b493b535873dbb9da 03-Mar-2008 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: l2cap info_timer delete fix in hci_conn_del

When the l2cap info_timer is active the info_state will be set to
L2CAP_INFO_FEAT_MASK_REQ_SENT, and it will be unset after the timer is
deleted or timeout triggered.

Here in l2cap_conn_del only call del_timer_sync when the info_state is
set to L2CAP_INFO_FEAT_MASK_REQ_SENT.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
3ab2273175bd59616b6e85c0f88b154e8bd97413 27-Feb-2008 Thomas Gleixner <tglx@linutronix.de> bluetooth: delete timer in l2cap_conn_del()

Delete a possibly armed timer before kfree'ing the connection object.

Solves: http://lkml.org/lkml/2008/2/15/514

Reported-by:Quel Qun <kelk1@comcast.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
07ce198a1eb3431d04a6d59ea9fb7b71f21e33b1 19-Feb-2008 Linus Torvalds <torvalds@woody.linux-foundation.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (60 commits)
[NIU]: Bump driver version and release date.
[NIU]: Fix BMAC alternate MAC address indexing.
net: fix kernel-doc warnings in header files
[IPV6]: Use BUG_ON instead of if + BUG in fib6_del_route.
[IPV6]: dst_entry leak in ip4ip6_err. (resend)
bluetooth: do not move child device other than rfcomm
bluetooth: put hci dev after del conn
[NET]: Elminate spurious print_mac() calls.
[BLUETOOTH] hci_sysfs.c: Kill build warning.
[NET]: Remove MAC_FMT
net/8021q/vlan_dev.c: Use print_mac.
[XFRM]: Fix ordering issue in xfrm_dst_hash_transfer().
[BLUETOOTH] net/bluetooth/hci_core.c: Use time_* macros
[IPV6]: Fix hardcoded removing of old module code
[NETLABEL]: Move some initialization code into __init section.
[NETLABEL]: Shrink the genl-ops registration code.
[AX25] ax25_out: check skb for NULL in ax25_kick()
[TCP]: Fix tcp_v4_send_synack() comment
[IPV4]: fix alignment of IP-Config output
Documentation: fix tcp.txt
...
8ac62dc773c149d7b7124b4912b425842f905d3e 19-Feb-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth: do not move child device other than rfcomm

hci conn child devices other than rfcomm tty should not be moved here.
This is my lost, thanks for Barnaby's reporting and testing.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
0cd63c8089f0f6316df1393c3a93bdbc67ab314d 19-Feb-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth: put hci dev after del conn

Move hci_dev_put to del_conn to avoid hci dev going away before hci conn.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_conn.c
ci_sysfs.c
988d0093f9cb2bf27c299e373f9cbaac47dab2c1 18-Feb-2008 David S. Miller <davem@davemloft.net> [BLUETOOTH] hci_sysfs.c: Kill build warning.

net/bluetooth/hci_sysfs.c: In function ‘del_conn’:
net/bluetooth/hci_sysfs.c:339: warning: suggest parentheses around assignment used as truth value

Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
82453021b8be85171350c695d7ebafe7b517c812 18-Feb-2008 S.Çağlar Onur <caglar@pardus.org.tr> [BLUETOOTH] net/bluetooth/hci_core.c: Use time_* macros

The functions time_before, time_before_eq, time_after, and
time_after_eq are more robust for comparing jiffies against other
values.

So following patch implements usage of the time_after() macro, defined
at linux/jiffies.h, which deals with wrapping correctly

Signed-off-by: S.Çağlar Onur <caglar@pardus.org.tr>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
b5606c2d4447e80b1d72406af4e78af1eda611d4 14-Feb-2008 Harvey Harrison <harvey.harrison@gmail.com> remove final fastcall users

fastcall always expands to empty, remove it.

Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fcomm/core.c
93d807401ced2320d0d1e56bf9de099bba5c0424 05-Feb-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth rfcomm tty: destroy before tty_close()

rfcomm dev could be deleted in tty_hangup, so we must not call
rfcomm_dev_del again to prevent from destroying rfcomm dev before tty
close.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
91f5cca3d1b4341624715f6dd01ee09be9af46c4 05-Feb-2008 Andrew Morton <akpm@linux-foundation.org> bluetooth: uninlining

Remove all those inlines which were either a) unneeded or b) increased code
size.

text data bss dec hex filename
before: 6997 74 8 7079 1ba7 net/bluetooth/hidp/core.o
after: 6492 74 8 6574 19ae net/bluetooth/hidp/core.o

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
idp/core.c
eff001e35a857361f3fb289fea86e97c334a5446 05-Feb-2008 Dave Young <hidave.darkstar@gmail.com> bluetooth: hidp_process_hid_control remove unnecessary parameter dealing

According to the bluetooth HID spec v1.0 chapter 7.4.2

"This code requests a major state change in a BT-HID device. A HID_CONTROL
request does not generate a HANDSHAKE response."

"A HID_CONTROL packet with a parameter of VIRTUAL_CABLE_UNPLUG is the only
HID_CONTROL packet a device can send to a host. A host will ignore all other
packets."

So in the hidp_precess_hid_control function, we just need to deal with the
UNLUG packet.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
idp/core.c
5396c9356efec1d3d818b786f69e081aaad4b98b 01-Feb-2008 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: Fix bugs in previous conn add/del workqueue changes.

Jens Axboe noticed that we were queueing &conn->work on both btaddconn
and keventd_wq.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
b6c0632105f7d7548f1d642ba830088478d4f2b0 30-Jan-2008 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: Add conn add/del workqueues to avoid connection fail.

The bluetooth hci_conn sysfs add/del executed in the default
workqueue. If the del_conn is executed after the new add_conn with
same target, add_conn will failed with warning of "same kobject name".

Here add btaddconn & btdelconn workqueues, flush the btdelconn
workqueue in the add_conn function to avoid the issue.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
67b23219ce2f78352b0c566a472ff16c1b0fea9a 08-Jan-2008 Julia Lawall <julia@diku.dk> [BLUETOOTH]: Use sockfd_put()

The function sockfd_lookup uses fget on the value that is stored in
the file field of the returned structure, so fput should ultimately be
applied to this value. This can be done directly, but it seems better
to use the specific macro sockfd_put, which does the same thing.

The problem was fixed using the following semantic patch.
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@@
expression s;
@@

s = sockfd_lookup(...)
...
+ sockfd_put(s);
?- fput(s->file);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/sock.c
mtp/sock.c
idp/sock.c
b24b8a247ff65c01b252025926fe564209fae4fc 24-Jan-2008 Pavel Emelyanov <xemul@openvz.org> [NET]: Convert init_timer into setup_timer

Many-many code in the kernel initialized the timer->function
and timer->data together with calling init_timer(timer). There
is already a helper for this. Use it for networking code.

The patch is HUGE, but makes the code 130 lines shorter
(98 insertions(+), 228 deletions(-)).

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_conn.c
idp/core.c
2cap.c
fcomm/core.c
co.c
acea6852f32b8805e166d885ed7e9f0c7cd10d41 22-Jan-2008 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: Move children of connection device to NULL before connection down.

The rfcomm tty device will possibly retain even when conn is down, and
sysfs doesn't support zombie device moving, so this patch move the tty
device before conn device is destroyed.

For the bug refered please see :
http://lkml.org/lkml/2007/12/28/87

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
fcomm/tty.c
f951375d470c1a20d92c34377991197e6bf17990 11-Jan-2008 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: rfcomm tty BUG_ON() code fix

1) In tty.c the BUG_ON at line 115 will never be called, because the the
before list_del_init in this same function.
115 BUG_ON(!list_empty(&dev->list));
So move the list_del_init to rfcomm_dev_del

2) The rfcomm_dev_del could be called from diffrent path
(rfcomm_tty_hangup/rfcomm_dev_state_change/rfcomm_release_dev),

So add another BUG_ON when the rfcomm_dev_del is called more than
one time.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
38b7da09cfdb2202f08476d6fb22a47649a177ec 30-Dec-2007 Dave Young <hidave.darkstar@gmail.com> [BLUETOOTH]: put_device before device_del fix

Because of workqueue delay, the put_device could be called before
device_del, so move it to del_conn.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_conn.c
ci_sysfs.c
6257ff2177ff02d7f260a7a501876aa41cb9a9f6 01-Nov-2007 Pavel Emelyanov <xemul@openvz.org> [NET]: Forget the zero_it argument of sk_alloc()

Finally, the zero_it argument can be completely removed from
the callers and from the function prototype.

Besides, fix the checkpatch.pl warnings about using the
assignments inside if-s.

This patch is rather big, and it is a part of the previous one.
I splitted it wishing to make the patches more readable. Hope
this particular split helped.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
a524eccc7307b1d6e79f03fed79f9f34c016ce56 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Convert RFCOMM to use kthread API

This patch does the full kthread conversion for the RFCOMM protocol. It
makes the code slightly simpler and more maintainable.

Based on a patch from Christoph Hellwig <hch@lst.de>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
b6a0dc822497e1c0b9e8c4add270cc27fce48454 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add support for handling simple eSCO links

With the Bluetooth 1.2 specification the Extended SCO feature for
better audio connections was introduced. So far the Bluetooth core
wasn't able to handle any eSCO connections correctly. This patch
adds simple eSCO support while keeping backward compatibility with
older devices.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
co.c
dae6a0f6636d05bcb28ece1f3630b23ed2d66e18 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add address and channel attribute to RFCOMM TTY device

Export the remote device address and channel of RFCOMM TTY device
via sysfs attributes. This allows udev to create better naming rules
for configured RFCOMM devices.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
6792b5ec8d9e723e4689fd5b16cfa52603985f43 20-Oct-2007 Dave Young <hidave.darkstar@gmail.com> [Bluetooth] Fix wrong argument in debug code of HIDP

In the debug code of the hidp_queue_report function, the device
variable does not exist, replace it with session->hid.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
6464f35f3771f69cd8d107fff166dc29ab392f97 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fall back to L2CAP in basic mode

In case the remote entity tries to negogiate retransmission or flow
control mode, reject it and fall back to basic mode.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
f0709e03ac3552b1b048ee171cb96ecaacc6813c 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Advertise L2CAP features mask support

Indicate the support for the L2CAP features mask value when the remote
entity tries to negotiate Bluetooth 1.2 specific features.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4e8402a3f884427f9233ba436459c158d1f2e114 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Retrieve L2CAP features mask on connection setup

The Bluetooth 1.2 specification introduced a specific features mask
value to interoperate with newer versions of the specification. So far
this piece of information was never needed, but future extensions will
rely on it. This patch adds a generic way to retrieve this information
only once per connection setup.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
861d6882b3dfe1710b35dbddf1b395b962061413 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Remove global conf_mtu variable from L2CAP

After the change to the L2CAP configuration parameter handling the
global conf_mtu variable is no longer needed and so remove it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
876d9484edf77d228adb42aecd4debd58d7739d6 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Finish L2CAP configuration only with acceptable settings

The parameters of the L2CAP output configuration might not be accepted
after the first configuration round. So only indicate a finished output
configuration when acceptable settings are provided.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
a9de9248064bfc8eb0a183a6a951a4e7b5ca10a4 20-Oct-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Switch from OGF+OCF to using only opcodes

The Bluetooth HCI commands are divided into logical OGF groups for
easier identification of their purposes. While this still makes sense
for the written specification, its makes the code only more complex
and harder to read. So instead of using separate OGF and OCF values
to identify the commands, use a common 16-bit opcode that combines
both values. As a side effect this also reduces the complexity of
OGF and OCF calculations during command header parsing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
96de0e252cedffad61b3cb5e05662c591898e69a 19-Oct-2007 Jan Engelhardt <jengelh@gmx.de> Convert files to UTF-8 and some cleanups

* Convert files to UTF-8.

* Also correct some people's names
(one example is Eißfeldt, which was found in a source file.
Given that the author used an ß at all in a source file
indicates that the real name has in fact a 'ß' and not an 'ss',
which is commonly used as a substitute for 'ß' when limited to
7bit.)

* Correct town names (Goettingen -> Göttingen)

* Update Eberhard Mönkeberg's address (http://lkml.org/lkml/2007/1/8/313)

Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
nep/core.c
nep/netdev.c
7b19ada2ed3c1eccb9fe94d74b05e1428224663d 19-Oct-2007 Jiri Slaby <jirislaby@gmail.com> get rid of input BIT* duplicate defines

get rid of input BIT* duplicate defines

use newly global defined macros for input layer. Also remove includes of
input.h from non-input sources only for BIT macro definiton. Define the
macro temporarily in local manner, all those local definitons will be
removed further in this patchset (to not break bisecting).
BIT macro will be globally defined (1<<x)

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Cc: <dtor@mail.ru>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Cc: <lenb@kernel.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Cc: <perex@suse.cz>
Acked-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: <vernux@us.ibm.com>
Cc: <malattia@linux.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
idp/core.c
53465eb4ab16660eab0a7be168a087a97172e650 26-Sep-2007 WANG Cong <xiyou.wangcong@gmail.com> [BLUETOOTH]: Make hidp_setup_input() return int

This patch:
- makes hidp_setup_input() return int to indicate errors;
- checks its return value to handle errors.

And this time it is against -rc7-mm1 tree.

Thanks to roel and Marcel Holtmann for comments.

Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
idp/core.c
1b8d7ae42d02e483ad94035cca851e4f7fbecb40 09-Oct-2007 Eric W. Biederman <ebiederm@xmission.com> [NET]: Make socket creation namespace safe.

This patch passes in the namespace a new socket should be created in
and has the socket code do the appropriate reference counting. By
virtue of this all socket create methods are touched. In addition
the socket create methods are modified so that they will fail if
you attempt to create a socket in a non-default network namespace.

Failing if we attempt to create a socket outside of the default
network namespace ensures that as we incrementally make the network stack
network namespace aware we will not export functionality that someone
has not audited and made certain is network namespace safe.
Allowing us to partially enable network namespaces before all of the
exotic protocols are supported.

Any protocol layers I have missed will fail to compile because I now
pass an extra parameter into the socket creation code.

[ Integrated AF_IUCV build fixes from Andrew Morton... -DaveM ]

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
1da97f83a843f92678b614fcaebdb3e4ebd6c9dd 12-Sep-2007 David S. Miller <davem@kimchee.(none)> [BLUETOOTH]: Fix non-COMPAT build of hci_sock.c

Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
89f2783ded0a4fc98852cb9552bb27a80cd6a41a 09-Sep-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix parameter list for event filter command

On device initialization the event filters are cleared. In case of
clearing the filters the extra condition type shall be omitted.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
7c631a67601f116d303cfb98a3d964a150090e38 09-Sep-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Update security filter for Bluetooth 2.1

This patch updates the HCI security filter with support for the
Bluetooth 2.1 commands and events.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
767c5eb5d35aeb85987143f0a730bc21d3ecfb3d 09-Sep-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add compat handling for timestamp structure

The timestamp structure needs special handling in case of compat
programs. Use the same wrapping method the network core uses.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
d83852822cb58f0beaa2d06b7c1e9e005e0c4f94 29-Jul-2007 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH] l2cap: don't mangle cmd.len

Since nobody uses it after we convert it to host-endian,
no need to do that at all. At that point l2cap is endian-clean.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
88219a0f65ae14ba744fa424604c965b6f1c1a8d 29-Jul-2007 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH]: pass (host-endian) cmd length as explicit argument to l2cap_conf_req()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
8e036fc3143646dc304356fa50314681d654363f 29-Jul-2007 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH] l2cap: endianness annotations

no code changes, just documenting existing types

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
6dc0c2082b8acf30c9239fbbcc051eebdaf7ecff 29-Jul-2007 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH]: Fix endianness bug in l2cap_sock_listen()

We loop through psm values, calling __l2cap_get_sock_by_addr(psm, ...)
until we get NULL; then we set ->psm of our socket to htobs(psm).
IOW, we find unused psm value and put it into our socket. So far, so
good, but... __l2cap_get_sock_by_addr() compares its argument with
->psm of sockets. IOW, the entire thing works correctly only on
little-endian. On big-endian we'll get "no socket with such psm"
on the first iteration, since we won't find a socket with ->psm == 0x1001.
We will happily conclude that 0x1001 is unused and slap htobs(0x1001)
(i.e. 0x110) into ->psm of our socket. Of course, the next time around
the same thing will repeat and we'll just get a fsckload of sockets
with the same ->psm assigned.

Fix: pass htobs(psm) to __l2cap_get_sock_by_addr() there. All other
callers are already passing little-endian values and all places that
store something in ->psm are storing little-endian.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
09c7d8293a2d1317d16ef4ddb9f6dd2553d0694e 26-Jul-2007 Marcel Holtmann <marcel@holtmann.org> [IRDA]: Fix rfcomm use-after-free

Adrian Bunk wrote:
> Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following
> use-after-free in net/bluetooth/rfcomm/tty.c:
>
> <-- snip -->
>
> ...
> static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
> {
> ...
> if (IS_ERR(dev->tty_dev)) {
> list_del(&dev->list);
> kfree(dev);
> return PTR_ERR(dev->tty_dev);
> }
> ...
>
> <-- snip -->
>
> Spotted by the Coverity checker.

really good catch. I fully overlooked that one. The attached patch
should fix it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
00ae02f31519e8d6e374424bbdf0c7381489e416 19-Jul-2007 YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> [NET] BLUETOOTH: Fix whitespace errors.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
ci_core.c
831441862956fffa17b9801db37e6ea1650b0f69 17-Jul-2007 Rafael J. Wysocki <rjw@sisk.pl> Freezer: make kernel threads nonfreezable by default

Currently, the freezer treats all tasks as freezable, except for the kernel
threads that explicitly set the PF_NOFREEZE flag for themselves. This
approach is problematic, since it requires every kernel thread to either
set PF_NOFREEZE explicitly, or call try_to_freeze(), even if it doesn't
care for the freezing of tasks at all.

It seems better to only require the kernel threads that want to or need to
be frozen to use some freezer-related code and to remove any
freezer-related code from the other (nonfreezable) kernel threads, which is
done in this patch.

The patch causes all kernel threads to be nonfreezable by default (ie. to
have PF_NOFREEZE set by default) and introduces the set_freezable()
function that should be called by the freezable kernel threads in order to
unset PF_NOFREEZE. It also makes all of the currently freezable kernel
threads call set_freezable(), so it shouldn't cause any (intentional)
change of behaviour to appear. Additionally, it updates documentation to
describe the freezing of tasks more accurately.

[akpm@linux-foundation.org: build fixes]
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Acked-by: Nigel Cunningham <nigel@nigel.suspend2.net>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Gautham R Shenoy <ego@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
nep/core.c
mtp/core.c
idp/core.c
fcomm/core.c
5b7f990927fe87ad3bec762a33c0e72bcbf6841e 11-Jul-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add basics to better support and handle eSCO links

To better support and handle eSCO links in the future a bunch of
constants needs to be added and some basic routines need to be
updated. This is the initial step.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_core.c
ci_event.c
8de0a15483b357d0f0b821330ec84d1660cadc4e 11-Jul-2007 Ville Tervo <ville.tervo@nokia.com> [Bluetooth] Keep rfcomm_dev on the list until it is freed

This patch changes the RFCOMM TTY release process so that the TTY is kept
on the list until it is really freed. A new device flag is used to keep
track of released TTYs.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
84950cf0ba02fd6a5defe2511bc41f9aa2237632 11-Jul-2007 Mikko Rapeli <mikko.rapeli@iki.fi> [Bluetooth] Hangup TTY before releasing rfcomm_dev

The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.

Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509

Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
ef222013fc8c1a2fcba5c7ab169be8ffcb778ec4 11-Jul-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add hci_recv_fragment() helper function

Most drivers must handle fragmented HCI data packets and events. This
patch adds a generic function for their reassembly to the Bluetooth
core layer and thus allows to shrink the complexity of the drivers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
1c39858b5dd46004b12c5acd26d8df346bef8a10 07-Jul-2007 David Woodhouse <dwmw2@infradead.org> Fix use-after-free oops in Bluetooth HID.

When cleaning up HIDP sessions, we currently close the ACL connection
before deregistering the input device. Closing the ACL connection
schedules a workqueue to remove the associated objects from sysfs, but
the input device still refers to them -- and if the workqueue happens to
run before the input device removal, the kernel will oops when trying to
look up PHYSDEVPATH for the removed input device.

Fix this by deregistering the input device before closing the
connections.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
idp/core.c
5dee9e7c4c869fcffccc3d432b755793dfa71376 24-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix L2CAP configuration parameter handling

The L2CAP configuration parameter handling was missing the support
for rejecting unknown options. The capability to reject unknown
options is mandatory since the Bluetooth 1.2 specification. This
patch implements its and also simplifies the parameter parsing.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
4ce61d1c7a8ef4c1337fa983a3036d4010e3c19e 17-May-2007 Satyam Sharma <ssatyam@cse.iitk.ac.in> [BLUETOOTH]: Fix locking in hci_sock_dev_event().

We presently use lock_sock() to acquire a lock on a socket in
hci_sock_dev_event(), but this goes BUG because lock_sock()
can sleep and we're already holding a read-write spinlock at
that point. So, we must use the non-sleeping BH version,
bh_lock_sock().

However, hci_sock_dev_event() is called from user context and
hence using simply bh_lock_sock() will deadlock against a
concurrent softirq that tries to acquire a lock on the same
socket. Hence, disabling BH's before acquiring the socket lock
and enable them afterwards, is the proper solution to fix
socket locking in hci_sock_dev_event().

Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
5884c40668a928bba017eaf54e2eb3c01c8a98e6 11-May-2007 Linus Torvalds <torvalds@woody.linux-foundation.org> Merge branch 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid

* 'upstream-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid:
USB HID: hiddev - fix race between hiddev_send_event() and hiddev_release()
HID: add hooks for getkeycode() and setkeycode() methods
HID: switch to using input_dev->dev.parent
USB HID: Logitech wheel 0x046d/0xc294 needs HID_QUIRK_NOGET quirk
USB HID: usb_buffer_free() cleanup
USB HID: report descriptor of Cypress USB barcode readers needs fixup
Bluetooth HID: HIDP - don't initialize force feedback
USB HID: update CONFIG_USB_HIDINPUT_POWERBOOK description
HID: add input mappings for non-working keys on Logitech S510 remote
5be3946647424b08db0f62c545215cf506af8a52 09-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Switch to using input_dev->dev.parent

In preparation for struct class_device -> struct device input core
conversion, switch to using input_dev->dev.parent when specifying
device position in sysfs tree.

Also, do not access input_dev->private directly, use helpers and
do not use kfree() on input device, use input_free_device() instead.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
9556fb73edfc37410cab3b47ae5e94bcecd8edf2 10-May-2007 Martin Schwidefsky <schwidefsky@de.ibm.com> [S390] Kconfig: unwanted menus for s390.

Disable some more menus in the configuration files that are of no
interest to a s390 machine.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
config
3b180bff4c606b2596c40b26f85af6bc7d8cc50b 08-May-2007 Jiri Kosina <jkosina@suse.cz> Bluetooth HID: HIDP - don't initialize force feedback

The current implementation of force feedback for HID devices is
USB-transport only and therefore calling hid_ff_init() from hidp code is
not going to work (plus it creates unwanted dependency of hidp on usbhid).
Remove the hid_ff_init() until either the hid-ff is made
transport-independent, or at least support for bluetooth transport is
added.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
e63340ae6b6205fef26b40a75673d1c9c0c8bb90 08-May-2007 Randy Dunlap <randy.dunlap@oracle.com> header cleaning: don't include smp_lock.h when not used

Remove includes of <linux/smp_lock.h> where it is not used/needed.
Suggested by Al Viro.

Builds cleanly on x86_64, i386, alpha, ia64, powerpc, sparc,
sparc64, and arm (all 59 defconfigs).

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
nep/core.c
d12db0b08f6c14dfd1438f6f6ad49dcd663c9ae5 08-May-2007 Linus Torvalds <torvalds@woody.linux-foundation.org> Fix bluetooth HCI sysfs compile

More fallout from the removal of "struct subsystem" from the core device
model.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ci_sysfs.c
9cf5b0ea3a7f1432c61029f7aaf4b8b338628884 05-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Disconnect L2CAP connection after last RFCOMM DLC

The RFCOMM specification says that the device closing the last DLC on
a particular session is responsible for closing the multiplexer by
closing the corresponding L2CAP channel.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
77f2a45fa1ba33147fd6cc8ae546188504a822cd 05-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Check that device is in rfcomm_dev_list before deleting

If RFCOMM_RELEASE_ONHUP flag is on and rfcomm_release_dev is called
before connection is closed, rfcomm_dev is deleted twice from the
rfcomm_dev_list and refcount is messed up. This patch adds a check
before deleting device that the device actually is listed.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
48db9ca4f2ac9f39eb90ccb12ad3ca7b645a552c 05-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Use in-kernel sockets API

The kernel provides a new convenient way to access the sockets API for
in-kernel users. It is a good idea to actually use it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
53c1d4b0b22243c093ded25aaa01c8ff8ab6e6b3 05-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Attach host adapters to the Bluetooth bus

The Bluetooth host adapters are attached to the Bluetooth class and the
low-level connections are children of these class devices. Having class
devices as parent of bus devices breaks a lot of reasonable assumptions
about sysfs. The host adapters should be attached to the Bluetooth bus
to simplify the dependency resolving. For compatibility an additional
symlink from the Bluetooth class will be used.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
0878b6667f28772aa7d6b735abff53efc7bf6d91 05-May-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix L2CAP and HCI setsockopt() information leaks

The L2CAP and HCI setsockopt() implementations have a small information
leak that makes it possible to leak kernel stack memory to userspace.

If the optlen parameter is 0, no data will be copied by copy_from_user(),
but the uninitialized stack buffer will be read and stored later. A call
to getsockopt() can now retrieve the leaked information.

To fix this problem the stack buffer given to copy_from_user() must be
initialized with the current settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
2cap.c
74da9d88bf5ffd31aed61a0b19519684ad744ded 26-Apr-2007 Andrew Morton <akpm@linux-foundation.org> [BLUETOOTH] rfcomm_worker(): fix wakeup race

Set TASK_INTERRUPTIBLE prior to testing the flag to avoid missed wakeups.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
3ff50b7997fe06cd5d276b229967bb52d6b3b6c1 21-Apr-2007 Stephen Hemminger <shemminger@linux-foundation.org> [NET]: cleanup extra semicolons

Spring cleaning time...

There seems to be a lot of places in the network code that have
extra bogus semicolons after conditionals. Most commonly is a
bogus semicolon after: switch() { }

Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
co.c
d626f62b11e00c16e81e4308ab93d3f13551812a 27-Mar-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Introduce skb_copy_from_linear_data{_offset}

To clearly state the intent of copying from linear sk_buffs, _offset being a
overly long variant but interesting for the sake of saving some bytes.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
nep/core.c
mtp/core.c
2cap.c
27a884dc3cb63b93c2b3b643f5b31eed5f8a4d26 20-Apr-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Convert skb->tail to sk_buff_data_t

So that it is also an offset from skb->head, reduces its size from 8 to 4 bytes
on 64bit architectures, allowing us to combine the 4 bytes hole left by the
layer headers conversion, reducing struct sk_buff size to 256 bytes, i.e. 4
64byte cachelines, and since the sk_buff slab cache is SLAB_HWCACHE_ALIGN...
:-)

Many calculations that previously required that skb->{transport,network,
mac}_header be first converted to a pointer now can be done directly, being
meaningful as offsets or pointers.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
9c70220b73908f64792422a2c39c593c4792f2c5 26-Apr-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Introduce skb_transport_header(skb)

For the places where we need a pointer to the transport header, it is
still legal to touch skb->h.raw directly if just adding to,
subtracting from or setting it to another layer header.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
badff6d01a8589a1c828b0bf118903ca38627f4e 13-Mar-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Introduce skb_reset_transport_header(skb)

For the common, open coded 'skb->h.raw = skb->data' operation, so that we can
later turn skb->h.raw into a offset, reducing the size of struct sk_buff in
64bit land while possibly keeping it as a pointer on 32bit.

This one touches just the most simple cases:

skb->h.raw = skb->data;
skb->h.raw = {skb_push|[__]skb_pull}()

The next ones will handle the slightly more "complex" cases.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
ci_core.c
ci_sock.c
98e399f82ab3a6d863d1d4a7ea48925cc91c830e 19-Mar-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Introduce skb_mac_header()

For the places where we need a pointer to the mac header, it is still legal to
touch skb->mac.raw directly if just adding to, subtracting from or setting it
to another layer header.

This one also converts some more cases to skb_reset_mac_header() that my
regex missed as it had no spaces before nor after '=', ugh.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
459a98ed881802dee55897441bc7f77af614368e 19-Mar-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [SK_BUFF]: Introduce skb_reset_mac_header(skb)

For the common, open coded 'skb->mac.raw = skb->data' operation, so that we can
later turn skb->mac.raw into a offset, reducing the size of struct sk_buff in
64bit land while possibly keeping it as a pointer on 32bit.

This one touches just the most simple case, next will handle the slightly more
"complex" cases.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
4c13eb6657fe9ef7b4dc8f1a405c902e9e5234e0 26-Apr-2007 Arnaldo Carvalho de Melo <acme@redhat.com> [ETH]: Make eth_type_trans set skb->dev like the other *_type_trans

One less thing for drivers writers to worry about.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
aca3192cc60d2bf193c2252e45563c32e3117289 26-Mar-2007 YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> [NET] BLUETOOTH: Use cpu_to_le{16,32}() where appropriate.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_conn.c
ci_core.c
ci_event.c
2cap.c
cb3fecc2f29056e89658e7eb371e7f9be66cda6d 29-Mar-2007 Jiri Kosina <jkosina@suse.cz> [PATCH] bluetooth hid quirks: mightymouse quirk

I have a bugreport that scrollwheel of bluetooth version of apple
mightymouse doesn't work. The USB version of mightymouse works, as there
is a quirk for handling scrollwheel in hid/usbhid for it.

Now that bluetooth git tree is hooked to generic hid layer, it could easily
use the quirks which are already present in generic hid parser, hid-input,
etc.

Below is a simple patch against bluetooth git tree, which adds quirk
handling to current bluetooth hidp code, and sets quirk flags for device
0x05ac/0x030c, which is the bluetooth version of the apple mightymouse.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
idp/core.c
b6f99a211957910a07437f46ce54dcfb1755cf84 22-Mar-2007 Dave Jones <davej@redhat.com> [NET]: fix up misplaced inlines.

Turning up the warnings on gcc makes it emit warnings
about the placement of 'inline' in function declarations.
Here's everything that was under net/

Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
idp/core.c
b40df5743ee8aed8674edbbb77b8fd3c8c7a747f 08-Mar-2007 Jiri Kosina <jkosina@suse.cz> [PATCH] bluetooth: fix socket locking in hci_sock_dev_event()

[Bluetooth] Fix socket locking in hci_sock_dev_event()

hci_sock_dev_event() uses bh_lock_sock() to lock the socket lock.
This is not deadlock-safe against locking of the same socket lock in
l2cap_connect_cfm() from softirq context. In addition to that,
hci_sock_dev_event() doesn't seem to be called from softirq context,
so it is safe to use lock_sock()/release_sock() instead.

The lockdep warning can be triggered on my T42p simply by switching
the Bluetooth off by the keyboard button.

=================================
[ INFO: inconsistent lock state ]
2.6.21-rc2 #4
---------------------------------
inconsistent {in-softirq-W} -> {softirq-on-W} usage.
khubd/156 [HC0[0]:SC0[0]:HE1:SE1] takes:
(slock-AF_BLUETOOTH){-+..}, at: [<e0ca5520>] hci_sock_dev_event+0xa8/0xc5 [bluetooth]
{in-softirq-W} state was registered at:
[<c012d1db>] mark_lock+0x59/0x414
[<e0cef688>] l2cap_connect_cfm+0x4e/0x11f [l2cap]
[<c012dfd7>] __lock_acquire+0x3e5/0xb99
[<e0cef688>] l2cap_connect_cfm+0x4e/0x11f [l2cap]
[<c012e7f2>] lock_acquire+0x67/0x81
[<e0cef688>] l2cap_connect_cfm+0x4e/0x11f [l2cap]
[<c036ee72>] _spin_lock+0x29/0x34
[<e0cef688>] l2cap_connect_cfm+0x4e/0x11f [l2cap]
[<e0cef688>] l2cap_connect_cfm+0x4e/0x11f [l2cap]
[<e0ca17c3>] hci_send_cmd+0x126/0x14f [bluetooth]
[<e0ca4ce4>] hci_event_packet+0x729/0xebd [bluetooth]
[<e0ca205b>] hci_rx_task+0x2a/0x20f [bluetooth]
[<e0ca209d>] hci_rx_task+0x6c/0x20f [bluetooth]
[<c012d7be>] trace_hardirqs_on+0x10d/0x14e
[<c011ac85>] tasklet_action+0x3d/0x68
[<c011abba>] __do_softirq+0x41/0x92
[<c011ac32>] do_softirq+0x27/0x3d
[<c0105134>] do_IRQ+0x7b/0x8f
[<c0103dec>] common_interrupt+0x24/0x34
[<c0103df6>] common_interrupt+0x2e/0x34
[<c0248e65>] acpi_processor_idle+0x1b3/0x34a
[<c0248e68>] acpi_processor_idle+0x1b6/0x34a
[<c010232b>] cpu_idle+0x39/0x4e
[<c04bab0c>] start_kernel+0x372/0x37a
[<c04ba42b>] unknown_bootoption+0x0/0x202
[<ffffffff>] 0xffffffff

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ci_sock.c
c1a3313698895d8ad4760f98642007bf236af2e8 17-Feb-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Make use of device_move() for RFCOMM TTY devices

In the case of bound RFCOMM TTY devices the parent is not available
before its usage. So when opening a RFCOMM TTY device, move it to
the corresponding ACL device as a child. When closing the device,
move it back to the virtual device tree.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
f5ffd4620aba9e55656483ae1ef5c79ba81f5403 17-Feb-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add open and close callbacks for HID device

The open and close callbacks for the HID device are not optional, but
for the Bluetooth HID report mode support it is enough to add empty
dummy callbacks.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
e1aaadd4d8162a2c33e41dd5a72234ea4d3b014f 17-Feb-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add support for using the HID subsystem

This patch extends the current Bluetooth HID support to use the new
HID subsystem and adds full report mode support.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/Kconfig
idp/core.c
idp/hidp.h
a83d6c0de8811d7bcc4eb67ed199d1120ca6cad8 17-Feb-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix wrong put_user() from HIDP compat ioctl patch

The compat ioctl patch copied the parser version field into the
report descriptor size field by mistake.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/sock.c
cd354f1ae75e6466a7e31b727faede57a1f89ca5 14-Feb-2007 Tim Schmielau <tim@physik3.uni-rostock.de> [PATCH] remove many unneeded #includes of sched.h

After Al Viro (finally) succeeded in removing the sched.h #include in module.h
recently, it makes sense again to remove other superfluous sched.h includes.
There are quite a lot of files which include it but don't actually need
anything defined in there. Presumably these includes were once needed for
macros that used to live in sched.h, but moved to other header files in the
course of cleaning it up.

To ease the pain, this time I did not fiddle with any header files and only
removed #includes from .c-files, which tend to cause less trouble.

Compile tested against 2.6.20-rc2 and 2.6.20-rc2-mm2 (with offsets) on alpha,
arm, i386, ia64, mips, powerpc, and x86_64 with allnoconfig, defconfig,
allmodconfig, and allyesconfig as well as a few randconfigs on x86_64 and all
configs in arch/arm/configs on arm. I also checked that no new warnings were
introduced by the patch (actually, some warnings are removed that were emitted
by unnecessarily included header files).

Signed-off-by: Tim Schmielau <tim@physik3.uni-rostock.de>
Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
nep/sock.c
mtp/sock.c
ci_conn.c
ci_event.c
ci_sock.c
idp/sock.c
8e87d14255acffeee36873de226dc25c11b5f46d 09-Feb-2007 YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> [NET] BLUETOOTH: Fix whitespace errors.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
nep/bnep.h
nep/core.c
nep/netdev.c
nep/sock.c
mtp/capi.c
mtp/cmtp.h
mtp/core.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
idp/core.c
idp/hidp.h
idp/sock.c
2cap.c
ib.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
55e747445beec8df1133bb8681c884500546775c 09-Feb-2007 Al Viro <viro@ftp.linux.org.uk> [PATCH] hidp __user annotations

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
idp/hidp.h
idp/sock.c
847641d7db15ac3f18b3d4aa05479812abdf397a 22-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Restrict well known PSM to privileged users

The PSM values below 0x1001 of L2CAP are reserved for well known
services. Restrict the possibility to bind them to privileged
users.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
7386397636d49cd5f03da29432467d3e98cbad35 22-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Missing endian swapping for L2CAP socket list

The PSM value in the L2CAP socket list must be converted to host
order before printing it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
c893779e9fbe78575cbd04596f1fcafdb48e8f3f 08-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Handle device registration failures

In the case the device registration for a new Bluetooth low-level
connection fails there is no need to unregister it when the temporary
data structure has been removed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
4d6a2188bd456969f52c03edf1988de90f08d9f5 08-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix uninitialized return value for RFCOMM sendmsg()

When calling send() with a zero length parameter on a RFCOMM socket
it returns a positive value. In this rare case the variable err is
used uninitialized and unfortunately its value is returned.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
b6e557fbf1dbba8cfa667a25503e5dbd0e9330b7 08-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] More checks if DLC is still attached to the TTY

If the DLC device is no longer attached to the TTY device, then return
errors or default values for various callbacks of the TTY layer.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
f4777569204cb59f2f04fbe9ef4e9a6918209104 08-Jan-2007 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add packet size checks for CAPI messages

With malformed packets it might be possible to overwrite internal
CMTP and CAPI data structures. This patch adds additional length
checks to prevent these kinds of remote attacks.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mtp/capi.c
905f3ed62515f233fea09dc5ad68bbcff4903520 13-Dec-2006 Al Viro <viro@ftp.linux.org.uk> [PATCH] hci endianness annotations

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
ci_sock.c
606d099cdd1080bbb50ea50dc52d98252f8f10a1 08-Dec-2006 Alan Cox <alan@lxorguk.ukuu.org.uk> [PATCH] tty: switch to ktermios

This is the grungy swap all the occurrences in the right places patch that
goes with the updates. At this point we have the same functionality as
before (except that sgttyb() returns speeds not zero) and are ready to
begin turning new stuff on providing nobody reports lots of bugs

If you are a tty driver author converting an out of tree driver the only
impact should be termios->ktermios name changes for the speed/property
setting functions from your upper layers.

If you are implementing your own TCGETS function before then your driver
was broken already and its about to get a whole lot more painful for you so
please fix it 8)

Also fill in c_ispeed/ospeed on init for most devices, although the current
code will do this for you anyway but I'd like eventually to lose that extra
paranoia

[akpm@osdl.org: bluetooth fix]
[mp3@de.ibm.com: sclp fix]
[mp3@de.ibm.com: warning fix for tty3270]
[hugh@veritas.com: fix tty_ioctl powerpc build]
[jdike@addtoit.com: uml: fix ->set_termios declaration]
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Martin Peschke <mp3@de.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@de.ibm.com>
Cc: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Jeff Dike <jdike@addtoit.com>
Cc: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fcomm/tty.c
4c1ac1b49122b805adfa4efc620592f68dccf5db 05-Dec-2006 David Howells <dhowells@redhat.com> Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:

drivers/infiniband/core/iwcm.c
drivers/net/chelsio/cxgb2.c
drivers/net/wireless/bcm43xx/bcm43xx_main.c
drivers/net/wireless/prism54/islpci_eth.c
drivers/usb/core/hub.h
drivers/usb/input/hid-core.c
net/core/netpoll.c

Fix up merge failures with Linus's head and fix new compilation failures.

Signed-Off-By: David Howells <dhowells@redhat.com>
fcc70d5fdc9b0bd3e99c9dacb8198224af2b4b42 09-Nov-2006 Peter Zijlstra <a.p.zijlstra@chello.nl> [BLUETOOTH] lockdep: annotate sk_lock nesting in AF_BLUETOOTH

=============================================
[ INFO: possible recursive locking detected ]
2.6.18-1.2726.fc6 #1
2cap.c
e8db8c99100750ade5a9b4072b9469cab718a5b7 08-Nov-2006 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH] rfcomm endianness bug: param_mask is little-endian on the wire

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
6ba9c755e5f044c6a37296481bf6a861e4193a37 08-Nov-2006 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH]: rfcomm endianness annotations

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
1bc5d4483a83349f143e2bbf23ec144cd7e21e89 08-Nov-2006 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH]: bnep endianness annotations

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/bnep.h
nep/core.c
e41d21697326a38a0a871c515db88fa310177e24 08-Nov-2006 Al Viro <viro@zeniv.linux.org.uk> [BLUETOOTH] bnep endianness bug: filtering by packet type

<= and => don't work well on net-endian...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
nep/netdev.c
c4028958b6ecad064b1a6303a6a5906d4fe48d73 22-Nov-2006 David Howells <dhowells@redhat.com> WorkStruct: make allyesconfig

Fix up for make allyesconfig.

Signed-Off-By: David Howells <dhowells@redhat.com>
ci_sysfs.c
4498c80d9c1ebdf42837be6a52ead35a2aa2b819 22-Nov-2006 David S. Miller <davem@davemloft.net> [BLUETOOTH]: Fix unaligned access in hci_send_to_sock.

The "u16 *" derefs of skb->data need to be wrapped inside of
a get_unaligned().

Thanks to Gustavo Zacarias for the bug report.

Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sock.c
354f60a9952d0af59e684b91cc6e06b95fbbf5ef 18-Nov-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Ignore L2CAP config requests on disconnect

Any L2CAP connection in disconnecting state shall not response
to any further config requests from the remote side. So in case
such a request is received, ignore it.

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
820ae1b865caa05e0614004d0183ca70de2b8665 18-Nov-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Always include MTU in L2CAP config responses

When sending a positive config response it shall include the actual
MTU to be used on this channel. This differs from the Bluetooth 1.1
specification where it was enough to acknowledge the config request.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
ff2d367ac33b9278c9516ac1888207dac11d10b0 18-Nov-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Check if RFCOMM session is still attached to the TTY

If the RFCOMM session is no longer attached to the TTY device, then it
makes no sense to go through with changing the termios settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
6bd57416127e92d35e6798925502c84e14a3a966 18-Nov-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Handling pending connect attempts after inquiry

After an inquiry completed or got canceled the Bluetooth core should
check for any pending connect attempts.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
e52726dece1d2e3976c0caf2f4e9e1c452d31282 18-Nov-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Attach low-level connections to the Bluetooth bus

To receive uvents for the low-level ACL and SCO links, they must be
assigned to a subsystem. It is enough to attach them to the already
established Bluetooth bus.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
7b19ffc40b0247fcfe083644fdb621fdb3c05ef6 20-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix HID disconnect NULL pointer dereference

The latest HID disconnect sequence change introduced a NULL pointer
dereference. For the quirk to handle buggy remote HID implementations,
it is enough to wait for a potential control channel disconnect from
the remote side and it is also enough to wait only 500 msecs.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
74da626a1098640ddc40c0e3481c0cd41e8ec1e9 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add locking for bt_proto array manipulation

The bt_proto array needs to be protected by some kind of locking to
prevent a race condition between bt_sock_create and bt_sock_register.

And in addition all calls to sk_alloc need to be made GFP_ATOMIC now.

Signed-off-by: Masatake YAMATO <jet@gyve.org>
Signed-off-by: Frederik Deweerdt <frederik.deweerdt@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
cb19d9ea2ce2bcbe291d3d48e3501dc4f33ba627 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Check if DLC is still attached to the TTY

If the DLC device is no longer attached to the TTY device, then it
makes no sense to go through with changing the termios settings.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/tty.c
b2cfcd75df77b80d9cc3fa84190a350dfa79eb93 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix reference count when connection lookup fails

When the connection lookup for the device structure fails, the reference
count for the HCI device needs to be decremented.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
idp/core.c
fcomm/tty.c
e86070c83e9110e89800274385c013db602b1444 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Disconnect HID interrupt channel first

The Bluetooth HID specification demands that the interrupt channel
shall be disconnected first. This is needed to pass the qualification
tests.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/core.c
4c67bc74f016b0d360b8573e18969c0ff7926974 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Support concurrent connect requests

Most Bluetooth chips don't support concurrent connect requests, because
this would involve a multiple baseband page with only one radio. In the
case an upper layer like L2CAP requests a concurrent connect these chips
return the error "Command Disallowed" for the second request. If this
happens it the responsibility of the Bluetooth core to queue the request
and try again after the previous connect attempt has been completed.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_conn.c
ci_event.c
e9c4bec63eac001651d6d30239dd4175cc3698ef 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Make use of virtual devices tree

The Bluetooth subsystem currently uses a platform device for devices
with no parent. It is a better idea to use the new virtual devices
tree for these.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
df5c37ea9a3820a9515d8204450aec00f48f8f88 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Handle return values from driver core functions

Some return values of the driver core register and create functions
are not handled and so might cause unexpected problems.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
e9c5702e3c5558dade169949abd730173e87ef9c 15-Oct-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix compat ioctl for BNEP, CMTP and HIDP

There exists no attempt do deal with the fact that a structure with
a uint32_t followed by a pointer is going to be different for 32-bit
and 64-bit userspace. Any 32-bit process trying to use it will be
failing with -EFAULT if it's lucky; suffering from having data dumped
at a random address if it's not.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/sock.c
mtp/sock.c
idp/sock.c
b68e31d0ebbcc909d1941f9f230c9d062a3a13d3 02-Oct-2006 Jeff Dike <jdike@addtoit.com> [PATCH] const struct tty_operations

As part of an SMP cleanliness pass over UML, I consted a bunch of
structures in order to not have to document their locking. One of these
structures was a struct tty_operations. In order to const it in UML
without introducing compiler complaints, the declaration of
tty_set_operations needs to be changed, and then all of its callers need to
be fixed.

This patch declares all struct tty_operations in the tree as const. In all
cases, they are static and used only as input to tty_set_operations. As an
extra check, I ran an i386 allyesconfig build which produced no extra
warnings.

53 drivers are affected. I checked the history of a bunch of them, and in
most cases, there have been only a handful of maintenance changes in the
last six months. serial_core.c was the busiest one that I looked at.

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Acked-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fcomm/tty.c
860e13b5c591f1040b76fff57a6a3d6ca9633983 29-Sep-2006 Arnaud Patard <arnaud.patard@rtp-net.org> [Bluetooth]: Fix section mismatch of bt_sysfs_cleanup()

The bt_sysfs_cleanup() is marked with __exit attribute, but it will
be called from an __init function in the error case. So the __exit
attribute must be removed.

Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_sysfs.c
37e97b4ef0d18b77a45a4714154daf3499206654 29-Sep-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Don't update disconnect timer for incoming connections

In the case of device pairing the only safe method is to establish
a low-level ACL link. In this case, the remote side should not use
the disconnect timer to give the other side the chance to enter the
PIN code. If the disconnect timer is used, the connection will be
dropped to soon, because it is impossible to identify an actual user
of this link.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_event.c
6ac59344ef25d5f0ebadb5663cf700d25d2a3886 26-Sep-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Support create connection cancel command

In case of non-blocking connects it is possible that the last user
of an ACL link quits before the connection has been fully established.
This will lead to a race condition where the internal state of a
connection is closed, but the actual link has been established and is
active. In case of Bluetooth 1.2 and later devices it is possible to
call create connection cancel to abort the connect. For older devices
the disconnect timer will be used to trigger the needed disconnect.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_event.c
1143e5a6d4d69cd36d44e0184769aa2b17041a10 23-Sep-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Read local version information on device init

The local version information are needed to identify certain feature
sets of devices. They must be read on device init and stored for later
use. It is also possible to access them through the device model.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ci_sysfs.c
b4c612a473eb816dff6e5ab6820dff338057aa8d 23-Sep-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Return EINPROGRESS for non-blocking socket calls

In case of non-blocking socket calls we should return EINPROGRESS
and not EAGAIN.

Signed-off-by: Ulisses Furquim <ulissesf@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
fcomm/core.c
defc761bc25643eeedee3abd6af0079ef214b55d 21-Sep-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Handle command complete event for exit periodic inquiry

The command complete event of the exit periodic inquiry command must
clear the HCI_INQUIRY flag and finish the HCI request.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
0ac53939a06c610b394aeb0211b985804f2d2da3 08-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add HCI device identifier for SDIO cards

This patch assigns the next free HCI device identifier to Bluetooth
devices based on the SDIO interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
0a85b964e141a4b8db6eaf500ceace12f8f52f93 06-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Integrate services into the driver model

This patch integrates the services of the Bluetooth protocols RFCOMM,
BNEP and HIDP into the driver model. This makes it possible to assign
the virtual TTY, network and input devices to a specific Bluetooth
connection.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
nep/core.c
idp/core.c
fcomm/tty.c
b219e3ac66183fc9771b94af931fb5fd41d586ec 06-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Integrate low-level connections into the driver model

This patch integrates the low-level connections (ACL and SCO) into the
driver model. Every connection is presented as device with the parent
set to its host controller device.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_conn.c
ci_sysfs.c
4d0eb0049ce94101f7f169f89216ba58475219e2 06-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Remove unused host controller attributes

This patch removes the unused device attribute entries for the Bluetooth
host controllers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sysfs.c
98bcd08b5bfe78c1c9bda5768aa081e0fe4fcc4f 14-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Correct RFCOMM channel MTU for broken implementations

Some Bluetooth RFCOMM implementations try to negotiate a bigger channel
MTU than we can support for a particular session. The maximum MTU for
a RFCOMM session is limited through the L2CAP layer. So if the other
side proposes a channel MTU that is bigger than the underlying L2CAP
MTU, we should reduce it to the L2CAP MTU of the session minus five
bytes for the RFCOMM headers.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
fd1278d720b48ad7576f64014b916cc77365cb3f 12-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix deadlock in the L2CAP layer

The Bluetooth L2CAP layer has 2 locks that are used in softirq context,
(one spinlock and one rwlock, where the softirq usage is readlock) but
where not all usages of the lock were _bh safe. The patch below corrects
this.

Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
0263603a01e802f79e369ac489793e5320031560 12-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Let BT_HIDP depend on INPUT

This patch lets BT_HIDP depend on instead of select INPUT. This fixes
the following warning during an s390 build:

net/bluetooth/hidp/Kconfig:4:warning: 'select' used by config symbol
'BT_HIDP' refer to undefined symbol 'INPUT'

A dependency on INPUT also implies !S390 (and therefore makes the
explicit dependency obsolete) since INPUT is not available on s390.

The practical difference should be nearly zero, since INPUT is always
set to y unless EMBEDDED=y (or S390=y).

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
idp/Kconfig
25ea6db04a96d7871e7ece27d566f3228d59d932 06-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Remaining transitions to use kzalloc()

This patch makes the remaining transitions to use kzalloc().

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
mtp/capi.c
mtp/core.c
ci_core.c
idp/core.c
fcomm/core.c
fcomm/tty.c
co.c
300b93974ff64f1bef1ac8294547c573954f0300 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add RFCOMM role switch support

This patch adds the support for RFCOMM role switching before the
connection is fully established.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
7c2660b00fae0575dd4ce5c7b6bf30762b632045 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Allow disabling of credit based flow control

This patch adds the module parameter disable_cfc which can be used to
disable the credit based flow control. The credit based flow control
was introduced with the Bluetooth 1.1 specification and devices can
negotiate its support, but for testing purpose it is helpful to allow
disabling of it.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
0139418c943c3389cf75afc4f4d2b2fa52bbf7c9 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Small cleanup of the L2CAP source code

This patch is a small cleanup of the L2CAP source code. It makes some
coding style changes and moves some functions around to avoid forward
declarations.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2cap.c
a91f2e396f5b32b21d842b4757bc8de5e88eac66 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Use real devices for host controllers

This patch converts the Bluetooth class devices into real devices. The
Bluetooth class is kept and the driver core provides the appropriate
symlinks for backward compatibility.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_sysfs.c
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
27d35284258c596900e0e41c46932ec4abe6a7b1 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add platform device for virtual and serial devices

This patch adds a generic Bluetooth platform device that can be used
as parent device by virtual and serial devices.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_sysfs.c
04837f6447c7f3ef114cda1ad761822dedbff8cf 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add automatic sniff mode support

This patch introduces the automatic sniff mode feature. This allows
the host to switch idle connections into sniff mode to safe power.

Signed-off-by: Ulisses Furquim <ulissesf@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_conn.c
ci_core.c
ci_event.c
ci_sysfs.c
da1f519851d1c66331363253f364bdb5d924ea96 03-Jul-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Correct SCO buffer size on request

This patch introduces a quirk that allows the drivers to tell the host
to correct the SCO buffer size values.

Signed-off-by: Olivier Galibert <galibert@pobox.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
6ab3d5624e172c553004ecc862bfeac16d9d68b7 30-Jun-2006 Jörn Engel <joern@wohnheim.fh-wedel.de> Remove obsolete #include <linux/config.h>

Signed-off-by: Jörn Engel <joern@wohnheim.fh-wedel.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
f_bluetooth.c
nep/core.c
nep/netdev.c
nep/sock.c
mtp/capi.c
mtp/core.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
idp/core.c
idp/sock.c
2cap.c
ib.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
602cada851b28c5792339786efe872fbdc1f5d41 29-Jun-2006 Linus Torvalds <torvalds@g5.osdl.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/devfs-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/devfs-2.6: (22 commits)
[PATCH] devfs: Remove it from the feature_removal.txt file
[PATCH] devfs: Last little devfs cleanups throughout the kernel tree.
[PATCH] devfs: Rename TTY_DRIVER_NO_DEVFS to TTY_DRIVER_DYNAMIC_DEV
[PATCH] devfs: Remove the tty_driver devfs_name field as it's no longer needed
[PATCH] devfs: Remove the line_driver devfs_name field as it's no longer needed
[PATCH] devfs: Remove the videodevice devfs_name field as it's no longer needed
[PATCH] devfs: Remove the gendisk devfs_name field as it's no longer needed
[PATCH] devfs: Remove the miscdevice devfs_name field as it's no longer needed
[PATCH] devfs: Remove the devfs_fs_kernel.h file from the tree
[PATCH] devfs: Remove devfs_remove() function from the kernel tree
[PATCH] devfs: Remove devfs_mk_cdev() function from the kernel tree
[PATCH] devfs: Remove devfs_mk_bdev() function from the kernel tree
[PATCH] devfs: Remove devfs_mk_symlink() function from the kernel tree
[PATCH] devfs: Remove devfs_mk_dir() function from the kernel tree
[PATCH] devfs: Remove devfs_*_tape() functions from the kernel tree
[PATCH] devfs: Remove devfs support from the sound subsystem
[PATCH] devfs: Remove devfs support from the ide subsystem.
[PATCH] devfs: Remove devfs support from the serial subsystem
[PATCH] devfs: Remove devfs from the init code
[PATCH] devfs: Remove devfs from the partition code
...
817d6d3bceaf34c99f5343820f9b9e6021f0655c 28-Jun-2006 Paul Fulghum <paulkf@microgate.com> [PATCH] remove TTY_DONT_FLIP

Remove TTY_DONT_FLIP tty flag. This flag was introduced in 2.1.X kernels
to prevent the N_TTY line discipline functions read_chan() and
n_tty_receive_buf() from running at the same time. 2.2.15 introduced
tty->read_lock to protect access to the N_TTY read buffer, which is the
only state requiring protection between these two functions.

The current TTY_DONT_FLIP implementation is broken for SMP, and is not
universally honored by drivers that send data directly to the line
discipline receive_buf function.

Because TTY_DONT_FLIP is not necessary, is broken in implementation, and is
not universally honored, it is removed.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fcomm/tty.c
331b831983f9d706f4a40d08a996d5c2c7a6ea7b 21-Jun-2005 Greg Kroah-Hartman <gregkh@suse.de> [PATCH] devfs: Rename TTY_DRIVER_NO_DEVFS to TTY_DRIVER_DYNAMIC_DEV

I've always found this flag confusing. Now that devfs is no longer around, it
has been renamed, and the documentation for when this flag should be used has
been updated.

Also fixes all drivers that use this flag.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
f4eaa37017a5a68f67ef86729508022c13fb8e6d 21-Jun-2005 Greg Kroah-Hartman <gregkh@suse.de> [PATCH] devfs: Remove the tty_driver devfs_name field as it's no longer needed

Also fixes all drivers that set this field.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fcomm/tty.c
cdee5751bf91d02616aaf30a5affef56105e3b79 06-Apr-2006 Eric Sesterhenn <snakebyte@gmx.de> [BLUETOOTH] sco: Possible double free.

this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
co.c
e041c683412d5bf44dc2b109053e3b837b71742d 27-Mar-2006 Alan Stern <stern@rowland.harvard.edu> [PATCH] Notifier chain update: API changes

The kernel's implementation of notifier chains is unsafe. There is no
protection against entries being added to or removed from a chain while the
chain is in use. The issues were discussed in this thread:

http://marc.theaimsgroup.com/?l=linux-kernel&m=113018709002036&w=2

We noticed that notifier chains in the kernel fall into two basic usage
classes:

"Blocking" chains are always called from a process context
and the callout routines are allowed to sleep;

"Atomic" chains can be called from an atomic context and
the callout routines are not allowed to sleep.

We decided to codify this distinction and make it part of the API. Therefore
this set of patches introduces three new, parallel APIs: one for blocking
notifiers, one for atomic notifiers, and one for "raw" notifiers (which is
really just the old API under a new name). New kinds of data structures are
used for the heads of the chains, and new routines are defined for
registration, unregistration, and calling a chain. The three APIs are
explained in include/linux/notifier.h and their implementation is in
kernel/sys.c.

With atomic and blocking chains, the implementation guarantees that the chain
links will not be corrupted and that chain callers will not get messed up by
entries being added or removed. For raw chains the implementation provides no
guarantees at all; users of this API must provide their own protections. (The
idea was that situations may come up where the assumptions of the atomic and
blocking APIs are not appropriate, so it should be possible for users to
handle these things in their own way.)

There are some limitations, which should not be too hard to live with. For
atomic/blocking chains, registration and unregistration must always be done in
a process context since the chain is protected by a mutex/rwsem. Also, a
callout routine for a non-raw chain must not try to register or unregister
entries on its own chain. (This did happen in a couple of places and the code
had to be changed to avoid it.)

Since atomic chains may be called from within an NMI handler, they cannot use
spinlocks for synchronization. Instead we use RCU. The overhead falls almost
entirely in the unregister routine, which is okay since unregistration is much
less frequent that calling a chain.

Here is the list of chains that we adjusted and their classifications. None
of them use the raw API, so for the moment it is only a placeholder.

ATOMIC CHAINS
-------------
arch/i386/kernel/traps.c: i386die_chain
arch/ia64/kernel/traps.c: ia64die_chain
arch/powerpc/kernel/traps.c: powerpc_die_chain
arch/sparc64/kernel/traps.c: sparc64die_chain
arch/x86_64/kernel/traps.c: die_chain
drivers/char/ipmi/ipmi_si_intf.c: xaction_notifier_list
kernel/panic.c: panic_notifier_list
kernel/profile.c: task_free_notifier
net/bluetooth/hci_core.c: hci_notifier
net/ipv4/netfilter/ip_conntrack_core.c: ip_conntrack_chain
net/ipv4/netfilter/ip_conntrack_core.c: ip_conntrack_expect_chain
net/ipv6/addrconf.c: inet6addr_chain
net/netfilter/nf_conntrack_core.c: nf_conntrack_chain
net/netfilter/nf_conntrack_core.c: nf_conntrack_expect_chain
net/netlink/af_netlink.c: netlink_chain

BLOCKING CHAINS
---------------
arch/powerpc/platforms/pseries/reconfig.c: pSeries_reconfig_chain
arch/s390/kernel/process.c: idle_chain
arch/x86_64/kernel/process.c idle_notifier
drivers/base/memory.c: memory_chain
drivers/cpufreq/cpufreq.c cpufreq_policy_notifier_list
drivers/cpufreq/cpufreq.c cpufreq_transition_notifier_list
drivers/macintosh/adb.c: adb_client_list
drivers/macintosh/via-pmu.c sleep_notifier_list
drivers/macintosh/via-pmu68k.c sleep_notifier_list
drivers/macintosh/windfarm_core.c wf_client_list
drivers/usb/core/notify.c usb_notifier_list
drivers/video/fbmem.c fb_notifier_list
kernel/cpu.c cpu_chain
kernel/module.c module_notify_list
kernel/profile.c munmap_notifier
kernel/profile.c task_exit_notifier
kernel/sys.c reboot_notifier_list
net/core/dev.c netdev_chain
net/decnet/dn_dev.c: dnaddr_chain
net/ipv4/devinet.c: inetaddr_chain

It's possible that some of these classifications are wrong. If they are,
please let us know or submit a patch to fix them. Note that any chain that
gets called very frequently should be atomic, because the rwsem read-locking
used for blocking chains is very likely to incur cache misses on SMP systems.
(However, if the chain's callout routines may sleep then the chain cannot be
atomic.)

The patch set was written by Alan Stern and Chandra Seetharaman, incorporating
material written by Keith Owens and suggestions from Paul McKenney and Andrew
Morton.

[jes@sgi.com: restructure the notifier chain initialization macros]
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com>
Signed-off-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
ci_core.c
f348d70a324e15afc701a494f32ec468abb7d1eb 25-Mar-2006 Davide Libenzi <davidel@xmailserver.org> [PATCH] POLLRDHUP/EPOLLRDHUP handling for half-closed devices notifications

Implement the half-closed devices notifiation, by adding a new POLLRDHUP
(and its alias EPOLLRDHUP) bit to the existing poll/select sets. Since the
existing POLLHUP handling, that does not report correctly half-closed
devices, was feared to be changed, this implementation leaves the current
POLLHUP reporting unchanged and simply add a new bit that is set in the few
places where it makes sense. The same thing was discussed and conceptually
agreed quite some time ago:

http://lkml.org/lkml/2003/7/12/116

Since this new event bit is added to the existing Linux poll infrastruture,
even the existing poll/select system calls will be able to use it. As far
as the existing POLLHUP handling, the patch leaves it as is. The
pollrdhup-2.6.16.rc5-0.10.diff defines the POLLRDHUP for all the existing
archs and sets the bit in the six relevant files. The other attached diff
is the simple change required to sys/epoll.h to add the EPOLLRDHUP
definition.

There is "a stupid program" to test POLLRDHUP delivery here:

http://www.xmailserver.org/pollrdhup-test.c

It tests poll(2), but since the delivery is same epoll(2) will work equally.

Signed-off-by: Davide Libenzi <davidel@xmailserver.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Michael Kerrisk <mtk-manpages@gmx.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
f_bluetooth.c
67b52e554ba973947704fcb4fc284d7bab9ab931 22-Mar-2006 Tobias Klauser <tklauser@nuerscht.ch> [BLUETOOTH]: Return negative error constant

Return negative error constant.

Signed-off-by: Tobias Klauser <tklauser@nuerscht.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
4a3e2f711a00a1feb72ae12fdc749da10179d185 21-Mar-2006 Arjan van de Ven <arjan@infradead.org> [NET] sem2mutex: net/

Semaphore to mutex conversion.

The conversion was generated via scripts, and the result was validated
automatically via a script as well.

Signed-off-by: Arjan van de Ven <arjan@infradead.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
7b005bd34c895ebeefd1c62f90a329730b88946b 13-Feb-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Fix NULL pointer dereferences of the HCI socket

This patch fixes the two NULL pointer dereferences found by the sfuzz
tool from Ilja van Sprundel. The first one was a call of getsockname()
for an unbound socket and the second was calling accept() while this
operation isn't implemented for the HCI socket interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
56f3a40a5e7586043260669cc794e56fa58339e1 13-Feb-2006 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Reduce L2CAP MTU for RFCOMM connections

This patch reduces the default L2CAP MTU for all RFCOMM connections
from 1024 to 1013 to improve the interoperability with some broken
RFCOMM implementations. To make this more flexible the L2CAP MTU
becomes also a module parameter and so it can changed at runtime.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
4fc268d24ceb9f4150777c1b5b2b8e6214e56b2b 11-Jan-2006 Randy Dunlap <rdunlap@xenotime.net> [PATCH] capable/capability.h (net/)

net: Use <linux/capability.h> where capable() is used.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/tty.c
12fe2c588df77d60dfe13b432f95d00f76b8c969 10-Jan-2006 Jesper Juhl <jesper.juhl@gmail.com> [NET]: Remove unneeded kmalloc() return value casts

Get rid of needless casting of kmalloc() return value in net/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_conn.c
d3f4a687f683f536506d0aa6b22e6cb3e79639ce 10-Jan-2006 Kris Katterjohn <kjak@users.sourceforge.net> [NET]: Change memcmp(,,ETH_ALEN) to compare_ether_addr()

This changes some memcmp(one,two,ETH_ALEN) to compare_ether_addr(one,two).

Signed-off-by: Kris Katterjohn <kjak@users.sourceforge.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/core.c
33f0f88f1c51ae5c2d593d26960c760ea154c2e2 10-Jan-2006 Alan Cox <alan@lxorguk.ukuu.org.uk> [PATCH] TTY layer buffering revamp

The API and code have been through various bits of initial review by
serial driver people but they definitely need to live somewhere for a
while so the unconverted drivers can get knocked into shape, existing
drivers that have been updated can be better tuned and bugs whacked out.

This replaces the tty flip buffers with kmalloc objects in rings. In the
normal situation for an IRQ driven serial port at typical speeds the
behaviour is pretty much the same, two buffers end up allocated and the
kernel cycles between them as before.

When there are delays or at high speed we now behave far better as the
buffer pool can grow a bit rather than lose characters. This also means
that we can operate at higher speeds reliably.

For drivers that receive characters in blocks (DMA based, USB and
especially virtualisation) the layer allows a lot of driver specific
code that works around the tty layer with private secondary queues to be
removed. The IBM folks need this sort of layer, the smart serial port
people do, the virtualisers do (because a virtualised tty typically
operates at infinite speed rather than emulating 9600 baud).

Finally many drivers had invalid and unsafe attempts to avoid buffer
overflows by directly invoking tty methods extracted out of the innards
of work queue structs. These are no longer needed and all go away. That
fixes various random hangs with serial ports on overflow.

The other change in here is to optimise the receive_room path that is
used by some callers. It turns out that only one ldisc uses receive room
except asa constant and it updates it far far less than the value is
read. We thus make it a variable not a function call.

I expect the code to contain bugs due to the size alone but I'll be
watching and squashing them and feeding out new patches as it goes.

Because the buffers now dynamically expand you should only run out of
buffering when the kernel runs out of memory for real. That means a lot of
the horrible hacks high performance drivers used to do just aren't needed any
more.

Description:

tty_insert_flip_char is an old API and continues to work as before, as does
tty_flip_buffer_push() [this is why many drivers dont need modification]. It
does now also return the number of chars inserted

There are also

tty_buffer_request_room(tty, len)

which asks for a buffer block of the length requested and returns the space
found. This improves efficiency with hardware that knows how much to
transfer.

and tty_insert_flip_string_flags(tty, str, flags, len)

to insert a string of characters and flags

For a smart interface the usual code is

len = tty_request_buffer_room(tty, amount_hardware_says);
tty_insert_flip_string(tty, buffer_from_card, len);

More description!

At the moment tty buffers are attached directly to the tty. This is causing a
lot of the problems related to tty layer locking, also problems at high speed
and also with bursty data (such as occurs in virtualised environments)

I'm working on ripping out the flip buffers and replacing them with a pool of
dynamically allocated buffers. This allows both for old style "byte I/O"
devices and also helps virtualisation and smart devices where large blocks of
data suddenely materialise and need storing.

So far so good. Lots of drivers reference tty->flip.*. Several of them also
call directly and unsafely into function pointers it provides. This will all
break. Most drivers can use tty_insert_flip_char which can be kept as an API
but others need more.

At the moment I've added the following interfaces, if people think more will
be needed now is a good time to say

int tty_buffer_request_room(tty, size)

Try and ensure at least size bytes are available, returns actual room (may be
zero). At the moment it just uses the flipbuf space but that will change.
Repeated calls without characters being added are not cumulative. (ie if you
call it with 1, 1, 1, and then 4 you'll have four characters of space. The
other functions will also try and grow buffers in future but this will be a
more efficient way when you know block sizes.

int tty_insert_flip_char(tty, ch, flag)

As before insert a character if there is room. Now returns 1 for success, 0
for failure.

int tty_insert_flip_string(tty, str, len)

Insert a block of non error characters. Returns the number inserted.

int tty_prepare_flip_string(tty, strptr, len)

Adjust the buffer to allow len characters to be added. Returns a buffer
pointer in strptr and the length available. This allows for hardware that
needs to use functions like insl or mencpy_fromio.

Signed-off-by: Alan Cox <alan@redhat.com>
Cc: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: John Hawkes <hawkes@sgi.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
fcomm/tty.c
db9edfd7e339ca4113153d887e782dd05be5a9eb 05-Jan-2006 Linus Torvalds <torvalds@g5.osdl.org> Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-2.6

Trivial manual merge fixup for usb_find_interface clashes.
312c004d36ce6c739512bac83b452f4c20ab1f62 16-Nov-2005 Kay Sievers <kay.sievers@suse.de> [PATCH] driver core: replace "hotplug" by "uevent"

Leave the overloaded "hotplug" word to susbsystems which are handling
real devices. The driver core does not "plug" anything, it just exports
the state to userspace and generates events.

Signed-off-by: Kay Sievers <kay.sievers@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
ci_sysfs.c
90ddc4f0470427df306f308ad03db6b6b21644b8 22-Dec-2005 Eric Dumazet <dada1@cosmosbay.com> [NET]: move struct proto_ops to const

I noticed that some of 'struct proto_ops' used in the kernel may share
a cache line used by locks or other heavily modified data. (default
linker alignement is 32 bytes, and L1_CACHE_LINE is 64 or 128 at
least)

This patch makes sure a 'struct proto_ops' can be declared as const,
so that all cpus can share all parts of it without false sharing.

This is not mandatory : a driver can still use a read/write structure
if it needs to (and eventually a __read_mostly)

I made a global stubstitute to change all existing occurences to make
them const.

This should reduce the possibility of false sharing on SMP, and
speedup some socket system calls.

Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
nep/sock.c
mtp/sock.c
ci_sock.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
c1cbe4b7ad0bc4b1d98ea708a3fecb7362aa4088 14-Dec-2005 Benjamin LaHaise <benjamin.c.lahaise@intel.com> [NET]: Avoid atomic xchg() for non-error case

It also looks like there were 2 places where the test on sk_err was
missing from the event wait logic (in sk_stream_wait_connect and
sk_stream_wait_memory), while the rest of the sock_error() users look
to be doing the right thing. This version of the patch fixes those,
and cleans up a few places that were testing ->sk_err directly.

Signed-off-by: Benjamin LaHaise <benjamin.c.lahaise@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
2cap.c
co.c
be9d122730c878baafe11e70d1436faac229f2fc 08-Nov-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Remove the usage of /proc completely

This patch removes all relics of the /proc usage from the Bluetooth
subsystem core and its upper layers. All the previous information are
now available via /sys/class/bluetooth through appropriate functions.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
f_bluetooth.c
ci_sysfs.c
2cap.c
fcomm/core.c
fcomm/sock.c
co.c
1ebb92521d0bc2d4ef772730d29333c06b807191 08-Nov-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Add endian annotations to the core

This patch adds the endian annotations to the Bluetooth core.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
ci_event.c
ci_sock.c
a51482bde22f99c63fbbb57d5d46cc666384e379 08-Nov-2005 Jesper Juhl <jesper.juhl@gmail.com> [NET]: kfree cleanup

From: Jesper Juhl <jesper.juhl@gmail.com>

This is the net/ part of the big kfree cleanup patch.

Remove pointless checks for NULL prior to calling kfree() in net/.

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Arnaldo Carvalho de Melo <acme@conectiva.com.br>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
idp/core.c
a6e0eb3791dcefc6dd4db53a23de5cfb18fe9a97 29-Oct-2005 Al Viro <viro@ftp.linux.org.uk> [PATCH] bluetooth hidp is broken on s390

Bluetooth HIDP selects INPUT and it really needs it to be there - module
depends on input core. And input core is never built on s390...

Marked as broken on s390, for now; if somebody has better ideas, feel
free to fix it and remove dependency...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
idp/Kconfig
84860bf0644d7c45afe7ddbd30731c3e3c371fae 28-Oct-2005 Linus Torvalds <torvalds@g5.osdl.org> Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6
dd7f5527b3e68a7b2f715ae1a21164383f418013 28-Oct-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Update security filter for Extended Inquiry Response

This patch updates the HCI security filter with support for the Extended
Inquiry Response (EIR) feature.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_sock.c
6516455d3b42b33759a33a8102c1b8b48af4d9c9 28-Oct-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Make more functions static

This patch makes another bunch of functions static.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
f_bluetooth.c
ci_core.c
408c1ce2716c7a004851c93f9f9dcf3d763bc240 28-Oct-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Move CRC table into RFCOMM core

This patch moves rfcomm_crc_table[] into the RFCOMM core, because there
is no need to keep it in a separate file.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/Makefile
fcomm/core.c
fcomm/crc.c
34abf91f4036c01669e298e649b7ba85cadf82eb 15-Sep-2005 Dmitry Torokhov <dtor_core@ameritech.net> [PATCH] Input: convert net/bluetooth to dynamic input_dev allocation

Input: convert net/bluetooth to dynamic input_dev allocation

This is required for input_dev sysfs integration

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
idp/core.c
dd0fc66fb33cd610bc1a5db8a5e232d34879b4d7 07-Oct-2005 Al Viro <viro@ftp.linux.org.uk> [PATCH] gfp flags annotations - part 1

- added typedef unsigned int __nocast gfp_t;

- replaced __nocast uses for gfp flags with gfp_t - it gives exactly
the same warnings as far as sparse is concerned, doesn't change
generated code (from gcc point of view we replaced unsigned int with
typedef) and documents what's going on far better.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2cap.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
354d28d5f8546e115ebaae9311897f0bc4b6a8d4 13-Sep-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Prevent RFCOMM connections through the RAW socket

This patch adds additional checks to prevent RFCOMM connections be
established through the RAW socket interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/sock.c
21d9e30ed020d24336cc3bee2a4e04da232ed554 13-Sep-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add support for extended inquiry responses

This patch adds the handling of the extended inquiry responses and
inserts them into the inquiry cache.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
a61bbcf28a8cb0ba56f8193d512f7222e711a294 15-Aug-2005 Patrick McHardy <kaber@trash.net> [NET]: Store skb->timestamp as offset to a base timestamp

Reduces skb size by 8 bytes on 64-bit.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
ci_event.c
ci_sock.c
0d48d93947dd9ea21c5cdc76a8581b06a4a39281 10-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Move packet type into the SKB control buffer

This patch moves the usage of packet type into the SKB control
buffer. After this patch it is now possible to shrink the sk_buff
structure and redefine its pkt_type.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_core.c
ci_event.c
ci_sock.c
2eb25a6c34504254760e67172f7518d6bfdd7676 10-Aug-2005 Victor Fusco <victor@cetuc.puc-rio.br> [Bluetooth]: Fix sparse warnings (__nocast type)

This patch fixes the sparse warnings "implicit cast to nocast type"
for the priority or gfp_mask parameters of the memory allocations.

Signed-off-by: Victor Fusco <victor@cetuc.puc-rio.br>
Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2cap.c
fcomm/core.c
fcomm/sock.c
fcomm/tty.c
co.c
3a5e903c09aed19ca4a1bb26d87b8d6461a93818 10-Aug-2005 J. Suter <jsuter@hardwave.de> [Bluetooth]: Implement RFCOMM remote port negotiation

This patch implements the remote port negotiation (RPN) of the RFCOMM
protocol for Bluetooth.

Signed-off-by: J. Suter <jsuter@hardwave.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/core.c
fcomm/tty.c
7b9eb9e2099f6f4acd6a36bcd7820d27c3cf5ee3 10-Aug-2005 Timo Ter�s <ext-timo.teras@nokia.com> [Bluetooth]: Call tty_hangup() when DCD is de-asserted

The RFCOMM layer does not handle properly the de-assertation
of CD signal. It should call tty_hangup() to work properly.

Signed-off-by: Timo Ter�s <ext-timo.teras@nokia.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
fcomm/tty.c
85a1e930bf628700e8e9c166b1f5c1c26d3651cc 10-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Track page scan repetition mode changes

The HCI page scan repetition mode change event contains the actual
page scan repetition mode for the remote device. It is the same
value that is received from an inquiry response and it can be used
to make further reconnections faster.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_event.c
45bb4bf08b9c16122af84d3f26a018c8022b24e5 10-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth]: Workaround for inquiry results with RSSI and page scan mode

This patch implements a workaround for buggy Bluetooth 1.2 devices from
Silicon Wave. Their inquiry results with RSSI contain the page scan mode
field. This field was removed in the final Bluetooth 1.2 specification.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ci_event.c
576c7d858f36cab6110b29db7b53964d5132cf30 06-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Add direction and timestamp to stack internal events

This patch changes the direction to incoming and adds the timestamp
to all stack internal events.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_event.c
66e8b6c31b9254243afaac8af4135e84e11dd38e 06-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Remove unused functions and cleanup symbol exports

This patch removes the unused bt_dump() function and it also removes
its BT_DMP macro. It also unexports the hci_dev_get(), hci_send_cmd()
and hci_si_event() functions.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
ci_core.c
ci_event.c
ib.c
dcc365d8f28d6a2332fa37e64d669858a8d017e8 06-Aug-2005 Marcel Holtmann <marcel@holtmann.org> [Bluetooth] Revert session reference counting fix

The fix for the reference counting problem of the signal DLC introduced
a race condition which leads to an oops. The reason for it is not fully
understood by now and so revert this fix, because the reference counting
problem is not crashing the RFCOMM layer and its appearance it rare.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
fcomm/core.c
b03efcfb2180289718991bb984044ce6c5b7d1b0 08-Jul-2005 David S. Miller <davem@davemloft.net> [NET]: Transform skb_queue_len() binary tests into skb_queue_empty()

This is part of the grand scheme to eliminate the qlen
member of skb_queue_head, and subsequently remove the
'list' member of sk_buff.

Most users of skb_queue_len() want to know if the queue is
empty or not, and that's trivially done with skb_queue_empty()
which doesn't use the skb_queue_head->qlen member and instead
uses the queue list emptyness as the test.

Signed-off-by: David S. Miller <davem@davemloft.net>
mtp/core.c
idp/core.c
fcomm/sock.c
fcomm/tty.c
b453257f057b834fdf9f4a6ad6133598b79bd982 26-Apr-2005 Al Viro <viro@www.linux.org.uk> [PATCH] kill gratitious includes of major.h under net/*

A lot of places in there are including major.h for no reason whatsoever.
Removed. And yes, it still builds.

The history of that stuff is often amusing. E.g. for net/core/sock.c
the story looks so, as far as I've been able to reconstruct it: we used
to need major.h in net/socket.c circa 1.1.early. In 1.1.13 that need
had disappeared, along with register_chrdev(SOCKET_MAJOR, "socket",
&net_fops) in sock_init(). Include had not. When 1.2 -> 1.3 reorg of
net/* had moved a lot of stuff from net/socket.c to net/core/sock.c,
this crap had followed...

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
f_bluetooth.c
nep/sock.c
mtp/capi.c
mtp/core.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
idp/core.c
idp/sock.c
2cap.c
fcomm/sock.c
co.c
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 17-Apr-2005 Linus Torvalds <torvalds@ppc970.osdl.org> Linux-2.6.12-rc2

Initial git repository build. I'm not bothering with the full history,
even though we have it. We can create a separate "historical" git
archive of that later if we want to, and in the meantime it's about
3.2GB when imported into git - space that would just make the early
git days unnecessarily complicated, when we don't have a lot of good
infrastructure for it.

Let it rip!
config
akefile
f_bluetooth.c
nep/Kconfig
nep/Makefile
nep/bnep.h
nep/core.c
nep/netdev.c
nep/sock.c
mtp/Kconfig
mtp/Makefile
mtp/capi.c
mtp/cmtp.h
mtp/core.c
mtp/sock.c
ci_conn.c
ci_core.c
ci_event.c
ci_sock.c
ci_sysfs.c
idp/Kconfig
idp/Makefile
idp/core.c
idp/hidp.h
idp/sock.c
2cap.c
ib.c
fcomm/Kconfig
fcomm/Makefile
fcomm/core.c
fcomm/crc.c
fcomm/sock.c
fcomm/tty.c
co.c