h5_reset_rx is unconditionally called at the end of
h5_complete_rx_pkt, no need to call it anymore after
that.
Signed-off-by: Loic Poulain <loic.poulain@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

When the current LE connection parameters of a slave connection do not
match up with the controller defined values, then trigger the connection
update procedure to allow adjusting them.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

For all incoming LE connections, the minimum and maximum connection
interval is a value that should be copied from the controller default
values. This allows to properly check if the resulting connection
interval of a newly established connection is in the range we are
expecting.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

When the LE controller changes its connection parameters, it will send
a connection parameter update event. Make sure that the new set of
parameters are stored in hci_conn struct and thus will properly update
the previous values retrieved from the connection complete event.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

The LE connection parameters are needed later on to be able to decide
if it is required to trigger connection update procedures. So when the
connection has been established successfully, store the current used
parameters in hci_conn struct.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

When the module is unloaded, unregister the network device
so that the system does not try to access non-existing device.
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Count how many 6LoWPAN connections there exists so that we
do not unload the module if there are still connections alive.
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Instead of adding the 6LoWPAN functionality to Bluetooth module,
we create a separate kernel module for it.

Usage:

In the slave side do this:

$ modprobe bluetooth_6lowpan
$ echo 62 > /sys/kernel/debug/bluetooth/6lowpan_psm
$ hciconfig hci0 leadv

In the master side do this:

$ modprobe bluetooth_6lowpan
$ echo 62 > /sys/kernel/debug/bluetooth/6lowpan_psm
$ echo 'connect E0:06:E6:B7:2A:73 1' > \
                  /sys/kernel/debug/bluetooth/6lowpan_control

The 6LoWPAN functionality can be controlled by psm value. If it
is left to 0, then the module is disabled and all the 6LoWPAN
connections are dropped if there were any. In the above example,
the psm value is just an example and not a real value for
6LoWPAN service. The real psm value is yet to be defined in
Bluetooth specification.

The 6lowpan controlling interface is a temporary solution
until the specifications are ready.
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Create a CoC dynamically instead of one fixed channel for communication
to peer devices.
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The highly optimized TX path for L2CAP channels and its fragmentation
within the HCI ACL packets requires to copy data from user provided
IO vectors and also kernel provided memory buffers.

This patch allows channel clients to provide a memcpy_fromiovec callback
to keep this optimized behavior, but adapt it to kernel vs user memory
for the TX path. For all kernel internal L2CAP channels, a default
implementation is provided that can be referenced.

In case of A2MP, this fixes a long-standing issue with wrongly accessing
kernel memory as user memory.

This patch originally by Marcel Holtmann.
Signed-off-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

All the special settings configured via debugfs are either developer
only options or temporary solutions. To not clutter the standard flags,
move them to their own dbg_flags entry.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

When the rename of STK_SLAVE to simply STK happened we missed this place
in the ltk_type_master function. Now, checking for master is as simple
as checking whether the type is SMP_LTK. The helper function is kept
around for better readability in the (right now three) callers and for
simpler extension with new key types in the future.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Tested-by: Lukasz Rymanowski <lukasz.rymanowski@tieto.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The valid range of IO capabilities for the Set IO Capability and Pair
Device mgmt commands is 0-4 (4 being the KeyboarDisplay capability for
SMP). We should return an invalid parameters error if user space gives
us a value outside of this range.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Fixed a coding style issue. Removed trailing whitespaces in
drivers/bluetooth/Kconfig.
Signed-off-by: Stephan Gabert <stephan.gabert@fau.de>
Signed-off-by: Nicolas Pfeiffer <nicolas.pfeiffer@fau.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Since the SMP code needs to swap ordering of variable length buffers add
a convenience function that can be used for any length buffer.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

There's no reason to have explicit values for these flags. Convert them
to an enum to be consistent with other similar flags.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

These defines were probably put in to track authenticated vs
unauthenticated LTKs, however since the LTK struct has a separate
boolean authenticated member these were never used.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The LTK type has really nothing to do with HCI so it makes more sense to
have these in smp.h than hci.h. This patch moves the defines to smp.h
and removes the HCI_ prefix in the same go.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

We never store the "master" type of STKs since we request encryption
directly with them so we only need one STK type (the one that's
looked-up on the slave side). Simply remove the unnecessary define and
rename the _SLAVE one to the shorter form.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

The smp_chan_create function may return NULL, e.g. in the case of memory
allocation failure, so we always need to check for this.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

Since the whole HCI command, event and data packet processing has been
migrated to use workqueues instead of tasklets, it makes sense to use
struct delayed_work instead of struct timer_list for the timeout
handling. This patch converts the hdev->cmd_timer to use workqueue
as well.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

When allocating the L2CAP SKB for transmission, provide the upper layers
with a clear distinction on what is the header and what is the body
portion of the SKB.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

The struct l2cap_ctrl fields are wasting an unsigned int when all the
bits can fit into an __u8 field.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

The SKB for L2CAP sockets are all allocated in a central callback
in the socket support. Instead of having to pass around the socket
priority all the time, assign it to skb->priority when actually
allocating the SKB.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

The struct l2cap_ops field should not allow any modifications and thus
it is better declared as const.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

Invoking usb_sndbulkpipe() on same pipe for same purpose only once is
enough.
Signed-off-by: Adam Lee <adam8157@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

This adds some cores with 0x2057 radio which will be supported soon as
well as core 40 that I missed in the earlier firmware patch.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

It doesn't include any device (radio revision) specific code yet, so it
isn't really usable. As the commit says, it's just some generic code.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Enable initialization and update calibration code to fix:
b43-phy0 ERROR: Radio 0x2057 rcal timeout
b43-phy0 debug: Radio 0x2057 rccal timeout
b43-phy0 debug: Radio 0x2057 rccal timeout
b43-phy0 ERROR: Radio 0x2057 rcal timeout
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

There are several exit path from the PCI probe function.
Some of them, that are taken in case of errors, forget to set the "err"
variable, that is returned by the probe function.
This can lead to the kernel thinking the probe function succeeds while it
didn't, and this in turn causes extra calls to the "remove" function.

This patch fix this problem by ensuring "err" variable is assigned to a proper
non-zero value in each exit path.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

All boards supported by this driver could work using PIO or MMIO for accessing
registers.
This driver tries to access HW by using MMIO, and, if this fails for somewhat
reason, the driver tries to fall back to PIO mode.

MMIO-mode is straightforward on all boards.
PIO-mode is straightforward on rtl8180 only.

On rtl8185 and rtl8187se boards not all registers are directly available in PIO
mode (they are paged).

On rtl8185 there are two pages and it is known how to switch page.
PIO mode works, except for only one access to a register out of default page,
recently added by me in the initialization code with patch:
rtl818x_pci: Fix rtl8185 excessive IFS after CTS-to-self
This can be easily fixed to work in both cases (MMIO and PIO).

On rtl8187se, for a number of reasons, there is much more work to do to fix PIO
access.
PIO access is currently broken on rtl8187se, and it never worked.

This patch fixes the said register write for rtl8185 and makes the driver to
fail cleanly if PIO mode is attempted with rtl8187se boards.

While doing this, I converted also a couple of printk(KERN_ERR) to dev_err(), in
order to make checkpatch happy.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Currently the driver configures mac80211 to provide two rates for each TX frame:
One initial rate and one alternate fallback rate, each one with its retry count.

HW does not support fully this: rtl8180 doesn't have support for rate scaling at
all, and rtl8185/rtl8187SE supports it in a way that does not fit with mac80211:
The HW does automatically fall back to the next lower rate, and only a lower
limit can be specified, so the HW may TX also on rates in between the two rates
specified by mac80211.  Furthermore only the total TX retry count can be
specified for each packet, while the number of TX attempts before scaling rate
can be configured only globally (not per each packet).

Currently the driver sets the HW auto rate fallback mechanism to quickly scale
rate after a couple of retries, and it uses the alternate rate requested by
mac80211 as fallback limit rate (and it does this even wrongly).

The HW indeed will behave differently than what mac80211 mandates, that is
probably undesirable, and the reported TX retry count may not refer to what
mac80211 thinks, and this could fool mac80211.

This patch makes the driver to declare to mac80211 to support only one rate
configuration for each packet, and it does disable the HW auto rate fallback
mechanism, relying only on SW and letting mac80211 to do all by itself.

This should ensure correct operation and fairness respect to mac80211.
Indeed here tests with iperf do not show significant performance differences.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

HW is programmed with wrong retry count value for TX:

Mac80211 passes to driver the number of times the TX should be attempted.
The HW, instead, wants the number of time the TX should be retried if it fails
the first time (assuming we have to TX it at least one time).

This patch correct this.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Rtl8187se support has been added to the rtl818x_pci driver by extracting a lot
of information from a rtl8187se Linux staging driver included in the kernel at
the time rtl8187se support was added.
The rtl818x_pci main file has a comment that advertises this.

Recently this staging driver has been removed from the kernel, but I still feel
it can be useful as "reference" code (in case of bugs, or to implement
improvements in rtl818x_pci driver).

This one-line patch adds a comment in rtl818x_pci driver to point people
searching for that "reference code" to the last kernel version still containing
it (3.14).
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Measuring time between _end_ of CTS-to-self and _end_ of datapacket (with a
prism54 board and mac80211 hacked to let the MAC timestamp stay untouched in the
radiotap header) resulted in about 300uS, while the datapacket itself should be
by far shorter (less than 100uS) and IFS should be SIFS (10uS).
This measure was confirmed whith a scope: about 250uS IFS has been seen between
the two packets.

This situation causes the CTS-to-self protection mechanism to work incorrectly
due to the NAV expiring during, or even before beginning, the packet
transmission, and it also causes the performances to be anyway reduced due to
time waste.

This problem has been seen at every packet TXed with CTS-to-self enabled on
rtl8185 board.
rtl8187se seems not affected (and rtl8180, being a 802.11b card, does not have
CTS-to-self mechaninsm).

This patch fixes this by adding a magic register write, making the board wait
for correct SIFS after CTS-to-self packet.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

BSSID register was written with six byte-writes.
It seems that, similarly to what happens with MAC registers, they needs to be
written with one 16-bit and one 32-bit writes, otherwise the write does not work.

The byte write didn't work only on my rtl8185, while it worked on rtl8180 and
rtl8187se, BTW since there are probably a number of different ASIC revisions out
of there, I let the change to affect all cards.
It shouldn't hurt anyway.
Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

LCNXN is simply a continuation of N, e.g. code handling LCNXN revs 0 and
1 is mostly the same as for N-PHY revs 7+.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Fix checkpatch warning:
WARNING: kfree(NULL) is safe this check is probably not required

Cc: Stanislav Yakovlev <stas.yakovlev@gmail.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Cc: linux-wireless@vger.kernel.org
Signed-off-by: Fabian Frederick <fabf@skynet.be>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

The patch fixes a couple of issues:
- absence of deallocation of rsi_dev->rx_usb_urb[0] in the driver;
- potential NULL pointer dereference because of lack of checks for memory
  allocation success in rsi_init_usb_interface().

By the way, it makes rsi_probe() returning error code instead of 1
and fixes comments regarding returning values.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>