--- /dev/null
+From b0c42cd7b210efc74aa4bfc3e39a2814dfaa9b89 Mon Sep 17 00:00:00 2001
+From: Alexander Aring <alex.aring@gmail.com>
+Date: Wed, 8 Oct 2014 10:24:53 +0200
+Subject: Bluetooth: 6lowpan: fix skb_unshare behaviour
+
+From: Alexander Aring <alex.aring@gmail.com>
+
+commit b0c42cd7b210efc74aa4bfc3e39a2814dfaa9b89 upstream.
+
+This patch reverts commit:
+
+a7807d73 ("Bluetooth: 6lowpan: Avoid memory leak if memory allocation
+fails")
+
+which was wrong suggested by Alexander Aring. The function skb_unshare
+run also kfree_skb on failure.
+
+Signed-off-by: Alexander Aring <alex.aring@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/6lowpan.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -591,17 +591,13 @@ static netdev_tx_t bt_xmit(struct sk_buf
+ int err = 0;
+ bdaddr_t addr;
+ u8 addr_type;
+- struct sk_buff *tmpskb;
+
+ /* We must take a copy of the skb before we modify/replace the ipv6
+ * header as the header could be used elsewhere
+ */
+- tmpskb = skb_unshare(skb, GFP_ATOMIC);
+- if (!tmpskb) {
+- kfree_skb(skb);
++ skb = skb_unshare(skb, GFP_ATOMIC);
++ if (!skb)
+ return NET_XMIT_DROP;
+- }
+- skb = tmpskb;
+
+ /* Return values from setup_header()
+ * <0 - error, packet is dropped
--- /dev/null
+From 3bb30a7cdf9242aca90d49aa41baebf9458f96f0 Mon Sep 17 00:00:00 2001
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+Date: Tue, 25 Nov 2014 20:19:52 +0300
+Subject: Bluetooth: ath3k: Add support of MCI 13d3:3408 bt device
+
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+
+commit 3bb30a7cdf9242aca90d49aa41baebf9458f96f0 upstream.
+
+Add support for Bluetooth MCI WB335 (AR9565) Wi-Fi+bt module. This
+Bluetooth module requires loading patch and sysconfig by ath3k driver.
+
+T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 20 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=13d3 ProdID=3408 Rev= 0.02
+C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
+A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/ath3k.c | 2 ++
+ drivers/bluetooth/btusb.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -105,6 +105,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x13d3, 0x3375) },
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x13d3, 0x3402) },
++ { USB_DEVICE(0x13d3, 0x3408) },
+ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -156,6 +157,7 @@ static const struct usb_device_id ath3k_
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -182,6 +182,7 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
--- /dev/null
+From a4d5504d5c39cc84f1f828e19967595597a8136e Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Wed, 29 Oct 2014 23:37:53 +0100
+Subject: Bluetooth: Clear LE white list when resetting controller
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit a4d5504d5c39cc84f1f828e19967595597a8136e upstream.
+
+The internal representation of the LE white list needs to be cleared
+when receiving a successful HCI_Reset command. A reset of the controller
+is expected to start with an empty LE white list.
+
+When the LE white list is not cleared on controller reset, the passive
+background scanning might skip programming the remote devices. Only
+changes to the LE white list are programmed when passive background
+is started.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -205,6 +205,8 @@ static void hci_cc_reset(struct hci_dev
+ hdev->le_scan_type = LE_SCAN_PASSIVE;
+
+ hdev->ssp_debug_mode = 0;
++
++ hci_bdaddr_list_clear(&hdev->le_white_list);
+ }
+
+ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
--- /dev/null
+From 6a8fc95c87110a466ee81675b41170b963f82bdb Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Wed, 24 Dec 2014 20:43:11 +0200
+Subject: Bluetooth: Fix accepting connections when not using mgmt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 6a8fc95c87110a466ee81675b41170b963f82bdb upstream.
+
+When connectable mode is enabled (page scan on) through some non-mgmt
+method the HCI_CONNECTABLE flag will not be set. For backwards
+compatibility with user space versions not using mgmt we should not
+require HCI_CONNECTABLE to be set if HCI_MGMT is not set.
+
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Tested-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2144,7 +2144,12 @@ static void hci_conn_request_evt(struct
+ return;
+ }
+
+- if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
++ /* Require HCI_CONNECTABLE or a whitelist entry to accept the
++ * connection. These features are only touched through mgmt so
++ * only do the checks if HCI_MGMT is set.
++ */
++ if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
++ !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+ !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
+ BDADDR_BREDR)) {
+ hci_reject_conn(hdev, &ev->bdaddr);
--- /dev/null
+From 0b1db38ca26b322296cbd141f3080eccfe1cc3e1 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 28 Oct 2014 22:23:27 +0100
+Subject: Bluetooth: Fix check for direct advertising
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 0b1db38ca26b322296cbd141f3080eccfe1cc3e1 upstream.
+
+These days we allow simultaneous LE scanning and advertising. Checking
+for whether advertising is enabled or not is therefore not a reliable
+way to determine whether directed advertising was used to trigger the
+connection creation. The appropriate place to check (instead of the hdev
+context) is the connection role that's stored in the hci_conn. This
+patch fixes such a check in le_conn_timeout() which could otherwise lead
+to incorrect HCI commands being sent.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_conn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -415,7 +415,7 @@ static void le_conn_timeout(struct work_
+ * happen with broken hardware or if low duty cycle was used
+ * (which doesn't have a timeout of its own).
+ */
+- if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
++ if (conn->role == HCI_ROLE_SLAVE) {
+ u8 enable = 0x00;
+ hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
+ &enable);
--- /dev/null
+From 8bfe8442ff20fdc2d965c197103d935a99bd3296 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Tue, 23 Dec 2014 23:10:48 +0100
+Subject: Bluetooth: Fix controller configuration with HCI_QUIRK_INVALID_BDADDR
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 8bfe8442ff20fdc2d965c197103d935a99bd3296 upstream.
+
+When controllers set the HCI_QUIRK_INVALID_BDADDR flag, it is required
+by userspace to program a valid public Bluetooth device address into
+the controller before it can be used.
+
+After successful address configuration, the internal state changes and
+the controller runs the complete initialization procedure. However one
+small difference is that this is no longer the HCI_SETUP stage. The
+HCI_SETUP stage is only valid during initial controller setup. In this
+case the stack runs the initialization as part of the HCI_CONFIG stage.
+
+The controller version information, default name and supported commands
+are only stored during HCI_SETUP. While these information are static,
+they are not read initially when HCI_QUIRK_INVALID_BDADDR is set. So
+when running in HCI_CONFIG state, these information need to be updated
+as well.
+
+This especially impacts Bluetooth 4.1 and later controllers using
+extended feature pages and second event mask page.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_event.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -239,7 +239,8 @@ static void hci_cc_read_local_name(struc
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags))
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags))
+ memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
+ }
+
+@@ -494,7 +495,8 @@ static void hci_cc_read_local_version(st
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags)) {
+ hdev->hci_ver = rp->hci_ver;
+ hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
+ hdev->lmp_ver = rp->lmp_ver;
+@@ -513,7 +515,8 @@ static void hci_cc_read_local_commands(s
+ if (rp->status)
+ return;
+
+- if (test_bit(HCI_SETUP, &hdev->dev_flags))
++ if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
++ test_bit(HCI_CONFIG, &hdev->dev_flags))
+ memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
+ }
+
--- /dev/null
+From 980ffc0a2cec2c37589cc97993e1ad17252f4f47 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 28 Oct 2014 22:23:26 +0100
+Subject: Bluetooth: Fix LE connection timeout deadlock
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 980ffc0a2cec2c37589cc97993e1ad17252f4f47 upstream.
+
+The le_conn_timeout() may call hci_le_conn_failed() which in turn may
+call hci_conn_del(). Trying to use the _sync variant for cancelling the
+conn timeout from hci_conn_del() could therefore result in a deadlock.
+This patch converts hci_conn_del() to use the non-sync variant so the
+deadlock is not possible.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_conn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -517,7 +517,7 @@ int hci_conn_del(struct hci_conn *conn)
+ /* Unacked frames */
+ hdev->acl_cnt += conn->sent;
+ } else if (conn->type == LE_LINK) {
+- cancel_delayed_work_sync(&conn->le_conn_timeout);
++ cancel_delayed_work(&conn->le_conn_timeout);
+
+ if (hdev->le_pkts)
+ hdev->le_cnt += conn->sent;
--- /dev/null
+From 36e8164882ca6d3c41cb91e6f09a3ed236841f80 Mon Sep 17 00:00:00 2001
+From: Myron Stowe <myron.stowe@redhat.com>
+Date: Thu, 30 Oct 2014 11:54:37 -0600
+Subject: PCI: Restore detection of read-only BARs
+
+From: Myron Stowe <myron.stowe@redhat.com>
+
+commit 36e8164882ca6d3c41cb91e6f09a3ed236841f80 upstream.
+
+Commit 6ac665c63dca ("PCI: rewrite PCI BAR reading code") masked off
+low-order bits from 'l', but not from 'sz'. Both are passed to pci_size(),
+which compares 'base == maxbase' to check for read-only BARs. The masking
+of 'l' means that comparison will never be 'true', so the check for
+read-only BARs no longer works.
+
+Resolve this by also masking off the low-order bits of 'sz' before passing
+it into pci_size() as 'maxbase'. With this change, pci_size() will once
+again catch the problems that have been encountered to date:
+
+ - AGP aperture BAR of AMD-7xx host bridges: if the AGP window is
+ disabled, this BAR is read-only and read as 0x00000008 [1]
+
+ - BARs 0-4 of ALi IDE controllers can be non-zero and read-only [1]
+
+ - Intel Sandy Bridge - Thermal Management Controller [8086:0103];
+ BAR 0 returning 0xfed98004 [2]
+
+ - Intel Xeon E5 v3/Core i7 Power Control Unit [8086:2fc0];
+ Bar 0 returning 0x00001a [3]
+
+Link: [1] https://git.kernel.org/cgit/linux/kernel/git/tglx/history.git/commit/drivers/pci/probe.c?id=1307ef6621991f1c4bc3cec1b5a4ebd6fd3d66b9 ("PCI: probing read-only BARs" (pre-git))
+Link: [2] https://bugzilla.kernel.org/show_bug.cgi?id=43331
+Link: [3] https://bugzilla.kernel.org/show_bug.cgi?id=85991
+Reported-by: William Unruh <unruh@physics.ubc.ca>
+Reported-by: Martin Lucina <martin@lucina.net>
+Signed-off-by: Myron Stowe <myron.stowe@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Matthew Wilcox <willy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/probe.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -216,14 +216,17 @@ int __pci_read_base(struct pci_dev *dev,
+ res->flags |= IORESOURCE_SIZEALIGN;
+ if (res->flags & IORESOURCE_IO) {
+ l &= PCI_BASE_ADDRESS_IO_MASK;
++ sz &= PCI_BASE_ADDRESS_IO_MASK;
+ mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
+ } else {
+ l &= PCI_BASE_ADDRESS_MEM_MASK;
++ sz &= PCI_BASE_ADDRESS_MEM_MASK;
+ mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
+ }
+ } else {
+ res->flags |= (l & IORESOURCE_ROM_ENABLE);
+ l &= PCI_ROM_ADDRESS_MASK;
++ sz &= PCI_ROM_ADDRESS_MASK;
+ mask = (u32)PCI_ROM_ADDRESS_MASK;
+ }
+
powerpc-powernv-switch-off-mmu-before-entering-nap-sleep-rvwinkle-mode.patch
powerpc-perf-hv-24x7-use-per-cpu-page-buffer.patch
powerpc-add-little-endian-flag-to-syscall_get_arch.patch
+bluetooth-ath3k-add-support-of-mci-13d3-3408-bt-device.patch
+bluetooth-6lowpan-fix-skb_unshare-behaviour.patch
+bluetooth-fix-le-connection-timeout-deadlock.patch
+bluetooth-fix-check-for-direct-advertising.patch
+bluetooth-clear-le-white-list-when-resetting-controller.patch
+bluetooth-fix-controller-configuration-with-hci_quirk_invalid_bdaddr.patch
+bluetooth-fix-accepting-connections-when-not-using-mgmt.patch
+pci-restore-detection-of-read-only-bars.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
