rt2x00: fix possible memory corruption in case of invalid rxdesc.size

Sometimes rxdesc descriptor provided by hardware contains invalid
(random) data. For example rxdesc.size can be bigger than actual
size of the buffer. When this happen rt2x00crypto_rx_insert_iv()
corrupt memory doing memmove outside of buffer boundaries.

Signed-off-by: Stanislaw Gruszka <stf_xl@wp.pl>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: move declarations of chantables functions to correct files

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: N-PHY: update switching analog on/off

Specs were recently updated.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: switch radio to requested channel

Switching channel happens after specific SHM write to B43_SHM_SH_CHAN.
This is the way we found it in BCM4331 MMIO dumps. By comparing with
N-PHY code we noticed there is routing used for SYN and TX/RX.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: add place for implementing channel switching

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: define standard structs for channel switching

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: enable radio

The trick was to find 0x810 PHY reg ops close to analog enabling code.
To find out proper masks and sets, MMIO hacks were used.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: implement killing radio

Closed drivers kill radio right after reading radio version and MACCTL,
so it was easy to find related PHY ops:
 phy_read(0x0810) -> 0x0000
phy_write(0x0810) <- 0x0000
To find out the mask of above OP, MMIO hack was used to fake read val:
 phy_read(0x0810) -> 0xffff
phy_write(0x0810) <- 0x0000

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Merge branch 'master' of /linux/kernel/git/padovan/bluetooth-next-2.6

Bluetooth: Fix not setting the chan state

When the connection is ready we should set the connection
to CONNECTED so userspace can use it.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Merge /linux/kernel/git/padovan/bluetooth-2.6

Conflicts:
net/bluetooth/l2cap_core.c

rtlwifi: rtl8192{c,ce,cu,se}: Remove comparisons of booleans with true

These are a potential source of confusion, as most C code treats all
non-zero values as true.

Signed-off-by: Mike McCormack <mikem@ring3k.org>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: rtl8192cu: Remove unused parameter

rtl_ps_set_rf_state's protect_or_not parameter is not set to
true anywhere, except for commented out code.

It enables some legacy locking code, which is no longer used,
so delete the parameter and the old locking code.

Signed-off-by: Mike McCormack <mikem@ring3k.org>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

rtlwifi: Fix typo in variable name

offchan_deley should be offchan_delay

Signed-off-by: Mike McCormack <mikem@ring3k.org>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

bcma: clean exports of functions

Function managing IRQs is needed for external drivers like b43.
On the other side we do not expect writing any hosts drivers outside of
bcma, so this is safe to do not export functions related to this.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: add missing ieee80211_free_hw() on unload in AHB code

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: free sc->ah in ath5k_deinit_softc

Nothing else is freeing it, and this mirrors the error handling path
already in ath5k_init_softc.

https://bugzilla.kernel.org/show_bug.cgi?id=37592

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reported-by: Tsyvarev Andrey <tsyvarev@ispras.ru>

bcma: fix BCM43224 rev 0 workaround

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

bcma: enable support for 14e4:4357 (BCM43225)

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k_hw: make sure PAPRD training is properly done

checking the status of PAPRD_AGC2_POWER(Log(ADC_power) measured after
last gain-change in dB) field suggests whether the PAPRD is completely/properly
done. This is an additional check apart from polling for PAPRD done bit being set.
        Susinder suggests that the ideal power range value should be
0xf0 to 0xfe. With AR9382 we do have the values in this range. to have a
common check for all platforms we take agc2_power should be atleast greater
than 0xe0

Cc: susinder@qca.qualcomm.com
Cc: senthilb@qca.qualcomm.com
Cc: kmuthusa@qca.qualcomm.com
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qca.qualcomm.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Fix a corner case failure in sending PAPRD frames in HT40

when the AP is configured with HT40/2.4GHz and when PAPRD is enabled in station
we have PAPRD training frames never sent out because of the following
failure "PAPRD target power delta out of range". This consistently happens
in channel 10,11 in Over The Air testing and rarely in channel 6 under wired
setup.
        the reason behind this issue is all the HT40 rates target power
are 0 when we operate in channel 10/11 at 2.4GHz

Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: quiesce vif before suspending

Cancel all relevant timers/works before suspending (wowlan).

This patch handles the following warning:
WARNING: at net/mac80211/util.c:565 queueing ieee80211 work while going to suspend
Backtrace:
[<bf07b598>] (ieee80211_can_queue_work+0x0/0x4c [mac80211])
[<bf07c28c>] (ieee80211_queue_work+0x0/0x30 [mac80211])
[<bf0690dc>] (ieee80211_sta_timer+0x0/0x3c [mac80211])
[<c00a3008>] (run_timer_softirq+0x0/0x220)
[<c009e530>] (__do_softirq+0x0/0x130)
[<c009e660>] (irq_exit+0x0/0xb4)
[<c004c4a0>] (ipi_timer+0x0/0x4c)
[<c0046350>] (do_local_timer+0x0/0x88)
[<c00488ec>] (cpu_idle+0x0/0xe0)
[<c05294e8>] (rest_init+0x0/0xe0)
[<c0008958>] (start_kernel+0x0/0x314)

Signed-off-by: Eliad Peller <eliad@wizery.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Bluetooth: Remove useless access to the socket

We already have access to the chan, we don't have to access the
socket to get its imtu.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Fix crash when setting a LE socket to ready

We should not try to do any other type of configuration for
LE links when they become ready.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Merge branch 'wireless-next-2.6' of git://git./linux/kernel/git/iwlwifi/iwlwifi-2.6

rtlwifi: include mac80211.h from core.h

core.h references ieee80211_ops but doesn't include mac80211.h, which issues
a warning once mac80211-compat.h is taken into use.

Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@adurom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

zd1211rw: include mac80211.h from zd_chip.h

zd_chip.h contains one function with a pointer to ieee80211_hw but doesn't
include mac80211.h. As a temporary solution include mac80211.h to avoid
a warning.

Signed-off-by: Kalle Valo <kvalo@adurom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlwifi: fix stop/wake queue hacks

The hacks break once mac80211-compat.h is taken into use. Fix it by adding
an ifdef check.

Signed-off-by: Kalle Valo <kvalo@adurom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlegacy: fix stop/wake queue hacks

The hacks break once mac80211-compat.h is taken into use. Fix it by adding
an ifdef check.

Signed-off-by: Kalle Valo <kvalo@adurom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlagn: remove incorrect define

Remove unused and incorrect EEPROM define

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: merge duplicate code into single function

Same operation needed by multiple devices, move to single function.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: code alignment

Code alignment, no functional changes.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add offset define for subsystem id

Add offset define for subsystem id in EEPROM

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: Add power_level module parameter

Add power_level module parameter to set the default power save level.
Power save level has range from 1 - 5, default power save level is 1.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add power_save module parameter

Add power_save module parameter to enable power management if needed
Default power management is disabled.

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: store the irq number to iwl_bus just like dev

Since the irq number is just an unsigned int, store it inside iwl_bus
instead of calling the get_irq ops every time it is needed.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: warn about nested SYNC commands

Since there is no protection around SYNC host command mechanism, at least WARN
when collision happens between two SYNC host comamnds. I am not sure there is a
real  issue (beyond the HCMD_ACTIVE flag maintenance) with having two SYNC host
commands at the same time, but at least now, we will know about it.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: fix misplaced bracket

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: waterfall the bus level if prepare card failed

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: finally kill the pointer to pci_dev from iwl-dev.h

All pci related stuff is in iwl-pci.c.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add a get_irq method to iwl_bus_ops and use it

In order to remove a few more dereference to priv->pdev that will be killed
[Asoon, there is now a method to get the IRQ number.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: don't read the PCI_REVISION_ID from iwl-agn.c

The PCI_REVISION_ID is read and printed in iwl_pci_probe anyway using pr_info

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add a method to get the HW ID description as a string to iwl_bus_ops

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: move PCI power related functions to the PCI layer

Continue to popule the PCI layer and the iwl_bus_ops with the power related
stuff.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: don't use the PCI wrappers for DMA operation

Get a pointer to the struct device during probe and get the rid of all the PCI
specific DMA wrappers.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: move PCI related operations from probe and remove to PCI layer

Since we have now a PCI layer, all the init and deinit code that is PCI
related should move to there.

Also move the IO functions: read8/read32/write32. They need hw_base which
is killed from priv.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add get_dev to iwl_bus_ops

Bus specific layer must know how to return the struct device* of the device.
Implement that as a callback of iwl_bus_ops and use that callback instead of
using the priv->pdev pointer which is meant to disappear soon.

Since the struct device * is needed in hot path, iwl_bus holds a pointer to it
instead of calling get_dev all the time.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: introduce iwl_bus and iwl_bus_ops

iwl_bus will represent a bus, and iwl_bus_ops all the operations that can be
done on this bus.
For the moment only set_prv_data is implemented. More to come...

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: remove uneeded include to pci.h and dma_mapping.h from a few files

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add a iwl_pci.[ch] files that will contain all PCI specific code

Move some PCI functionality to the new iwl_pci.[ch] files:
* the PCI_DEVICE_TABLE
* the pci_driver struct definition
* the PCI probe / remove functions
* the PCI suspend / resume functions

All these functions are now split: the trigger comes from the PCI layer which
calls to the bus generic code located in the other files.

This is the beginning only. There are still a lot of PCI related code needs
to be gathered.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: don't disable interrupts after the NIC has been reset

It is superfluous to disable the interrupts after we reset the NIC. The only
entity that could enable the interrupts after the NIC is reset is the driver.
So remove this pointless action.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: Support flush queues for specified interface

Flush command can target specified interface or all interfaces

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: add PAN to tx flush

When issue tx flush, also consider PAN

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

iwlagn: Remove un-necessary indirect call

After driver split, no need to make indirect call to txfifo flush function

Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>

Bluetooth: Fix locking in blacklist code

There was no unlock call on the errors path

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

b43: HT-PHY: implement switching analog

Turning it on is always done between reading PHY version and radio
version, so it was easy to find it in MMIO dumps from ndiswrapper.
Turning off is done by writing different values to the same registers.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: implement radio ops

Every PHY has some specific bit used for reading radio regs. Analyze of
MMIO dumps from BCM4331 and ndiswrapper has shown it is 0x200 for HT.
 radio_read(0x037f) -> 0x0073
radio_write(0x017f) <- 0x0072

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: annotate reg in ath5k_hw_nic_reset() as __iomem

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath5k: minor cleanup

Move an extern variable declaration to a header file.  Prefix all
functions with "ath5k_".  Make ath5k_intr() static.  Remove unneeded
forward declarations.  Remove pointless "extern" in a function
declaration.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: typo fix in a comment

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: use standard max(), remove A_MAX macro

Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: remove a redundant call to pcipowersave

during suspend/resume ath9k_stop will always call ath_radio_disable
which will inturn call ath9k_hw_configpcipowersave, so no need to call
it explicitly in ath9k_stop

Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

iwlegacy: fix up brokenness caused by cleanup

Patch 7f1f9742514 "iwlegacy: refactor iwl4965_mac_channel_switch"
reversed a test and also it changed a spin_lock_irq() to
spin_lock().  I assume the spin_lock change was a mistake because
the unlock was left as spin_unlock_irq().

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

ath9k: Add debug messages to track PAPRD failures

Add few debug messages for some of the possible scenarios
where we can detect PAPRD failures. this will help us to be
sure that we had really enabled PAPRD

Cc: susinder@qca.qualcomm.com
Cc: senthilb@qca.qualcomm.com
Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: add Kconfig option for compiling SSB driver

It is always "y" for now, b43 will not compile without CONFIG_SSB yet.
This is just a first step of dropping SSB dependency.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

if_spi: Fix compilation warning - unused variable

if_spi: Fix compilation warning - unused variable 'spi'

drivers/net/wireless/libertas/if_spi.c: In function ‘if_spi_init_card’:
drivers/net/wireless/libertas/if_spi.c:1035: warning: unused variable ‘spi’

The variable is used only in a macro which uses the args only for DEBUG builds.
Remove the 'spi' variable completely.

Signed-off-by: Nikanth Karthikesan <nikanth@google.com>
Acked-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: HT-PHY: add place for writing HT PHY support

This is totally broken plus we do not have specs for HT PHY yet. Just
introduce place for writing driver if we discover anything.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

b43: define new PHYs and radio regs for cores >= 24

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: add cancel_hw_scan() callback

When suspending, __ieee80211_suspend() calls ieee80211_scan_cancel(),
which will only cancel sw scan. In order to cancel hw scan, the
low-level driver has to cancel it in the suspend() callback. however,
this is too late, as a new scan_work will be enqueued (while the driver
is going into suspend).

Add a new cancel_hw_scan() callback, asking the driver to cancel an
active hw scan, and call it in ieee80211_scan_cancel().

Signed-off-by: Eliad Peller <eliad@wizery.com>
Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/ssb/driver_chipcommon_pmu.c: uninitilized warning

warning message
drivers/ssb/driver_chipcommon_pmu.c: In function ssb_pmu_resources_init
drivers/ssb/driver_chipcommon_pmu.c:420:15: warning: updown_tab_size may
be used uninitilized in this function.

updown_tab_size and depend_tab_size may not be set in the bus->chip_id
switch statement, so set to 0 by default to avoid using uninitialized
stack space.

Signed-off-by: Connor Hansen <cmdkhh@gmail.com>
Signed-off-by: Michael Buesch <m@bues.ch>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

mac80211: Start monitor work on restart

Trigger connection monitor on resume from suspend.  Since we
have been sleeping, there is reason to suspect that we might
not still be associated.  The speed of detecting loss of
{connection,authentication} is worth the cost of the small
additional traffic at resume.

Signed-off-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Bluetooth: Use bit operations on conn_state

Instead of setting bits manually we use set_bit, test_bit, etc.
Also remove L2CAP_ prefix from macros.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: use bit operation on conf_state

Instead of making the bit operations manually, we now use set_bit,
test_bit, etc.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add blacklisting support for mgmt interface

Management interface commands for blocking and unblocking devices.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Move blacklisting functions to hci_core

Move blacklisting functions to hci_core.c, so that they can
be used by both management interface and hci socket interface.

Signed-off-by: Antti Julku <antti.julku@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Fix L2CAP connection establishment

In hci_conn_security ( which is used during L2CAP connection
establishment ) test for HCI_CONN_ENCRYPT_PEND state also
sets this state, which is bogus and leads to connection time-out
on L2CAP sockets in certain situations (especially when
using non-ssp devices )

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add key size checks for SMP

This patch implements a check in smp cmd pairing request and pairing
response to verify if encryption key maximum size is compatible in both
slave and master when SMP Pairing is requested. Keys are also masked to
the correct negotiated size.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for SMP timeout

This patch adds support for disconnecting the link when SMP procedure
takes more than 30 seconds.

SMP begins when either the Pairing Request command is sent or the
Pairing Response is received, and it ends when the link is encrypted
(or terminated). Vol 3, Part H Section 3.4.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Fix accepting connect requests for defer_setup

When authentication completes we shouldn't blindly accept any pending
L2CAP connect requests. If the socket has the defer_setup feature
enabled it should still wait for user space acceptance of the connect
request. The issue only happens for non-SSP connections since with SSP
the L2CAP Connect request may not be sent for non-SDP PSMs before
authentication has completed successfully.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: fix missing parameter for HCI_OP_DISCONNECT

The "dc" variable is initialized but not passed to hci_send_cmd().

Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Bruna Moreira <bruna.moreira@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for Pairing features exchange

This patch implements a simple version of the SMP Pairing Features
exchange procedure (Vol. 3 Part H, Section 2.3.5.1).

For now, everything that would cause a Pairing Method different of
Just Works to be chosen is rejected.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for building pairing commands

Before we are able to do a proper exchange of pairing parameters,
we need a unified way of building pairing requests and responses.

For IO Capability we use the value that was set by userspace,
using the management interface.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Update the security level when link is encrypted

If the pending security level is greater than the current security
level and the link is now encrypted, we should update the link
security level.

This is only useful for LE links, when the only event generated
when SMP is sucessful in the Encrypt Change event.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Fix initial security level of LE links

As the default security level (BT_SECURITY_SDP) doesn't make sense for
LE links, initialize LE links with something that makes sense.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for resuming socket when SMP is finished

This adds support for resuming the user space traffic when SMP
negotiation is complete.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Remove debug statements

Now that these commands are sent to the controller we can use hcidump
to verify that the correct values are produced.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for LE Start Encryption

This adds support for starting SMP Phase 2 Encryption, when the initial
SMP negotiation is successful. This adds the LE Start Encryption and LE
Long Term Key Request commands and related events.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add SMP confirmation checks methods

This patch includes support for generating and sending the random value
used to produce the confirmation value.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add SMP confirmation structs

This patch adds initial support for verifying the confirmation value
that the remote side has sent.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add LE SMP Cryptoolbox functions

This patch implements SMP crypto functions called ah, c1, s1 and e.
It also implements auxiliary functions. All These functions are needed
for SMP keys generation.

Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Signed-off-by: Bruna Moreira <bruna.moreira@openbossa.org>
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add support for using the crypto subsystem

This will allow using the crypto subsystem for encrypting data. As SMP
(Security Manager Protocol) is implemented almost entirely on the host
side and the crypto module already implements the needed methods
(AES-128), it makes sense to use it.

There's now a new module option to enable/disable SMP support.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add simple SMP pairing negotiation

This implementation only exchanges SMP messages between the Host and the
Remote. No keys are being generated. TK and STK generation will be
provided in further patches.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Start SMP procedure

Start SMP procedure for LE connections. This modification intercepts
l2cap received frames and call proper SMP functions to start the SMP
procedure. By now, no keys are being used.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Implement the first SMP commands

These simple commands will allow the SMP procedure to be started
and terminated with a not supported error. This is the first step
toward something useful.

Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Anderson Briglia <anderson.briglia@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Don't forget to check for LE_LINK

Otherwise the wrong error can be returned.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: keep reference if any ERTM timer is enabled

ERTM use the generic L2CAP timer functions to keep a reference to the
channel. This is useful for avoiding crashes.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Make timer functions generic

We now plan to use l2cap_set_timer and l2cap_clear_timer in ERTM timers.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add refcnt to struct l2cap_chan

struct l2cap_chan has now its own refcnt that is compatible with the
socket refcnt, i.e., we won't see sk_refcnt = 0 and chan->refcnt > 0.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: Add state tracking to struct l2cap_chan

Now socket state is tracked by struct sock and channel state is tracked by
chan->state. At this point both says the same, but this is going to change
when we add AMP Support for example.

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>

Bluetooth: add close() callback to l2cap_chan_ops

close() calls l2cap_sock_kill() on l2cap_sock.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>