Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetoot...

diff --combined drivers/bluetooth/ath3k.c
index a83b57e57b6370572d53325638355a0d94ce24bf,4aef96b0eb637f8136a2262c0a56c8001a7ea106..f98380648cb3513fe47ac19213ce0b105a0d1873
--- 1/drivers/bluetooth/ath3k.c
--- 2/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@@ -82,7 -82,6 +82,7 @@@ static const struct usb_device_id ath3k
        { USB_DEVICE(0x04CA, 0x3004) },
        { USB_DEVICE(0x04CA, 0x3005) },
        { USB_DEVICE(0x04CA, 0x3006) },
 +      { USB_DEVICE(0x04CA, 0x3007) },
        { USB_DEVICE(0x04CA, 0x3008) },
        { USB_DEVICE(0x04CA, 0x300b) },
        { USB_DEVICE(0x0930, 0x0219) },
@@@ -132,7 -131,6 +132,7 @@@ static const struct usb_device_id ath3k
        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 +      { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
@@@ -193,9 -191,10 +193,10 @@@ static int ath3k_load_firmware(struct u
        sent += 20;
        count -= 20;
  
+       pipe = usb_sndbulkpipe(udev, 0x02);
+ 
        while (count) {
                size = min_t(uint, count, BULK_SIZE);
-               pipe = usb_sndbulkpipe(udev, 0x02);
                memcpy(send_buf, firmware->data + sent, size);
  
                err = usb_bulk_msg(udev, pipe, send_buf, size,

diff --combined net/bluetooth/6lowpan.c
index 73492b91105ac0aba10aec738415128d0582bfc5,d906016f3c6bd5219cbc23e175681044a444f199..8796ffa08b43b4f57ae1485f4a5867c0f532807c
--- 1/net/bluetooth/6lowpan.c
--- 2/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@@ -27,7 -27,7 +27,7 @@@
  
  #include "6lowpan.h"
  
 -#include "../ieee802154/6lowpan.h" /* for the compression support */
 +#include <net/6lowpan.h> /* for the compression support */
  
  #define IFACE_NAME_TEMPLATE "bt%d"
  #define EUI64_ADDR_LEN 8
@@@ -420,12 -420,18 +420,18 @@@ static int conn_send(struct l2cap_conn 
        return 0;
  }
  
- static void get_dest_bdaddr(struct in6_addr *ip6_daddr,
-                           bdaddr_t *addr, u8 *addr_type)
+ static u8 get_addr_type_from_eui64(u8 byte)
  {
-       u8 *eui64;
+       /* Is universal(0) or local(1) bit,  */
+       if (byte & 0x02)
+               return ADDR_LE_DEV_RANDOM;
  
-       eui64 = ip6_daddr->s6_addr + 8;
+       return ADDR_LE_DEV_PUBLIC;
+ }
+ 
+ static void copy_to_bdaddr(struct in6_addr *ip6_daddr, bdaddr_t *addr)
+ {
+       u8 *eui64 = ip6_daddr->s6_addr + 8;
  
        addr->b[0] = eui64[7];
        addr->b[1] = eui64[6];
@@@ -433,16 -439,19 +439,19 @@@
        addr->b[3] = eui64[2];
        addr->b[4] = eui64[1];
        addr->b[5] = eui64[0];
+ }
  
-       addr->b[5] ^= 2;
+ static void convert_dest_bdaddr(struct in6_addr *ip6_daddr,
+                               bdaddr_t *addr, u8 *addr_type)
+ {
+       copy_to_bdaddr(ip6_daddr, addr);
  
-       /* Set universal/local bit to 0 */
-       if (addr->b[5] & 1) {
-               addr->b[5] &= ~1;
-               *addr_type = ADDR_LE_DEV_PUBLIC;
-       } else {
-               *addr_type = ADDR_LE_DEV_RANDOM;
-       }
+       /* We need to toggle the U/L bit that we got from IPv6 address
+        * so that we get the proper address and type of the BD address.
+        */
+       addr->b[5] ^= 0x02;
+ 
+       *addr_type = get_addr_type_from_eui64(addr->b[5]);
  }
  
  static int header_create(struct sk_buff *skb, struct net_device *netdev,
@@@ -473,9 -482,11 +482,11 @@@
                /* Get destination BT device from skb.
                 * If there is no such peer then discard the packet.
                 */
-               get_dest_bdaddr(&hdr->daddr, &addr, &addr_type);
+               convert_dest_bdaddr(&hdr->daddr, &addr, &addr_type);
  
-               BT_DBG("dest addr %pMR type %d", &addr, addr_type);
+               BT_DBG("dest addr %pMR type %s IP %pI6c", &addr,
+                      addr_type == ADDR_LE_DEV_PUBLIC ? "PUBLIC" : "RANDOM",
+                      &hdr->daddr);
  
                read_lock_irqsave(&devices_lock, flags);
                peer = peer_lookup_ba(dev, &addr, addr_type);
@@@ -556,7 -567,7 +567,7 @@@ static netdev_tx_t bt_xmit(struct sk_bu
        } else {
                unsigned long flags;
  
-               get_dest_bdaddr(&lowpan_cb(skb)->addr, &addr, &addr_type);
+               convert_dest_bdaddr(&lowpan_cb(skb)->addr, &addr, &addr_type);
                eui64_addr = lowpan_cb(skb)->addr.s6_addr + 8;
                dev = lowpan_dev(netdev);
  
@@@ -564,8 -575,10 +575,10 @@@
                peer = peer_lookup_ba(dev, &addr, addr_type);
                read_unlock_irqrestore(&devices_lock, flags);
  
-               BT_DBG("xmit from %s to %pMR (%pI6c) peer %p", netdev->name,
-                      &addr, &lowpan_cb(skb)->addr, peer);
+               BT_DBG("xmit %s to %pMR type %s IP %pI6c peer %p",
+                      netdev->name, &addr,
+                      addr_type == ADDR_LE_DEV_PUBLIC ? "PUBLIC" : "RANDOM",
+                      &lowpan_cb(skb)->addr, peer);
  
                if (peer && peer->conn)
                        err = send_pkt(peer->conn, netdev->dev_addr,
@@@ -620,13 -633,13 +633,13 @@@ static void set_addr(u8 *eui, u8 *addr
        eui[6] = addr[1];
        eui[7] = addr[0];
  
-       eui[0] ^= 2;
- 
-       /* Universal/local bit set, RFC 4291 */
+       /* Universal/local bit set, BT 6lowpan draft ch. 3.2.1 */
        if (addr_type == ADDR_LE_DEV_PUBLIC)
-               eui[0] |= 1;
+               eui[0] &= ~0x02;
        else
-               eui[0] &= ~1;
+               eui[0] |= 0x02;
+ 
+       BT_DBG("type %d addr %*phC", addr_type, 8, eui);
  }
  
  static void set_dev_addr(struct net_device *netdev, bdaddr_t *addr,
@@@ -634,7 -647,6 +647,6 @@@
  {
        netdev->addr_assign_type = NET_ADDR_PERM;
        set_addr(netdev->dev_addr, addr->b, addr_type);
-       netdev->dev_addr[0] ^= 2;
  }
  
  static void ifup(struct net_device *netdev)
@@@ -684,13 -696,6 +696,6 @@@ static int add_peer_conn(struct l2cap_c
  
        memcpy(&peer->eui64_addr, (u8 *)&peer->peer_addr.s6_addr + 8,
               EUI64_ADDR_LEN);
-       peer->eui64_addr[0] ^= 2; /* second bit-flip (Universe/Local)
-                                  * is done according RFC2464
-                                  */
- 
-       raw_dump_inline(__func__, "peer IPv6 address",
-                       (unsigned char *)&peer->peer_addr, 16);
-       raw_dump_inline(__func__, "peer EUI64 address", peer->eui64_addr, 8);
  
        write_lock_irqsave(&devices_lock, flags);
        INIT_LIST_HEAD(&peer->list);

diff --combined net/bluetooth/hci_event.c
index 3454807a40c53df7e720543e90ab4208d9e0afc2,df7895e8fcc8007977119a69230346a4c0465f99..1096e4cd12833387313c7b5da3dd7698b3faad32
--- 1/net/bluetooth/hci_event.c
--- 2/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@@ -1453,6 -1453,7 +1453,7 @@@ static int hci_outgoing_auth_needed(str
         * is requested.
         */
        if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
+           conn->pending_sec_level != BT_SECURITY_FIPS &&
            conn->pending_sec_level != BT_SECURITY_HIGH &&
            conn->pending_sec_level != BT_SECURITY_MEDIUM)
                return 0;
@@@ -3076,7 -3077,8 +3077,8 @@@ static void hci_link_key_request_evt(st
                }
  
                if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
-                   conn->pending_sec_level == BT_SECURITY_HIGH) {
+                   (conn->pending_sec_level == BT_SECURITY_HIGH ||
+                    conn->pending_sec_level == BT_SECURITY_FIPS)) {
                        BT_DBG("%s ignoring key unauthenticated for high security",
                               hdev->name);
                        goto not_found;
@@@ -3448,12 -3450,6 +3450,12 @@@ static void hci_key_refresh_complete_ev
        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
        if (!conn)
                goto unlock;
 +
 +      /* For BR/EDR the necessary steps are taken through the
 +       * auth_complete event.
 +       */
 +      if (conn->type != LE_LINK)
 +              goto unlock;
  
        if (!ev->status)
                conn->sec_level = conn->pending_sec_level;

diff --combined net/bluetooth/l2cap_core.c
index dc4d301d3a728ccd0af8efe4e9648b843d598406,746848229c8537d02137b112e514d0eaad6e30e2..6eabbe05fe54fe8ecc39707a05350439d99ce830
--- 1/net/bluetooth/l2cap_core.c
--- 2/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -471,8 -471,14 +471,14 @@@ void l2cap_chan_set_defaults(struct l2c
        chan->max_tx = L2CAP_DEFAULT_MAX_TX;
        chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
        chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
+       chan->remote_max_tx = chan->max_tx;
+       chan->remote_tx_win = chan->tx_win;
        chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
        chan->sec_level = BT_SECURITY_LOW;
+       chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+       chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+       chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+       chan->conf_state = 0;
  
        set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
  }
@@@ -7519,9 -7525,9 +7525,9 @@@ int __init l2cap_init(void
        l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
                                            NULL, &l2cap_debugfs_fops);
  
 -      debugfs_create_u16("l2cap_le_max_credits", 0466, bt_debugfs,
 +      debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
                           &le_max_credits);
 -      debugfs_create_u16("l2cap_le_default_mps", 0466, bt_debugfs,
 +      debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
                           &le_default_mps);
  
        bt_6lowpan_init();

diff --combined net/bluetooth/l2cap_sock.c
index ef5e5b04f34fbd3c130c74dc2a41ffe775870b3b,34d62348084d829892fd8231155dd335363a2194..ade3fb4c23bce81aa054e2bdd064f74019767dae
--- 1/net/bluetooth/l2cap_sock.c
--- 2/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@@ -1180,13 -1180,16 +1180,16 @@@ static struct l2cap_chan *l2cap_sock_ne
        /* Check for backlog size */
        if (sk_acceptq_is_full(parent)) {
                BT_DBG("backlog full %d", parent->sk_ack_backlog);
+               release_sock(parent);
                return NULL;
        }
  
        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
                              GFP_ATOMIC);
-       if (!sk)
+       if (!sk) {
+               release_sock(parent);
                return NULL;
+         }
  
        bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
  
@@@ -1271,7 -1274,7 +1274,7 @@@ static void l2cap_sock_teardown_cb(stru
  
                if (parent) {
                        bt_accept_unlink(sk);
 -                      parent->sk_data_ready(parent, 0);
 +                      parent->sk_data_ready(parent);
                } else {
                        sk->sk_state_change(sk);
                }
@@@ -1327,7 -1330,7 +1330,7 @@@ static void l2cap_sock_ready_cb(struct 
        sk->sk_state_change(sk);
  
        if (parent)
 -              parent->sk_data_ready(parent, 0);
 +              parent->sk_data_ready(parent);
  
        release_sock(sk);
  }
@@@ -1340,7 -1343,7 +1343,7 @@@ static void l2cap_sock_defer_cb(struct 
  
        parent = bt_sk(sk)->parent;
        if (parent)
 -              parent->sk_data_ready(parent, 0);
 +              parent->sk_data_ready(parent);
  
        release_sock(sk);
  }