The TX power setting is currently per wiphy (hardware
device) but with multi-channel capabilities that doesn't
make much sense any more.

Allow drivers (and mac80211) to advertise support for
per-interface TX power configuration. When the TX power
is configured for the wiphy, the wdev will be NULL and
the driver can still handle that, but when a wdev is
given the TX power can be set only for that wdev now.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Setting the wdev to NULL when the channel can't be
set for that interface type (to treat the channel
setting for the wiphy/monitor) currently works, but
is confusing in the code if netdev/wdev aren't both
set/unset in the same way. Move the check whether
the channel can be set to where it's needed so that
wdev and netdev are always both assigned or NULL.
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

NFC_CMD_LLC_GET_PARAMS: request LTO, RW, and MIUX parameters for a device

NFC_CMD_LLC_SET_PARAMS: set one or more of LTO, RW, and MIUX parameters for
a device. LTO must be set before the link is up otherwise -EINPROGRESS is
returned. RW and MIUX can be set at anytime and will be passed in subsequent
CONNECT and CC messages. If one of the passed parameters is wrong none is
set and -EINVAL is returned.
Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The code to allow EAPOL frames even when the station
isn't yet marked associated needs to check that the
incoming frame is long enough and due to paged RX it
also can't assume skb->data contains the right data,
it must use skb_copy_bits(). Fix this to avoid using
data that doesn't really exist.

Cc: stable@vger.kernel.org
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

A number of places in the mesh code don't check that
the frame data is present and in the skb header when
trying to access. Add those checks and the necessary
pskb_may_pull() calls. This prevents accessing data
that doesn't actually exist.

To do this, export ieee80211_get_mesh_hdrlen() to be
able to use it in mac80211.

Cc: stable@vger.kernel.org
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

Due to pskb_may_pull() checking the skb length, all
non-management frames are checked on input whether
their 802.11 header is fully present. Also add that
check for management frames and remove a check that
is now duplicate. This prevents accessing skb data
beyond the frame end.

Cc: stable@vger.kernel.org
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The mesh header can have address extension by a 4th
or a 5th and 6th address, but never both. Drop such
frames in 802.11 -> 802.3 conversion along with any
frames that have the wrong extension.

Cc: stable@vger.kernel.org
Reviewed-by: NJavier Cardona <javier@cozybit.com>
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The 'ssid' field of the cfg80211_ibss_params is a u8 pointer and
its length is likely to be less than IEEE80211_MAX_SSID_LEN most
of the time.

This patch fixes the ssid copy in ieee80211_ibss_join() by using
the SSID length to prevent it from reading beyond the string.

Cc: stable@vger.kernel.org
Signed-off-by: NAntonio Quartulli <ordex@autistici.org>
[rewrapped commit message, small rewording]
Signed-off-by: NJohannes Berg <johannes.berg@intel.com>

The Tx queues are no longer valid when we receive a disconnection or when
the LLCP link goes down. In the later case we also purge the entire local
Tx queue.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This config item has not carried much meaning for a while now and is
almost always enabled by default. As agreed during the Linux kernel
summit, remove it.
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This config item has not carried much meaning for a while now and is
almost always enabled by default. As agreed during the Linux kernel
summit, remove it.
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This config item has not carried much meaning for a while now and is
almost always enabled by default. As agreed during the Linux kernel
summit, remove it.
Acked-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

As a consequence the NFC device IDs won't be increasing all the time,
as IDR provides the first available ID.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

The previous code was always returning the last socket from the
LLCP socket list.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

It simply involves getting the client dsap and ssap and calling the UI
frame building and sending routine.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

UI frames still need to follow the MIU rule, and they need to use the
client passed dsap as the listening socket dsap is stuck on SDP.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

With connection less PDUs we have to send the SSAP and DSAP as well.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

UI (Unnumbered Information) frames are used for sending data over
connection less links.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

When DEP goes down, bound cl sockets can be kept alive as there is no
reason to kill a connection less server socket because the LLCP link
went down.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Connection less server sockets will be in BOUND state, not LISTEN.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Replying to an SNL (Service Name Lookup) means that the other end of
the link can now rely on our answer (Which is an ssap) and thus we have
to reserve it.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Signed-off-by: NArron Wang <arron.wang@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Logical continuations should be on the previous line.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Return code from nfc_hci_execute_cmd was not propagated to caller.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Check for error and return if any. This makes it easier to see what is
a 'positive' function flow.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

There is no need for return statement at the end of function returning
void.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

No need for local rc variable as result of nci_request can be returned
directly.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

local_gb is of size NFC_MAX_GT_LEN and len is used as index for it.
Check len against this instead of NCI_MAX_PARAM_LEN before accessing
local_gb.
Signed-off-by: NSzymon Janc <szymon.janc@tieto.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

This is useful when getting devices to know if they're in target or
initiator mode.
Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

rf_mode is now set to NFC_RF_NONE when a device gets allocated,
when the link goes down, and when stop polling.
Signed-off-by: NThierry Escande <thierry.escande@linux.intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

SNL (Service Name Lookup) allows for LLCP peers to map service names with
SAPs. This is mandatory for connection less support as peers need to get
the right SAPs without sending the CONNECT frame.
Here we only support the Rx part of SNL. The Tx one will be implemented
when supporting connection less LLCP sockets.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

SNL (Service Name Lookup) frames are used to respond to SNL requests.
This is needed for SDP implementation.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

We no longer need to be atomic as this is only called from
llcp_sock_release().
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

In some cases (SNL, DISC, DM) we need to send an LLCP skbs without
having a sock owning it. I frames are an exception here since
they may be requeued to the llcp_sock queue.
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

When the driver does not support checking the tag is still present, it
must return -EOPNOTSUPP. The NFC Core will then stop asking and not
report a tag lost event to user space.
Signed-off-by: NEric Lapuyade <eric.lapuyade@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

And implement the corresponding hooks for pn544.
Signed-off-by: NArron Wang <arron.wang@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

And implement the corresponding hooks for pn544.
Signed-off-by: NArron Wang <arron.wang@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

We need to send continue activation command to allow NFCIP-1
activation when a NFC target has been discovered in type A or
type F reader gate.
Signed-off-by: NArron Wang <arron.wang@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

Signed-off-by: NArron Wang <arron.wang@intel.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>