linux.git/net/bluetooth, branch v2.6.33

Bluetooth: Keep a copy of each HID device's report descriptor

2010-02-05T17:50:05+00:00

The report descriptor is read by user space (via the Service
Discovery Protocol), so it is only available during the ioctl
to connect. However, the HID probe function that needs the
descriptor might not be called until a specific module is
loaded. Keep a copy of the descriptor so it is available for
later use.

Signed-off-by: Michael Poole 
Signed-off-by: Marcel Holtmann

Bluetooth: Enter active mode before establishing a SCO link.

2010-02-04T03:10:59+00:00

When in sniff mode with a long interval time (1.28s) it can take 4+ seconds
to establish a SCO link. Fix by requesting active mode before requesting
SCO connection. This improves SCO setup time to ~500ms.

Bluetooth headsets that use a long interval time, and exhibit the long
SCO connection time include Motorola H790, HX1 and H17. They have a
CSR 2.1 chipset.

Verified this behavior and fix with host Bluetooth chipsets: BCM4329 and
TI1271.

2009-10-13 14:17:46.183722 > HCI Event: Mode Change (0x14) plen 6
    status 0x00 handle 1 mode 0x02 interval 2048
    Mode: Sniff
2009-10-13 14:17:53.436285 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
    handle 1 voice setting 0x0060
2009-10-13 14:17:53.445593 > HCI Event: Command Status (0x0f) plen 4
    Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-10-13 14:17:57.788855 > HCI Event: Synchronous Connect Complete 0x2c) plen 17
    status 0x00 handle 257 bdaddr 00:1A:0E:F1:A4:7F type eSCO
    Air mode: CVSD

Signed-off-by: Nick Pelly 
Signed-off-by: Marcel Holtmann

Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket

2010-02-04T00:28:44+00:00

When processing a RFCOMM UA frame when the socket is closed and we were
not the RFCOMM initiator would cause rfcomm_session_put() to be called
twice during rfcomm_process_rx(). This would cause a kernel panic in
rfcomm_session_close() then.

This could be easily reproduced during disconnect with devices such as
Motorola H270 that send RFCOMM UA followed quickly by L2CAP disconnect
request. This trace for this looks like:

2009-09-21 17:22:37.788895 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 20 pf 1 ilen 0 fcs 0x7d
2009-09-21 17:22:37.906204 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:37.933090 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 20 pf 1 ilen 0 fcs 0x57
2009-09-21 17:22:38.636764 < ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0041 len 4 [psm 3]
     RFCOMM(s): DISC: cr 0 dlci 0 pf 1 ilen 0 fcs 0x9c
2009-09-21 17:22:38.744125 > HCI Event: Number of Completed Packets (0x13) plen 5
   handle 1 packets 1
2009-09-21 17:22:38.763687 > ACL data: handle 1 flags 0x02 dlen 8
   L2CAP(d): cid 0x0040 len 4 [psm 3]
     RFCOMM(s): UA: cr 0 dlci 0 pf 1 ilen 0 fcs 0xb6
2009-09-21 17:22:38.783554 > ACL data: handle 1 flags 0x02 dlen 12
   L2CAP(s): Disconn req: dcid 0x0040 scid 0x0041

Avoid calling rfcomm_session_put() twice by skipping this call
in rfcomm_recv_ua() if the socket is closed.

Signed-off-by: Nick Pelly 
Signed-off-by: Marcel Holtmann

Bluetooth: Fix sleeping function in RFCOMM within invalid context

2010-02-03T23:52:18+00:00

With the commit 9e726b17422bade75fba94e625cd35fd1353e682 the
rfcomm_session_put() gets accidentially called from a timeout
callback and results in this:

BUG: sleeping function called from invalid context at net/core/sock.c:1897
in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper
Pid: 0, comm: swapper Tainted: P           2.6.32 #31
Call Trace:
   [] __might_sleep+0xf8/0xfa
 [] lock_sock_nested+0x29/0xc4
 [] lock_sock+0xb/0xd [l2cap]
 [] l2cap_sock_shutdown+0x1c/0x76 [l2cap]
 [] ? clockevents_program_event+0x75/0x7e
 [] ? tick_dev_program_event+0x37/0xa5
 [] l2cap_sock_release+0x27/0x67 [l2cap]
 [] sock_release+0x1a/0x67
 [] rfcomm_session_del+0x34/0x53 [rfcomm]
 [] rfcomm_session_put+0x14/0x16 [rfcomm]
 [] rfcomm_session_timeout+0xe/0x1a [rfcomm]
 [] run_timer_softirq+0x1e2/0x29a
 [] ? rfcomm_session_timeout+0x0/0x1a [rfcomm]
 [] __do_softirq+0xfe/0x1c5
 [] ? timer_interrupt+0x1a/0x21
 [] call_softirq+0x1c/0x28
 [] do_softirq+0x33/0x6b
 [] irq_exit+0x36/0x85
 [] do_IRQ+0xa6/0xbd
 [] ret_from_intr+0x0/0xa
   [] ? acpi_idle_enter_bm+0x269/0x294
 [] ? acpi_idle_enter_bm+0x25f/0x294
 [] ? cpuidle_idle_call+0x97/0x107
 [] ? cpu_idle+0x53/0xaa
 [] ? rest_init+0x7a/0x7c
 [] ? start_kernel+0x389/0x394
 [] ? x86_64_start_reservations+0xac/0xb0
 [] ? x86_64_start_kernel+0xe4/0xeb

To fix this, the rfcomm_session_put() needs to be moved out of
rfcomm_session_timeout() into rfcomm_process_sessions(). In that
context it is perfectly fine to sleep and disconnect the socket.

Signed-off-by: Marcel Holtmann 
Tested-by: David John

Bluetooth: Fallback eSCO to SCO on error 0x1a (Unsupported Remote Feature)

2010-02-03T20:05:01+00:00

General Motors carkits that use LGE BT chipsets return this error code
when an eSCO is attempted, despite advertising eSCO support.

2009-08-13 14:41:39.755518 < HCI Command: Setup Synchronous Connection (0x01|0x0028) plen 17
   handle 1 voice setting 0x0060
2009-08-13 14:41:39.757563 > HCI Event: Command Status (0x0f) plen 4
   Setup Synchronous Connection (0x01|0x0028) status 0x00 ncmd 1
2009-08-13 14:41:39.789484 > HCI Event: Synchronous Connect Complete (0x2c) plen 17
   status 0x1a handle 257 bdaddr 00:1E:B2:23:5E:B3 type eSCO
   Error: Unsupported Remote Feature / Unsupported LMP Feature

Signed-off-by: Jaikumar Ganesh 
Signed-off-by: Nick Pelly 
Signed-off-by: Marcel Holtmann

Bluetooth: Use the control channel for raw HID reports

2010-01-30T13:57:39+00:00

In commit 2da31939a42f7a676a0bc5155d6a0a39ed8451f2, support
for Bluetooth hid_output_raw_report was added, but it pushes
the data to the interrupt channel instead of the contol one.

This patch makes hid_output_raw_report use the control channel
instead. Using the interrupt channel was a mistake.

Signed-off-by: Bastien Nocera 
Signed-off-by: Marcel Holtmann

Bluetooth: Fix memory leak in L2CAP

2010-01-30T13:57:20+00:00

Move skb_clone after error confition check so it is not going
potentially out of the scope.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Remove double free of SKB pointer in L2CAP

2010-01-30T13:57:11+00:00

Trivial fix for double free of SKB pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Fix L2CAP locking scheme regression

2009-12-17T20:07:25+00:00

When locking was introduced the error path branch was not taken
into account. Error was found in sparse code checking. Kudos to
Jani Nikula.

Signed-off-by: Andrei Emeltchenko 
Acked-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Ack L2CAP I-frames before retransmit missing packet

2009-12-17T20:06:23+00:00

Moving the Ack to before l2cap_retransmit_frame() we can avoid the
case where txWindow is full and the packet can't be retransmited.

Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann