linux/drivers/bluetooth, branch v4.8

Bluetooth: btmrvl: reset is_suspending flag in failure path

2016-07-18T08:13:02Z

is_suspending flag remains on when host sleep fails to enable. Data path is unnecessarily blocked after this. This patch ensures to reset the flag in failure path. Signed-off-by: Amitkumar Karwar Signed-off-by: Marcel Holtmann

Bluetooth: bpa10x: Add support for hci_set_fw_info

2016-07-18T06:33:56Z

The Digianswer sniffer devices allow for reading a firmware specific information string. If it is available, then inform the Bluetooth core about it via hci_set_fw_info. That exposes it via debugfs like this: # cat /sys/kernel/debug/bluetooth/hci0/firmware_info SNIF_102,BB930,02/01/18,10:37:56 Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

drivers: misc: ti-st: Use int instead of fuzzy char for callback status

2016-07-17T17:59:26Z

On mips and parisc: drivers/bluetooth/btwilink.c: In function 'ti_st_open': drivers/bluetooth/btwilink.c:174:21: warning: overflow in implicit constant conversion [-Woverflow] hst->reg_status = -EINPROGRESS; drivers/nfc/nfcwilink.c: In function 'nfcwilink_open': drivers/nfc/nfcwilink.c:396:31: warning: overflow in implicit constant conversion [-Woverflow] drv->st_register_cb_status = -EINPROGRESS; There are actually two issues: 1. Whether "char" is signed or unsigned depends on the architecture. As the completion callback data is used to pass a (negative) error code, it should always be signed. 2. EINPROGRESS is 150 on mips, 245 on parisc. Hence -EINPROGRESS doesn't fit in a signed 8-bit number. Change the callback status from "char" to "int" to fix these. Signed-off-by: Geert Uytterhoeven Acked-by: Mauro Carvalho Chehab Acked-by: Samuel Ortiz Signed-off-by: Marcel Holtmann

Bluetooth: Add support of 13d3:3490 AR3012 device

2016-07-11T22:36:39Z

T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=05 Dev#= 5 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3490 Rev=00.01 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb BugLink: https://bugs.launchpad.net/bugs/1600623 Signed-off-by: Dmitry Tunin Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org

Bluetooth: hci_intel: Remove LPM enabling from setup procedure

2016-07-11T19:57:50Z

LPM can be enabled via a DDC write command at specific DDC ID. As any other DDC value, this is up to the DDC config file to include (or not) the low power mode configuration. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: Rename HCI_BREDR into HCI_PRIMARY

2016-07-09T18:37:13Z

The HCI_BREDR naming is confusing since it actually stands for Primary Bluetooth Controller. Which is a term that has been used in the latest standard. However from a legacy point of view there only really have been Basic Rate (BR) and Enhanced Data Rate (EDR). Recent versions of Bluetooth introduced Low Energy (LE) and made this terminology a little bit confused since Dual Mode Controllers include BR/EDR and LE. To simplify this the name HCI_PRIMARY stands for the Primary Controller which can be a single mode or dual mode controller. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

Bluetooth: btusb: add support for device 0489:e092

2016-07-08T10:20:57Z

With current btusb.ko kernel module, Bluetooth pretends to be active but there is no real activity. I'm using an Acer Aspire VN7-791. Output of lsusb: Bus 003 Device 007: ID 0489:e092 Foxconn / Hon Hai On my laptop, this device is actually used as a combo with wifi chipset Atheros Qualcomm Killer N1525 Wireless-AC [168c:003e], * Fix by adding a declaration in kernel sources drivers/bluetooth/btusb.c { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME }, * Compiled extra module /lib/modules/4.4.0-22-generic/extra/btusb.ko * Successfully tested against my phone (obex file transfer) Signed-off-by: Yvain THONNART Signed-off-by: Marcel Holtmann

Bluetooth: btmrvl: fix slab-out-of-bounds access in btmrvl_sdio

2016-07-08T10:20:57Z

Kasan reported slab-out-of-bounds access in btmrvl_sdio: [ 33.055400] ================================================================== [ 33.062585] BUG: KASAN: slab-out-of-bounds in memcpy+0x24/0x50 at addr ffffffc0d89b4a00 [ 33.070529] Read of size 256 by task btmrvl_main_ser/3576 [ 33.075885] ============================================================================= [ 33.084002] BUG kmalloc-256 (Tainted: G B ): kasan: bad access detected [ 33.091511] ----------------------------------------------------------------------------- [ 33.413498] Call trace: [ 33.415928] [] dump_backtrace+0x0/0x190 [ 33.421288] [] show_stack+0x1c/0x28 [ 33.426305] [] dump_stack+0xa0/0xf8 [ 33.431320] [] print_trailer+0x158/0x16c [ 33.436765] [] object_err+0x48/0x5c [ 33.441780] [] kasan_report+0x344/0x510 [ 33.447141] [] __asan_loadN+0x20/0x150 [ 33.452413] [] memcpy+0x20/0x50 [ 33.457084] [] swiotlb_tbl_map_single+0x2ec/0x310 [ 33.463305] [] map_single+0x24/0x30 [ 33.468320] [] swiotlb_map_sg_attrs+0xec/0x21c [ 33.474286] [] __swiotlb_map_sg_attrs+0x48/0xec [ 33.480339] [] msdc_prepare_data.isra.11+0xf0/0x11c [ 33.486733] [] msdc_ops_request+0x74/0xf0 [ 33.492266] [] __mmc_start_request+0x78/0x8c [ 33.498057] [] mmc_start_request+0x220/0x240 [ 33.503848] [] mmc_wait_for_req+0x78/0x250 [ 33.509468] [] mmc_io_rw_extended+0x2ec/0x388 [ 33.515347] [] sdio_io_rw_ext_helper+0x160/0x268 [ 33.521483] [] sdio_writesb+0x40/0x50 [ 33.526677] [] btmrvl_sdio_host_to_card+0x124/0x1bc [btmrvl_sdio] [ 33.534283] [] btmrvl_service_main_thread+0x384/0x428 [btmrvl] [ 33.541626] [] kthread+0x140/0x158 [ 33.546550] Memory state around the buggy address: [ 33.551305] ffffffc0d89b4980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.558474] ffffffc0d89b4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.565643] >ffffffc0d89b4a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 33.572809] ^ [ 33.579889] ffffffc0d89b4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.587055] ffffffc0d89b4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 33.594221] ================================================================== The cause of this is that btmrvl_sdio_host_to_card can access memory region out of its allocated space due to: 1. the requested block size is smaller than SDIO_BLOCK_SIZE, and/or 2. the allocated memory is not BTSDIO_DMA_ALIGN-aligned. This patch fixes the issue by allocating a buffer which is big enough for SDIO_BLOCK_SIZE transfer and/or BTSDIO_DMA_ALIGN address relocation. Signed-off-by: Ricky Liang Signed-off-by: Marcel Holtmann

Bluetooth: Replace constant hw_variant from Intel Bluetooth firmware filename

2016-07-08T10:20:57Z

The format of Intel Bluetooth firmware filename for bootloader product is ibt--.sfi Currently the driver uses a constant value 11 (0x0b) for hw_variant to support LnP/SfP product. But new product like WsP product has a different value such as 12 (0x0c). To support the multiple products, this patch replaces the constant value of hw_variant to the actual hw_variant value read from the device. Signed-off-by: Tedd Ho-Jeong An Signed-off-by: Marcel Holtmann

Bluetooth: Add support for Intel Bluetooth device 3168 [8087:0aa7]

2016-07-08T10:20:57Z

This patch adds support for Intel Bluetooth device 3168 also known as Sandy Peak (SdP). T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=8087 ProdID=0aa7 Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Tedd Ho-Jeong An Signed-off-by: Marcel Holtmann