Bluetooth: Allow headroom in ACL data packets from HCI socket

Need to allocate headroom in ACL data packets destined for the
Qualcomm PAL that are be transmitted via an HCI socket.

The Qualcomm PAL uses extra headroom in skbs to be transmitted to
save a copy when passing to the WLAN driver. This headroom is
allocated by L2CAP. This same headroom must be added for skbs to
be transmitted directly by HCI socket layer. HCI sockets are used
to transmit data during Bluetooth qualification testing.

(cherry picked from commit fc60bda779673ad1cd0d8e5b0bb956fdbedfc413)

Change-Id: I0875e6d29ab6b59689a326516b6c47dfce3e7a97
CRs-fixed: 332866
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
Bluetooth: Fix timeout configuration for AMP channels

When doing L2CAP configuration, use the correct retransmit and monitor
timeouts when configuring (or reconfiguring) AMP channels. The host
stack needs to use the timeouts read from incoming configuration
responses, and write appropriate timeouts when sending configuration
responses.

(cherry picked from commit 966dcfae8213ddfd2b291f4c54aab9778f6d1ef1)

Change-Id: I568b358cbdd8600696a6fbe54b524a902c794bf4
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Bluetooth: Ensure full A2MP msg is pulled from skb

Ensure the full A2MP Get Info Response message is pulled from the
skb when the status is not SUCCESS. Also fix similiar scenario in
Get AMP Assoc and remove unneeded check for mismatched id's.

CRs-fixed: 335076
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
(cherry picked from commit 02a952a76115095865e3adeae4b465738d53dab0)

Change-Id: Iea03c037aea3ef56525d5099d4884d29e6315f5e
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
Bluetooth: Reading remote device lmp_version from controller.

On ACL connection complete with a remote device, the remote
device lmp version should be available with Controller. The
current change is to read this information from controller to
host and update to bluez userspace through management APIs.

CRs-fixed: 336687
Signed-off-by: Srinivas Krovvidi <skrovvid@codeaurora.org>
(cherry picked from commit d352b26f74591cac89bf4d501d78efcdc88a5ca3)

Change-Id: Id1840e886ccf5cc7934f252fbbd92d3dc2c88e0b
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>

Conflicts:

	include/net/bluetooth/hci_core.h
	include/net/bluetooth/mgmt.h
	net/bluetooth/mgmt.c
modified for HTC Amaze kernel by faux123
Bluetooth: Require streaming mode when it is requested for a socket

The L2CAP specification has two ways to support streaming mode: Allow
fallback to ERTM or basic mode when the remote device requests one of
those modes, or make the connection fail unless both sides agree on
streaming mode.

The current code does not properly support either method.  This change
makes a streaming mode connection fail if the remote device does not
also request streaming mode.

CRs-fixed: 336291
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
(cherry picked from commit 0ac143698695cedeffb3a29621d859bd507f8127)

Change-Id: Iae86019e3ced47f395d7b86187d8deee83c32a8a
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
Bluetooth: Return empty mask for wrong link type in connect_ind

For every incoming connection, both l2cap_connect_ind and
sco_connect_ind are called.  One will always have a mismatched link
type (which is expected), the incoming link will be either L2CAP or
SCO but both connect_ind functions get called anyway.  If the incoming
link is an L2CAP link, sco_connect_ind should return 0 so it doesn't
set any mask bits.  Similarly, an incoming SCO link should make
l2cap_connect_ind return 0.

(cherry picked from commit 8b51dd4677358b57970d88ea41519d726318d71c)

Change-Id: Ibddea307615600088f2de8987bc1d74a60d7d307
CRs-fixed: 336437
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Bluetooth: Increased the LE connection supervision timeout

Increased the LE supervision timeout to 10 seconds
so that concurrent operations can be performed with LE
connection.

(cherry picked from commit d6d25e19625bc63335113c6d50ba55cad23bb03a)

Change-Id: Iabf25d2921caba99c2a8573604a2b31ed7a7de37
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
Bluetooth: Fix LE Connection refcnts

Some rebalancing of refcnts due to issues found during testing:

Refcnt was not being released on security completion, if local side
was paired but the remote side had deleted the pairing info, and then
the re-pair failed to complete successfully.

Additionally, the refcnt was not held-released properly if pairing
was initiated due to the client socket being opened with security
level elevated from the start.

CRs-fixed: 335993
Signed-off-by: Brian Gix <bgix@codeaurora.org>
(cherry picked from commit 80fb3a9e8c39e62f0628a79f2144e0c63ee99c23)

Change-Id: I5ca3197cebc3cf63a924c6e7dfef9445d2284462
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
Bluetooth: Fix ATT MTU size to 23

We only support a 23 octet MTU, so auto-respond to all
MTU change requests with the 23 octet response.

CRs-fixed: 336025
Signed-off-by: Brian Gix <bgix@codeaurora.org>
(cherry picked from commit 8217b269884d5fbd0f617d82f66b73302248a6e5)

Change-Id: I96679815a6e3bd48d578c83c16684de37f308c3c
Signed-off-by: Srivalli Oguri <oguri@codeaurora.org>
Signed-off-by: Zhoulu Luo <zluo@codeaurora.org>
Bluetooth: Block incoming commands from mgmtops when hci device is down

Even after the device is down, some hci commands are getting queued in
some scenarios, since there is no command queue purge mechanism in the
initialization sequence, so the immediate device up initialization
sequence is messed up with unexpected commands.
The current change blocks some of the hci commands to get queued if the
device is down and also purges the queue in the beginning of the next
device initialization sequence.

CRs-fixed: 336160
Signed-off-by: Bhasker Neti <bneti@codeaurora.org>
(cherry picked from commit a6e6a4f0572876fc92aeb83701d447944415bfe8)

Change-Id: Ibddec4b29a09df836ec226f8ec710ad8d1f9d7a3
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: LE sockets not ready until encrypted

If encryption fails during socket setup, the L2CAP channel should not
be marked as Ready until after re-pairing takes place.

CRs-fixed: 335988 336029
Signed-off-by: Brian Gix <bgix@codeaurora.org>
(cherry picked from commit 416db905111658907ec331f08dd50cd75172f575)

Change-Id: I43ff86130dd49116de1022cfb85574f9efe974c5
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Use seperate socket for LE ATT Server

Because traffic between the local GATT client(s) and
remote servers are subject to different controls than
remote clients and the local server, all on the shared
fixed CID, it is important to manage the traffic on
seperate sockets.

CRs-fixed: 336029
Signed-off-by: Brian Gix <bgix@codeaurora.org>
(cherry picked from commit 20de7cfdbcd6dc7d9dd27ff55654b439164cb984)

Change-Id: Icc272323a53f630f22481fd2dcd5fd581fea7bc9
Signed-off-by: Ramakrishna Prasad N <crpn@codeaurora.org>
Bluetooth: Skip ERTM queue processing when there are receive errors

An application may call recv() on a disconnected socket if the
connection has unexpectedly dropped.  In this case, the socket may
still exist, but it will be in an error state and the L2CAP connection
will be mostly torn down.

A crash was observed when the ERTM code attempted to send an ACK when
the L2CAP connection was not up.  If the error state is detected and
ERTM queue processing is skipped, then the crash is avoided and the
recv() call just returns an error in userspace.

CRs-fixed: 336000
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
(cherry picked from commit 28eb3fab3577414b3088123a9e5dfc2b83a9e2c4)

Change-Id: I44cf5930291f58d36f30a1c182d566f926b4a032
Signed-off-by: Yen-Pin Hsiao <yphsiao@codeaurora.org>
Bluetooth: Handle error command status for AUTH_REQUESTED command

When AUTH_REQUESTED command status is error status, do the bonding
cleanup, so that there will not be any problem for next time
pairing process and in user space.

CRs-fixed: 331126
Signed-off-by: Prabhakaran Mc <prabhakaranmc@codeaurora.org>
(cherry picked from commit 7953ca7e408486efc37022da76f4a77742b3437d)

Change-Id: Iaa56720ccc7ee7e0997b506d29f476e126362c6d
Signed-off-by: Yen-Pin Hsiao <yphsiao@codeaurora.org>
Bluetooth: Fix null pointer dereference

CRs-fixed: 340541
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
(cherry picked from commit 2850a82059dfed90cecae027112f9e8ae0b5a435)

Change-Id: I4b2a7d902e552dc4d9fc1f2c712f13c1fec3f7e7
Signed-off-by: Zhoulu Luo <zluo@codeaurora.org>
Bluetooth: Lock sockets when closing HCI device

When a Bluetooth device is powered down while RFCOMM connections are
open, there are race conditions where RFCOMM tries to use an HCI
connection after the data structures have been deleted.  Since the
powerdown procedure runs in process context, it is possible to lock
sockets before accessing them to close connections.  This change adds
that locking, which will serialize socket access between processors
during powerdown.

CRs-fixed: 336893
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
(cherry picked from commit 3b9239a8f435f80a07364fdaefb5490197fb1079)

Change-Id: Ib60748e380b16b640be94ac6bc575c23748b0114
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Bluetooth: Set security level based on remote device features.

Connection security level is modified based on remote device's
extended feature. Deciding SSP capability of remote device
by EIR response is incorrect, because few BT2.1 devices do not
send EIR and few BT2.1 devices which send EIR do not support
SSP. SSP capability of remote device has to be decided based on
remote_extended_features event. This patch makes sure that
MEDIUM_SECURITY is set for non ssp devices' pairing process.

CRs-fixed: 339166
Signed-off-by: Prabhakaran Mc <prabhakaranmc@codeaurora.org>
(cherry picked from commit 453651c5db2cba83b07331199ce5e35a0f6f057b)

Change-Id: I3c6c90f5e0a8ea2eb5737456ecc07b24a2c44e38
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Bluetooth: Fix L2CAP connection establishment

In hci_conn_security ( which is used during L2CAP connection
establishment ) test for HCI_CONN_ENCRYPT_PEND state also
sets this state, which is bogus and leads to connection time-out
on L2CAP sockets in certain situations (especially when
using non-ssp devices )

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
[mathewm@codeaurora.org: Resolved conflict]
CRs-fixed: 343392
Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
(cherry picked from commit edc44dd5059f7f16a63af462cd1fc48532b8933e)

Change-Id: I9ef864c81eed5b0aaa37683c7dee7f20535ed9e4
Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>
Bluetooth: Poll for RSSI updates from the remote device

This feature is required for implementing Low energy
proximity client immediate alert service. The proximtiy
client registers with the kernel for receiving RSSI updates
of the remote device. The kernel starts polling for RSSI
value using READ_RSSI HCI command and When it reaches
a particular threshold set by the proximity client,
updates are sent to the client.

CRs-fixed: 344936
Signed-off-by: Archana Ramachandran <archanar@codeaurora.org>
(cherry picked from commit 26a752b8a7af75b375ea6322d6819700afe3263f)

Change-Id: I3cddbb00790389ae8f8d8e5ffd7cfcd9ddb0fa4c
Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
(cherry picked from commit c66e9ca52fa8af8663a0be1caa90b887a542d576)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>
(cherry picked from commit cc267c57bec232bf57c91fcd19e3175155e91924)

Signed-off-by: Sudhir Sharma <sudsha@codeaurora.org>

Conflicts:

	include/net/bluetooth/hci_core.h
	net/bluetooth/hci_conn.c
modified for HTC Amaze kernel by faux123
Bluetooth: Fix channel disconnect when logical link already exists

Fix issue where the attempt to move a second OBEX connection onto an
AMP link fails and the connection is disconnected.

When handling a Move when there is an existing Best Effort Logical Link
L2CAP must check for the WAIT_MOVE_CONFIRM and WAIT_MOVE_RSP_SUCESS
states when the logical link completes. In these scenarios the logical
link completes before the Move Confirm or Move Response Success is
received and L2CAP must continue to wait for the confirm or response.

CRs-fixed: 344557

Change-Id: I3e0786f780fa48592bb45ec2e81ae1ffa4a6ab80
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
(cherry picked from commit 4277842742757cc308301e4405a6d976a7a7d47a)

Signed-off-by: Ram Kumar Chakravarthy Chebathini <rcheba@codeaurora.org>