Remove duplicate controls.xml file, which should reside in v4l, not media/v4l
Bluetooth: Wait for wcnss to be ready after SSR

After subsystem restart (SSR), it takes about 10 sec
for wcnss to get ready to accept commands from the
host. If the BT radio is accessed before that, wcnss
can go into bad state.

CRs-fixed: 360858
Change-Id: I5b5c723802311f14b29311372d9d5435eccf583d
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit 2a39b80e9cf53fcef57304d88260abac4c03a851)
Bluetooth: hci_core: fix NULL-pointer dereference at unregister

commit 94324962066231a938564bebad0f941cd2d06bb2 upstream.

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
   eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
   hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[   79.627136] INFO: trying to register non-static key.
[   79.632354] the code is fine but needs lockdep annotation.
[   79.638122] turning off the locking correctness validator.
[   79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
[   79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
[   79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
[   79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[   79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[   79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[   79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[   79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[   79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.723358] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   79.756011] pgd = cf3b4000
[   79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[   79.765502] Internal error: Oops: 80000007 [#1]
[   79.770294] Modules linked in:
[   79.773529] CPU: 0    Tainted: G        W     (3.3.0-rc6-00002-gb5d5c87 #421)
[   79.781066] PC is at 0x0
[   79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[   79.788787] pc : [<00000000>]    lr : [<c0040aa4>]    psr: 60000113
[   79.788787] sp : cf281ee0  ip : 00000000  fp : cf280000
[   79.800903] r10: 00000004  r9 : 00000100  r8 : b6f234d0
[   79.806427] r7 : c0519c28  r6 : cf093488  r5 : c0561a00  r4 : 00000000
[   79.813323] r3 : 00000000  r2 : c054eee0  r1 : 00000001  r0 : 00000000
[   79.820190] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   79.827728] Control: 10c5387d  Table: 8f3b4019  DAC: 00000015
[   79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[   79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[   79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[   79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[   79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[   79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[   79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[   79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[   79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[   79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[   79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[   79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[   79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[   79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[   79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[   79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.973083] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.997161] Code: bad PC value
[   80.000396] ---[ end trace 6f6739840475f9ee ]---
[   80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bluetooth : Ignore incomming events when the hci device is down

In error conditions Adapter state machine via Bluez tries to reset
the hci device, during that in some rare scenario if some pending event
comes from riva, the command complete apis tries to access some already
freed memory in reset sequence.

CRs-fixed: 369658
Signed-off-by: Bhasker Neti <bneti@codeaurora.org>
(cherry picked from commit 6f4ceb1f8588aec11b4d9380cd328d0008c8d167)

Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
(cherry picked from commit d686446400fd0a5645ff2d1e1b9f0249748ce5f8)

Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
(cherry picked from commit 69c592dd2a4b3ea95fe82970737bbbd2da8588b7)

Change-Id: Ic4cb65d405a4928b5a45aaad9c1d8ad1f6e67907
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
Bluetooth : hidp: Get the valid hci_conn while unlink

Since the context where unlink will be called is unaware of
validity of hci_conn pointer, fetch the valid hci_conn
before unlink.

CRs-fixed: 370274
Signed-off-by: Mallikarjuna GB <gbmalli@codeaurora.org>
(cherry picked from commit f411769619b631aa0d9f7d460bcfec4ff3e6f54a)

Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
(cherry picked from commit fce25f117ec7ea4296f550f8ed819dc517f89172)

Signed-off-by: Sunil Joseph <sunilj@codeaurora.org>
(cherry picked from commit 025e910a412c9f5d2e8d247e69afdb3041706a3a)

Change-Id: I60c9024c1c27d18ee2852166eed03a4c8593ca88
Signed-off-by: Shruthi Krishna <skrish@codeaurora.org>
Bluetooth: hidp: use dest address from session info

While hid device unpair process, we are trying to access released
socket as apart of getting hci device which results a kernel panic.

CRs-fixed: 387164
Signed-off-by: Ram Mohan Korukonda <rkorukon@codeaurora.org>
(cherry picked from commit 27e77d2bda65c96815cb5f785df9ffd7bd733e6a)

Change-Id: Ic4359adf41c3da4effba25856169629787b5f7e0
Signed-off-by: Sivasri Kumar Vanka <sivasri@codeaurora.org>
Bluetooth: Disable sniff when the subrate values doesnt match.

Found there is possibility of sniff subrate collision with some
IOT devices. When this collision happned if the remote device
send subrate values that doesn't match with DUT supported
values exit sniff mode. This will allow DUT to reconfigure
sniff after idle time.

CRs-fixed: 380811
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit a7c3d7e6d905bab198003f16316971ae872eec9f)

Change-Id: Ibe3d02c6a404bbce677c7d980f0ad124e31bca26
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: fix shutdown on SCO sockets

shutdown should wait for SCO link to be properly disconnected before
detroying the socket, otherwise an application using the socket may
assume link is properly disconnected before it really happens which
can be a problem when e.g synchronizing profile switch.

CRs-fixed: 365445
Signed-off-by: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit 2e02b861173406a1287a53ca7b836a4ad5fd4255)

Change-Id: Icc38e940f8008d908077dbdea16bc5c6420d1371
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Block SCO disconnect operation on BT_CLOSED state.

Have maximum blocking time for shutdown operation as DISCONNECT_TIMEOUT.
During this period when SCO connection closes, the userspace will be
updated on the close operation. Existing approach of immidiate return
on shutdown call can cause synchronization issues on SCO state between
kernel and userspace. This happens when disconnect operation takes
more time at kernel space.

CRs-fixed: 365445
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit f799996e309cad545b3a7f84ef6f333a09c8b876)

Change-Id: Ifa74d2568d2ee157a605a405017d4cc0f05d41fc
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
bluetooth: Add support for LE conn param

Added support to let the userspace know about the updated
LE connection parameters. On receiving successful connection
complete and connection parameters update event from the BT
Controller, send a mgmt event to the userspace bluetoothd.

CRs-fixed: 380271
Change-Id: If8c3d785188e0d4f38c7431d01c016f399137408
Signed-off-by: Sunny Kapdi <sunnyk@codeaurora.org>
(cherry picked from commit a42b50244cdb71f93bf842a28b0fc1cecc622c55)
Bluetooth: Prevents update of Low Energy connection parameters

The start encryption command fails when the LE update
connection parameters request is pending.
Hence, prevent the update of LE connection parameters during the
bonding process. The update of connection parameters is
not necessary during bonding process.

CRs-fixed: 380257
Change-Id: I41cb3998fecc2297d61ec97d66ac35a0bd41ca80
Signed-off-by: Subramanian Srinivasan <subrsrin@codeaurora.org>
Bluetooth: Send Disconnection reason to Bluez

Send device disconnection reason to bluez on receiving the
diconnection complete event so that low energy profiles
such as proximity can decide to reconnect if the reason
is link loss.

CRs-fixed: 378240
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
(cherry picked from commit da09d26a75ee1c7c1911dcfbe0128fd09f6631f4)

Change-Id: I5fb2041c34922dab95a483b3409553d3be5b5042
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>