Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts:
	litmus/sched_cedf.c

28 files changed, 10100 insertions, 5597 deletions

diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
index ed371684c133..6ae5ec508587 100644
--- a/net/bluetooth/Kconfig
+++ b/net/bluetooth/Kconfig
@@ -27,31 +27,27 @@ menuconfig BT
           compile it as module (bluetooth).
 
           To use Linux Bluetooth subsystem, you will need several user-space
-          utilities like hciconfig and hcid.  These utilities and updates to
-          Bluetooth kernel modules are provided in the BlueZ packages.
-          For more information, see <http://www.bluez.org/>.
+          utilities like hciconfig and bluetoothd.  These utilities and updates
+          to Bluetooth kernel modules are provided in the BlueZ packages.  For
+          more information, see <http://www.bluez.org/>.
+
+if BT != n
 
 config BT_L2CAP
-        tristate "L2CAP protocol support"
-        depends on BT
+        bool "L2CAP protocol support"
         select CRC16
         help
           L2CAP (Logical Link Control and Adaptation Protocol) provides
           connection oriented and connection-less data transport.  L2CAP
           support is required for most Bluetooth applications.
 
-          Say Y here to compile L2CAP support into the kernel or say M to
-          compile it as module (l2cap).
-
 config BT_SCO
-        tristate "SCO links support"
-        depends on BT
+        bool "SCO links support"
         help
           SCO link provides voice transport over Bluetooth.  SCO support is
           required for voice applications like Headset and Audio.
 
-          Say Y here to compile SCO support into the kernel or say M to
-          compile it as module (sco).
+endif
 
 source "net/bluetooth/rfcomm/Kconfig"
 
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
index d1e433f7d673..f04fe9a9d634 100644
--- a/net/bluetooth/Makefile
+++ b/net/bluetooth/Makefile
@@ -3,11 +3,11 @@
 #
 
 obj-$(CONFIG_BT)        += bluetooth.o
-obj-$(CONFIG_BT_L2CAP)  += l2cap.o
-obj-$(CONFIG_BT_SCO)    += sco.o
 obj-$(CONFIG_BT_RFCOMM) += rfcomm/
 obj-$(CONFIG_BT_BNEP)   += bnep/
 obj-$(CONFIG_BT_CMTP)   += cmtp/
 obj-$(CONFIG_BT_HIDP)   += hidp/
 
-bluetooth-objs := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
+bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o hci_sock.o hci_sysfs.o lib.o
+bluetooth-$(CONFIG_BT_L2CAP)    += l2cap_core.o l2cap_sock.o
+bluetooth-$(CONFIG_BT_SCO)      += sco.o
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 421c45bd1b95..8add9b499912 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -40,7 +40,7 @@
 
 #include <net/bluetooth/bluetooth.h>
 
-#define VERSION "2.15"
+#define VERSION "2.16"
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
@@ -199,14 +199,15 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
 
         BT_DBG("parent %p", parent);
 
+        local_bh_disable();
         list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
                 sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
 
-                lock_sock(sk);
+                bh_lock_sock(sk);
 
                 /* FIXME: Is this check still needed */
                 if (sk->sk_state == BT_CLOSED) {
-                        release_sock(sk);
+                        bh_unlock_sock(sk);
                         bt_accept_unlink(sk);
                         continue;
                 }
@@ -216,12 +217,16 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
                         bt_accept_unlink(sk);
                         if (newsock)
                                 sock_graft(sk, newsock);
-                        release_sock(sk);
+
+                        bh_unlock_sock(sk);
+                        local_bh_enable();
                         return sk;
                 }
 
-                release_sock(sk);
+                bh_unlock_sock(sk);
         }
+        local_bh_enable();
+
         return NULL;
 }
 EXPORT_SYMBOL(bt_accept_dequeue);
@@ -240,7 +245,8 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & (MSG_OOB))
                 return -EOPNOTSUPP;
 
-        if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) {
+        skb = skb_recv_datagram(sk, flags, noblock, &err);
+        if (!skb) {
                 if (sk->sk_shutdown & RCV_SHUTDOWN)
                         return 0;
                 return err;
@@ -265,6 +271,116 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 }
 EXPORT_SYMBOL(bt_sock_recvmsg);
 
+static long bt_sock_data_wait(struct sock *sk, long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (!skb_queue_empty(&sk->sk_receive_queue))
+                        break;
+
+                if (sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN))
+                        break;
+
+                if (signal_pending(current) || !timeo)
+                        break;
+
+                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return timeo;
+}
+
+int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+                               struct msghdr *msg, size_t size, int flags)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+        size_t target, copied = 0;
+        long timeo;
+
+        if (flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        msg->msg_namelen = 0;
+
+        BT_DBG("sk %p size %zu", sk, size);
+
+        lock_sock(sk);
+
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
+        timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+
+        do {
+                struct sk_buff *skb;
+                int chunk;
+
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                if (!skb) {
+                        if (copied >= target)
+                                break;
+
+                        err = sock_error(sk);
+                        if (err)
+                                break;
+                        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                                break;
+
+                        err = -EAGAIN;
+                        if (!timeo)
+                                break;
+
+                        timeo = bt_sock_data_wait(sk, timeo);
+
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeo);
+                                goto out;
+                        }
+                        continue;
+                }
+
+                chunk = min_t(unsigned int, skb->len, size);
+                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        if (!copied)
+                                copied = -EFAULT;
+                        break;
+                }
+                copied += chunk;
+                size   -= chunk;
+
+                sock_recv_ts_and_drops(msg, sk, skb);
+
+                if (!(flags & MSG_PEEK)) {
+                        skb_pull(skb, chunk);
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                break;
+                        }
+                        kfree_skb(skb);
+
+                } else {
+                        /* put message back and return */
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        break;
+                }
+        } while (size);
+
+out:
+        release_sock(sk);
+        return copied ? : err;
+}
+EXPORT_SYMBOL(bt_sock_stream_recvmsg);
+
 static inline unsigned int bt_accept_poll(struct sock *parent)
 {
         struct list_head *p, *n;
@@ -281,7 +397,7 @@ static inline unsigned int bt_accept_poll(struct sock *parent)
         return 0;
 }
 
-unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait)
+unsigned int bt_sock_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
@@ -297,13 +413,12 @@ unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *w
                 mask |= POLLERR;
 
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
 
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-                        (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         if (sk->sk_state == BT_CLOSED)
@@ -430,13 +545,39 @@ static int __init bt_init(void)
 
         BT_INFO("HCI device and connection manager initialized");
 
-        hci_sock_init();
+        err = hci_sock_init();
+        if (err < 0)
+                goto error;
+
+        err = l2cap_init();
+        if (err < 0)
+                goto sock_err;
+
+        err = sco_init();
+        if (err < 0) {
+                l2cap_exit();
+                goto sock_err;
+        }
 
         return 0;
+
+sock_err:
+        hci_sock_cleanup();
+
+error:
+        sock_unregister(PF_BLUETOOTH);
+        bt_sysfs_cleanup();
+
+        return err;
 }
 
 static void __exit bt_exit(void)
 {
+
+        sco_exit();
+
+        l2cap_exit();
+
         hci_sock_cleanup();
 
         sock_unregister(PF_BLUETOOTH);
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index 70672544db86..8e6c06158f8e 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -23,88 +23,88 @@
 #include <linux/crc32.h>
 #include <net/bluetooth/bluetooth.h>
 
-// Limits
-#define BNEP_MAX_PROTO_FILTERS     5
-#define BNEP_MAX_MULTICAST_FILTERS 20
-
-// UUIDs
-#define BNEP_BASE_UUID 0x0000000000001000800000805F9B34FB
-#define BNEP_UUID16    0x02
-#define BNEP_UUID32    0x04
-#define BNEP_UUID128   0x16
-
-#define BNEP_SVC_PANU  0x1115
-#define BNEP_SVC_NAP   0x1116
-#define BNEP_SVC_GN    0x1117
-
-// Packet types
-#define BNEP_GENERAL               0x00
-#define BNEP_CONTROL               0x01
-#define BNEP_COMPRESSED            0x02
-#define BNEP_COMPRESSED_SRC_ONLY   0x03
-#define BNEP_COMPRESSED_DST_ONLY   0x04
-
-// Control types
-#define BNEP_CMD_NOT_UNDERSTOOD    0x00
-#define BNEP_SETUP_CONN_REQ        0x01
-#define BNEP_SETUP_CONN_RSP        0x02
-#define BNEP_FILTER_NET_TYPE_SET   0x03
-#define BNEP_FILTER_NET_TYPE_RSP   0x04
-#define BNEP_FILTER_MULTI_ADDR_SET 0x05
-#define BNEP_FILTER_MULTI_ADDR_RSP 0x06
-
-// Extension types
-#define BNEP_EXT_CONTROL           0x00
-
-// Response messages
-#define BNEP_SUCCESS               0x00
-
-#define BNEP_CONN_INVALID_DST      0x01
-#define BNEP_CONN_INVALID_SRC      0x02
-#define BNEP_CONN_INVALID_SVC      0x03
-#define BNEP_CONN_NOT_ALLOWED      0x04
-
-#define BNEP_FILTER_UNSUPPORTED_REQ    0x01
-#define BNEP_FILTER_INVALID_RANGE      0x02
-#define BNEP_FILTER_INVALID_MCADDR     0x02
-#define BNEP_FILTER_LIMIT_REACHED      0x03
-#define BNEP_FILTER_DENIED_SECURITY    0x04
-
-// L2CAP settings
-#define BNEP_MTU         1691
-#define BNEP_PSM         0x0f
-#define BNEP_FLUSH_TO    0xffff
-#define BNEP_CONNECT_TO  15
-#define BNEP_FILTER_TO   15
-
-// Headers
-#define BNEP_TYPE_MASK   0x7f
-#define BNEP_EXT_HEADER  0x80
+/* Limits */
+#define BNEP_MAX_PROTO_FILTERS          5
+#define BNEP_MAX_MULTICAST_FILTERS      20
+
+/* UUIDs */
+#define BNEP_BASE_UUID  0x0000000000001000800000805F9B34FB
+#define BNEP_UUID16     0x02
+#define BNEP_UUID32     0x04
+#define BNEP_UUID128    0x16
+
+#define BNEP_SVC_PANU   0x1115
+#define BNEP_SVC_NAP    0x1116
+#define BNEP_SVC_GN     0x1117
+
+/* Packet types */
+#define BNEP_GENERAL                    0x00
+#define BNEP_CONTROL                    0x01
+#define BNEP_COMPRESSED                 0x02
+#define BNEP_COMPRESSED_SRC_ONLY        0x03
+#define BNEP_COMPRESSED_DST_ONLY        0x04
+
+/* Control types */
+#define BNEP_CMD_NOT_UNDERSTOOD         0x00
+#define BNEP_SETUP_CONN_REQ             0x01
+#define BNEP_SETUP_CONN_RSP             0x02
+#define BNEP_FILTER_NET_TYPE_SET        0x03
+#define BNEP_FILTER_NET_TYPE_RSP        0x04
+#define BNEP_FILTER_MULTI_ADDR_SET      0x05
+#define BNEP_FILTER_MULTI_ADDR_RSP      0x06
+
+/* Extension types */
+#define BNEP_EXT_CONTROL 0x00
+
+/* Response messages */
+#define BNEP_SUCCESS 0x00
+
+#define BNEP_CONN_INVALID_DST 0x01
+#define BNEP_CONN_INVALID_SRC 0x02
+#define BNEP_CONN_INVALID_SVC 0x03
+#define BNEP_CONN_NOT_ALLOWED 0x04
+
+#define BNEP_FILTER_UNSUPPORTED_REQ     0x01
+#define BNEP_FILTER_INVALID_RANGE       0x02
+#define BNEP_FILTER_INVALID_MCADDR      0x02
+#define BNEP_FILTER_LIMIT_REACHED       0x03
+#define BNEP_FILTER_DENIED_SECURITY     0x04
+
+/* L2CAP settings */
+#define BNEP_MTU        1691
+#define BNEP_PSM        0x0f
+#define BNEP_FLUSH_TO   0xffff
+#define BNEP_CONNECT_TO 15
+#define BNEP_FILTER_TO  15
+
+/* Headers */
+#define BNEP_TYPE_MASK  0x7f
+#define BNEP_EXT_HEADER 0x80
 
 struct bnep_setup_conn_req {
-        __u8  type;
-        __u8  ctrl;
-        __u8  uuid_size;
-        __u8  service[0];
+        __u8 type;
+        __u8 ctrl;
+        __u8 uuid_size;
+        __u8 service[0];
 } __packed;
 
 struct bnep_set_filter_req {
-        __u8  type;
-        __u8  ctrl;
+        __u8 type;
+        __u8 ctrl;
         __be16 len;
-        __u8  list[0];
+        __u8 list[0];
 } __packed;
 
 struct bnep_control_rsp {
-        __u8  type;
-        __u8  ctrl;
+        __u8 type;
+        __u8 ctrl;
         __be16 resp;
 } __packed;
 
 struct bnep_ext_hdr {
-        __u8  type;
-        __u8  len;
-        __u8  data[0];
+        __u8 type;
+        __u8 len;
+        __u8 data[0];
 } __packed;
 
 /* BNEP ioctl defines */
@@ -114,10 +114,10 @@ struct bnep_ext_hdr {
 #define BNEPGETCONNINFO _IOR('B', 211, int)
 
 struct bnep_connadd_req {
-        int   sock;       // Connected socket
+        int   sock;             /* Connected socket */
         __u32 flags;
         __u16 role;
-        char  device[16]; // Name of the Ethernet device
+        char  device[16];       /* Name of the Ethernet device */
 };
 
 struct bnep_conndel_req {
@@ -148,14 +148,14 @@ int bnep_del_connection(struct bnep_conndel_req *req);
 int bnep_get_connlist(struct bnep_connlist_req *req);
 int bnep_get_conninfo(struct bnep_conninfo *ci);
 
-// BNEP sessions
+/* BNEP sessions */
 struct bnep_session {
         struct list_head list;
 
         unsigned int  role;
         unsigned long state;
         unsigned long flags;
-        atomic_t      killed;
+        struct task_struct *task;
 
         struct ethhdr eh;
         struct msghdr msg;
@@ -173,7 +173,7 @@ void bnep_sock_cleanup(void);
 
 static inline int bnep_mc_hash(__u8 *addr)
 {
-        return (crc32_be(~0, addr, ETH_ALEN) >> 26);
+        return crc32_be(~0, addr, ETH_ALEN) >> 26;
 }
 
 #endif
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index f10b41fb05a0..ca39fcf010ce 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -36,6 +36,7 @@
 #include <linux/errno.h>
 #include <linux/net.h>
 #include <linux/slab.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/socket.h>
@@ -131,7 +132,8 @@ static int bnep_ctrl_set_netfilter(struct bnep_session *s, __be16 *data, int len
                 return -EILSEQ;
 
         n = get_unaligned_be16(data);
-        data++; len -= 2;
+        data++;
+        len -= 2;
 
         if (len < n)
                 return -EILSEQ;
@@ -176,7 +178,8 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
                 return -EILSEQ;
 
         n = get_unaligned_be16(data);
-        data += 2; len -= 2;
+        data += 2;
+        len -= 2;
 
         if (len < n)
                 return -EILSEQ;
@@ -187,6 +190,8 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
         n /= (ETH_ALEN * 2);
 
         if (n > 0) {
+                int i;
+
                 s->mc_filter = 0;
 
                 /* Always send broadcast */
@@ -196,18 +201,22 @@ static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
                 for (; n > 0; n--) {
                         u8 a1[6], *a2;
 
-                        memcpy(a1, data, ETH_ALEN); data += ETH_ALEN;
-                        a2 = data; data += ETH_ALEN;
+                        memcpy(a1, data, ETH_ALEN);
+                        data += ETH_ALEN;
+                        a2 = data;
+                        data += ETH_ALEN;
 
                         BT_DBG("mc filter %s -> %s",
                                 batostr((void *) a1), batostr((void *) a2));
 
-                        #define INCA(a) { int i = 5; while (i >=0 && ++a[i--] == 0); }
-
                         /* Iterate from a1 to a2 */
                         set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
                         while (memcmp(a1, a2, 6) < 0 && s->mc_filter != ~0LL) {
-                                INCA(a1);
+                                /* Increment a1 */
+                                i = 5;
+                                while (i >= 0 && ++a1[i--] == 0)
+                                        ;
+
                                 set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
                         }
                 }
@@ -227,7 +236,8 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
         u8  cmd = *(u8 *)data;
         int err = 0;
 
-        data++; len--;
+        data++;
+        len--;
 
         switch (cmd) {
         case BNEP_CMD_NOT_UNDERSTOOD:
@@ -302,7 +312,6 @@ static u8 __bnep_rx_hlen[] = {
         ETH_ALEN + 2, /* BNEP_COMPRESSED_SRC_ONLY */
         ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */
 };
-#define BNEP_RX_TYPES   (sizeof(__bnep_rx_hlen) - 1)
 
 static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 {
@@ -312,9 +321,10 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 
         dev->stats.rx_bytes += skb->len;
 
-        type = *(u8 *) skb->data; skb_pull(skb, 1);
+        type = *(u8 *) skb->data;
+        skb_pull(skb, 1);
 
-        if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)
+        if ((type & BNEP_TYPE_MASK) >= sizeof(__bnep_rx_hlen))
                 goto badframe;
 
         if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
@@ -367,14 +377,14 @@ static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
 
         case BNEP_COMPRESSED_DST_ONLY:
                 memcpy(__skb_put(nskb, ETH_ALEN), skb_mac_header(skb),
-                       ETH_ALEN);
+                                                                ETH_ALEN);
                 memcpy(__skb_put(nskb, ETH_ALEN + 2), s->eh.h_source,
-                       ETH_ALEN + 2);
+                                                                ETH_ALEN + 2);
                 break;
 
         case BNEP_GENERAL:
                 memcpy(__skb_put(nskb, ETH_ALEN * 2), skb_mac_header(skb),
-                       ETH_ALEN * 2);
+                                                                ETH_ALEN * 2);
                 put_unaligned(s->eh.h_proto, (__be16 *) __skb_put(nskb, 2));
                 break;
         }
@@ -470,15 +480,14 @@ static int bnep_session(void *arg)
 
         BT_DBG("");
 
-        daemonize("kbnepd %s", dev->name);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(sk_sleep(sk), &wait);
-        while (!atomic_read(&s->killed)) {
+        while (!kthread_should_stop()) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
-                // RX
+                /* RX */
                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
                         skb_orphan(skb);
                         bnep_rx_frame(s, skb);
@@ -487,7 +496,7 @@ static int bnep_session(void *arg)
                 if (sk->sk_state != BT_CONNECTED)
                         break;
 
-                // TX
+                /* TX */
                 while ((skb = skb_dequeue(&sk->sk_write_queue)))
                         if (bnep_tx_frame(s, skb))
                                 break;
@@ -555,8 +564,8 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 
         /* session struct allocated as private part of net_device */
         dev = alloc_netdev(sizeof(struct bnep_session),
-                           (*req->device) ? req->device : "bnep%d",
-                           bnep_net_setup);
+                                (*req->device) ? req->device : "bnep%d",
+                                bnep_net_setup);
         if (!dev)
                 return -ENOMEM;
 
@@ -571,7 +580,7 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         s = netdev_priv(dev);
 
         /* This is rx header therefore addresses are swapped.
-         * ie eh.h_dest is our local address. */
+         * ie. eh.h_dest is our local address. */
         memcpy(s->eh.h_dest,   &src, ETH_ALEN);
         memcpy(s->eh.h_source, &dst, ETH_ALEN);
         memcpy(dev->dev_addr, s->eh.h_dest, ETH_ALEN);
@@ -597,17 +606,17 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
         SET_NETDEV_DEVTYPE(dev, &bnep_type);
 
         err = register_netdev(dev);
-        if (err) {
+        if (err)
                 goto failed;
-        }
 
         __bnep_link_session(s);
 
-        err = kernel_thread(bnep_session, s, CLONE_KERNEL);
-        if (err < 0) {
+        s->task = kthread_run(bnep_session, s, "kbnepd %s", dev->name);
+        if (IS_ERR(s->task)) {
                 /* Session thread start failed, gotta cleanup. */
                 unregister_netdev(dev);
                 __bnep_unlink_session(s);
+                err = PTR_ERR(s->task);
                 goto failed;
         }
 
@@ -631,15 +640,9 @@ int bnep_del_connection(struct bnep_conndel_req *req)
         down_read(&bnep_session_sem);
 
         s = __bnep_get_session(req->dst);
-        if (s) {
-                /* Wakeup user-space which is polling for socket errors.
-                 * This is temporary hack until we have shutdown in L2CAP */
-                s->sock->sk->sk_err = EUNATCH;
-
-                /* Kill session thread */
-                atomic_inc(&s->killed);
-                wake_up_interruptible(sk_sleep(s->sock->sk));
-        } else
+        if (s)
+                kthread_stop(s->task);
+        else
                 err = -ENOENT;
 
         up_read(&bnep_session_sem);
@@ -648,6 +651,7 @@ int bnep_del_connection(struct bnep_conndel_req *req)
 
 static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
 {
+        memset(ci, 0, sizeof(*ci));
         memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
         strcpy(ci->device, s->dev->name);
         ci->flags = s->flags;
@@ -707,8 +711,6 @@ static int __init bnep_init(void)
 {
         char flt[50] = "";
 
-        l2cap_load();
-
 #ifdef CONFIG_BT_BNEP_PROTO_FILTER
         strcat(flt, "protocol ");
 #endif
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 2862f53b66b1..17800b1d28ea 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -39,10 +39,10 @@
 #include <linux/init.h>
 #include <linux/compat.h>
 #include <linux/gfp.h>
+#include <linux/uaccess.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
 
 #include "bnep.h"
 
@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
                         sockfd_put(nsock);
                         return -EBADFD;
                 }
+                ca.device[sizeof(ca.device)-1] = 0;
 
                 err = bnep_add_connection(&ca, nsock);
                 if (!err) {
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 3487cfe74aec..744233cba244 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/wait.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -143,7 +144,7 @@ static void cmtp_send_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         skb_queue_tail(&session->transmit, skb);
 
-        cmtp_schedule(session);
+        wake_up_interruptible(sk_sleep(session->sock->sk));
 }
 
 static void cmtp_send_interopmsg(struct cmtp_session *session,
@@ -155,7 +156,8 @@ static void cmtp_send_interopmsg(struct cmtp_session *session,
 
         BT_DBG("session %p subcmd 0x%02x appl %d msgnum %d", session, subcmd, appl, msgnum);
 
-        if (!(skb = alloc_skb(CAPI_MSG_BASELEN + 6 + len, GFP_ATOMIC))) {
+        skb = alloc_skb(CAPI_MSG_BASELEN + 6 + len, GFP_ATOMIC);
+        if (!skb) {
                 BT_ERR("Can't allocate memory for interoperability packet");
                 return;
         }
@@ -385,8 +387,7 @@ static void cmtp_reset_ctr(struct capi_ctr *ctrl)
 
         capi_ctr_down(ctrl);
 
-        atomic_inc(&session->terminate);
-        cmtp_schedule(session);
+        kthread_stop(session->task);
 }
 
 static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index 785e79e953c5..db43b54ac9af 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -37,7 +37,7 @@
 #define CMTP_LOOPBACK   0
 
 struct cmtp_connadd_req {
-        int   sock;     // Connected socket
+        int   sock;     /* Connected socket */
         __u32 flags;
 };
 
@@ -81,7 +81,7 @@ struct cmtp_session {
 
         char name[BTNAMSIZ];
 
-        atomic_t terminate;
+        struct task_struct *task;
 
         wait_queue_head_t wait;
 
@@ -121,13 +121,6 @@ void cmtp_detach_device(struct cmtp_session *session);
 
 void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb);
 
-static inline void cmtp_schedule(struct cmtp_session *session)
-{
-        struct sock *sk = session->sock->sk;
-
-        wake_up_interruptible(sk_sleep(sk));
-}
-
 /* CMTP init defines */
 int cmtp_init_sockets(void);
 void cmtp_cleanup_sockets(void);
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index d4c6af082d48..c5b11af908be 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -78,6 +79,7 @@ static void __cmtp_unlink_session(struct cmtp_session *session)
 
 static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
 {
+        memset(ci, 0, sizeof(*ci));
         bacpy(&ci->bdaddr, &session->bdaddr);
 
         ci->flags = session->flags;
@@ -114,7 +116,8 @@ static inline void cmtp_add_msgpart(struct cmtp_session *session, int id, const
 
         size = (skb) ? skb->len + count : count;
 
-        if (!(nskb = alloc_skb(size, GFP_ATOMIC))) {
+        nskb = alloc_skb(size, GFP_ATOMIC);
+        if (!nskb) {
                 BT_ERR("Can't allocate memory for CAPI message");
                 return;
         }
@@ -215,7 +218,8 @@ static void cmtp_process_transmit(struct cmtp_session *session)
 
         BT_DBG("session %p", session);
 
-        if (!(nskb = alloc_skb(session->mtu, GFP_ATOMIC))) {
+        nskb = alloc_skb(session->mtu, GFP_ATOMIC);
+        if (!nskb) {
                 BT_ERR("Can't allocate memory for new frame");
                 return;
         }
@@ -223,7 +227,8 @@ static void cmtp_process_transmit(struct cmtp_session *session)
         while ((skb = skb_dequeue(&session->transmit))) {
                 struct cmtp_scb *scb = (void *) skb->cb;
 
-                if ((tail = (session->mtu - nskb->len)) < 5) {
+                tail = session->mtu - nskb->len;
+                if (tail < 5) {
                         cmtp_send_frame(session, nskb->data, nskb->len);
                         skb_trim(nskb, 0);
                         tail = session->mtu;
@@ -231,9 +236,12 @@ static void cmtp_process_transmit(struct cmtp_session *session)
 
                 size = min_t(uint, ((tail < 258) ? (tail - 2) : (tail - 3)), skb->len);
 
-                if ((scb->id < 0) && ((scb->id = cmtp_alloc_block_id(session)) < 0)) {
-                        skb_queue_head(&session->transmit, skb);
-                        break;
+                if (scb->id < 0) {
+                        scb->id = cmtp_alloc_block_id(session);
+                        if (scb->id < 0) {
+                                skb_queue_head(&session->transmit, skb);
+                                break;
+                        }
                 }
 
                 if (size < 256) {
@@ -280,12 +288,11 @@ static int cmtp_session(void *arg)
 
         BT_DBG("session %p", session);
 
-        daemonize("kcmtpd_ctr_%d", session->num);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
         add_wait_queue(sk_sleep(sk), &wait);
-        while (!atomic_read(&session->terminate)) {
+        while (!kthread_should_stop()) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 if (sk->sk_state != BT_CONNECTED)
@@ -321,14 +328,10 @@ static int cmtp_session(void *arg)
 int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 {
         struct cmtp_session *session, *s;
-        bdaddr_t src, dst;
         int i, err;
 
         BT_DBG("");
 
-        baswap(&src, &bt_sk(sock->sk)->src);
-        baswap(&dst, &bt_sk(sock->sk)->dst);
-
         session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
         if (!session)
                 return -ENOMEM;
@@ -343,11 +346,12 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         bacpy(&session->bdaddr, &bt_sk(sock->sk)->dst);
 
-        session->mtu = min_t(uint, l2cap_pi(sock->sk)->omtu, l2cap_pi(sock->sk)->imtu);
+        session->mtu = min_t(uint, l2cap_pi(sock->sk)->chan->omtu,
+                                        l2cap_pi(sock->sk)->chan->imtu);
 
         BT_DBG("mtu %d", session->mtu);
 
-        sprintf(session->name, "%s", batostr(&dst));
+        sprintf(session->name, "%s", batostr(&bt_sk(sock->sk)->dst));
 
         session->sock  = sock;
         session->state = BT_CONFIG;
@@ -367,9 +371,12 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         __cmtp_link_session(session);
 
-        err = kernel_thread(cmtp_session, session, CLONE_KERNEL);
-        if (err < 0)
+        session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d",
+                                                                session->num);
+        if (IS_ERR(session->task)) {
+                err = PTR_ERR(session->task);
                 goto unlink;
+        }
 
         if (!(session->flags & (1 << CMTP_LOOPBACK))) {
                 err = cmtp_attach_device(session);
@@ -406,9 +413,8 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
                 /* Flush the transmit queue */
                 skb_queue_purge(&session->transmit);
 
-                /* Kill session thread */
-                atomic_inc(&session->terminate);
-                cmtp_schedule(session);
+                /* Stop session thread */
+                kthread_stop(session->task);
         } else
                 err = -ENOENT;
 
@@ -469,8 +475,6 @@ int cmtp_get_conninfo(struct cmtp_conninfo *ci)
 
 static int __init cmtp_init(void)
 {
-        l2cap_load();
-
         BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
 
         cmtp_init_sockets();
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 7ea1979a8e4f..3f2dd5c25ae5 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -34,12 +34,12 @@
 #include <linux/file.h>
 #include <linux/compat.h>
 #include <linux/gfp.h>
+#include <linux/uaccess.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
 
 #include "cmtp.h"
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 0b1e460fe440..bcd158f40bb9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -39,12 +39,39 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+static void hci_le_connect(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_le_create_conn cp;
+
+        conn->state = BT_CONNECT;
+        conn->out = 1;
+        conn->link_mode |= HCI_LM_MASTER;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.scan_interval = cpu_to_le16(0x0004);
+        cp.scan_window = cpu_to_le16(0x0004);
+        bacpy(&cp.peer_addr, &conn->dst);
+        cp.conn_interval_min = cpu_to_le16(0x0008);
+        cp.conn_interval_max = cpu_to_le16(0x0100);
+        cp.supervision_timeout = cpu_to_le16(0x0064);
+        cp.min_ce_len = cpu_to_le16(0x0001);
+        cp.max_ce_len = cpu_to_le16(0x0001);
+
+        hci_send_cmd(hdev, HCI_OP_LE_CREATE_CONN, sizeof(cp), &cp);
+}
+
+static void hci_le_connect_cancel(struct hci_conn *conn)
+{
+        hci_send_cmd(conn->hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 0, NULL);
+}
+
 void hci_acl_connect(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
@@ -66,7 +93,8 @@ void hci_acl_connect(struct hci_conn *conn)
         bacpy(&cp.bdaddr, &conn->dst);
         cp.pscan_rep_mode = 0x02;
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
+        ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+        if (ie) {
                 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
                         cp.pscan_rep_mode = ie->data.pscan_rep_mode;
                         cp.pscan_mode     = ie->data.pscan_mode;
@@ -155,6 +183,26 @@ void hci_setup_sync(struct hci_conn *conn, __u16 handle)
         hci_send_cmd(hdev, HCI_OP_SETUP_SYNC_CONN, sizeof(cp), &cp);
 }
 
+void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
+                                        u16 latency, u16 to_multiplier)
+{
+        struct hci_cp_le_conn_update cp;
+        struct hci_dev *hdev = conn->hdev;
+
+        memset(&cp, 0, sizeof(cp));
+
+        cp.handle               = cpu_to_le16(conn->handle);
+        cp.conn_interval_min    = cpu_to_le16(min);
+        cp.conn_interval_max    = cpu_to_le16(max);
+        cp.conn_latency         = cpu_to_le16(latency);
+        cp.supervision_timeout  = cpu_to_le16(to_multiplier);
+        cp.min_ce_len           = cpu_to_le16(0x0001);
+        cp.max_ce_len           = cpu_to_le16(0x0001);
+
+        hci_send_cmd(hdev, HCI_OP_LE_CONN_UPDATE, sizeof(cp), &cp);
+}
+EXPORT_SYMBOL(hci_le_conn_update);
+
 /* Device _must_ be locked */
 void hci_sco_setup(struct hci_conn *conn, __u8 status)
 {
@@ -192,8 +240,12 @@ static void hci_conn_timeout(unsigned long arg)
         switch (conn->state) {
         case BT_CONNECT:
         case BT_CONNECT2:
-                if (conn->type == ACL_LINK && conn->out)
-                        hci_acl_connect_cancel(conn);
+                if (conn->out) {
+                        if (conn->type == ACL_LINK)
+                                hci_acl_connect_cancel(conn);
+                        else if (conn->type == LE_LINK)
+                                hci_le_connect_cancel(conn);
+                }
                 break;
         case BT_CONFIG:
         case BT_CONNECTED:
@@ -217,6 +269,19 @@ static void hci_conn_idle(unsigned long arg)
         hci_conn_enter_sniff_mode(conn);
 }
 
+static void hci_conn_auto_accept(unsigned long arg)
+{
+        struct hci_conn *conn = (void *) arg;
+        struct hci_dev *hdev = conn->hdev;
+
+        hci_dev_lock(hdev);
+
+        hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY, sizeof(conn->dst),
+                                                                &conn->dst);
+
+        hci_dev_unlock(hdev);
+}
+
 struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 {
         struct hci_conn *conn;
@@ -233,6 +298,9 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->mode  = HCI_CM_ACTIVE;
         conn->state = BT_OPEN;
         conn->auth_type = HCI_AT_GENERAL_BONDING;
+        conn->io_capability = hdev->io_capability;
+        conn->remote_auth = 0xff;
+        conn->key_type = 0xff;
 
         conn->power_save = 1;
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
@@ -257,6 +325,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
 
         setup_timer(&conn->disc_timer, hci_conn_timeout, (unsigned long)conn);
         setup_timer(&conn->idle_timer, hci_conn_idle, (unsigned long)conn);
+        setup_timer(&conn->auto_accept_timer, hci_conn_auto_accept,
+                                                        (unsigned long) conn);
 
         atomic_set(&conn->refcnt, 0);
 
@@ -287,6 +357,8 @@ int hci_conn_del(struct hci_conn *conn)
 
         del_timer(&conn->disc_timer);
 
+        del_timer(&conn->auto_accept_timer);
+
         if (conn->type == ACL_LINK) {
                 struct hci_conn *sco = conn->link;
                 if (sco)
@@ -294,6 +366,11 @@ int hci_conn_del(struct hci_conn *conn)
 
                 /* Unacked frames */
                 hdev->acl_cnt += conn->sent;
+        } else if (conn->type == LE_LINK) {
+                if (hdev->le_pkts)
+                        hdev->le_cnt += conn->sent;
+                else
+                        hdev->acl_cnt += conn->sent;
         } else {
                 struct hci_conn *acl = conn->link;
                 if (acl) {
@@ -316,6 +393,9 @@ int hci_conn_del(struct hci_conn *conn)
 
         hci_dev_put(hdev);
 
+        if (conn->handle == 0)
+                kfree(conn);
+
         return 0;
 }
 
@@ -359,38 +439,54 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
 }
 EXPORT_SYMBOL(hci_get_route);
 
-/* Create SCO or ACL connection.
+/* Create SCO, ACL or LE connection.
  * Device _must_ be locked */
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8 sec_level, __u8 auth_type)
 {
         struct hci_conn *acl;
         struct hci_conn *sco;
+        struct hci_conn *le;
 
         BT_DBG("%s dst %s", hdev->name, batostr(dst));
 
-        if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
-                if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
+        if (type == LE_LINK) {
+                le = hci_conn_hash_lookup_ba(hdev, LE_LINK, dst);
+                if (le)
+                        return ERR_PTR(-EBUSY);
+                le = hci_conn_add(hdev, LE_LINK, dst);
+                if (!le)
+                        return ERR_PTR(-ENOMEM);
+                if (le->state == BT_OPEN)
+                        hci_le_connect(le);
+
+                hci_conn_hold(le);
+
+                return le;
+        }
+
+        acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
+        if (!acl) {
+                acl = hci_conn_add(hdev, ACL_LINK, dst);
+                if (!acl)
                         return NULL;
         }
 
         hci_conn_hold(acl);
 
         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
                 return acl;
 
-        if (!(sco = hci_conn_hash_lookup_ba(hdev, type, dst))) {
-                if (!(sco = hci_conn_add(hdev, type, dst))) {
+        sco = hci_conn_hash_lookup_ba(hdev, type, dst);
+        if (!sco) {
+                sco = hci_conn_add(hdev, type, dst);
+                if (!sco) {
                         hci_conn_put(acl);
                         return NULL;
                 }
@@ -437,11 +533,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
+
         if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
         else if (conn->link_mode & HCI_LM_AUTH)
                 return 1;
 
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
+
         conn->auth_type = auth_type;
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
@@ -454,36 +556,93 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
         return 0;
 }
 
+/* Encrypt the the link */
+static void hci_conn_encrypt(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (!test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+                struct hci_cp_set_conn_encrypt cp;
+                cp.handle  = cpu_to_le16(conn->handle);
+                cp.encrypt = 0x01;
+                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
+        }
+}
+
 /* Enable security */
 int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        /* For sdp we don't need the link key. */
         if (sec_level == BT_SECURITY_SDP)
                 return 1;
 
+        /* For non 2.1 devices and low security level we don't need the link
+           key. */
         if (sec_level == BT_SECURITY_LOW &&
                                 (!conn->ssp_mode || !conn->hdev->ssp_mode))
                 return 1;
 
-        if (conn->link_mode & HCI_LM_ENCRYPT)
-                return hci_conn_auth(conn, sec_level, auth_type);
+        /* For other security levels we need the link key. */
+        if (!(conn->link_mode & HCI_LM_AUTH))
+                goto auth;
+
+        /* An authenticated combination key has sufficient security for any
+           security level. */
+        if (conn->key_type == HCI_LK_AUTH_COMBINATION)
+                goto encrypt;
+
+        /* An unauthenticated combination key has sufficient security for
+           security level 1 and 2. */
+        if (conn->key_type == HCI_LK_UNAUTH_COMBINATION &&
+                        (sec_level == BT_SECURITY_MEDIUM ||
+                        sec_level == BT_SECURITY_LOW))
+                goto encrypt;
+
+        /* A combination key has always sufficient security for the security
+           levels 1 or 2. High security level requires the combination key
+           is generated using maximum PIN code length (16).
+           For pre 2.1 units. */
+        if (conn->key_type == HCI_LK_COMBINATION &&
+                        (sec_level != BT_SECURITY_HIGH ||
+                        conn->pin_length == 16))
+                goto encrypt;
+
+auth:
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+                return 0;
 
-        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+        if (!hci_conn_auth(conn, sec_level, auth_type))
                 return 0;
 
-        if (hci_conn_auth(conn, sec_level, auth_type)) {
-                struct hci_cp_set_conn_encrypt cp;
-                cp.handle  = cpu_to_le16(conn->handle);
-                cp.encrypt = 1;
-                hci_send_cmd(conn->hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-        }
+encrypt:
+        if (conn->link_mode & HCI_LM_ENCRYPT)
+                return 1;
 
+        hci_conn_encrypt(conn);
         return 0;
 }
 EXPORT_SYMBOL(hci_conn_security);
 
+/* Check secure link requirement */
+int hci_conn_check_secure(struct hci_conn *conn, __u8 sec_level)
+{
+        BT_DBG("conn %p", conn);
+
+        if (sec_level != BT_SECURITY_HIGH)
+                return 1; /* Accept if non-secure is required */
+
+        if (conn->key_type == HCI_LK_AUTH_COMBINATION ||
+                        (conn->key_type == HCI_LK_COMBINATION &&
+                        conn->pin_length == 16))
+                return 1;
+
+        return 0; /* Reject not secure link */
+}
+EXPORT_SYMBOL(hci_conn_check_secure);
+
 /* Change link key */
 int hci_conn_change_link_key(struct hci_conn *conn)
 {
@@ -647,10 +806,12 @@ int hci_get_conn_list(void __user *arg)
 
         size = sizeof(req) + req.conn_num * sizeof(*ci);
 
-        if (!(cl = kmalloc(size, GFP_KERNEL)))
+        cl = kmalloc(size, GFP_KERNEL);
+        if (!cl)
                 return -ENOMEM;
 
-        if (!(hdev = hci_dev_get(req.dev_id))) {
+        hdev = hci_dev_get(req.dev_id);
+        if (!hdev) {
                 kfree(cl);
                 return -ENODEV;
         }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c52f091ee6de..815269b07f20 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -41,19 +41,21 @@
 #include <linux/interrupt.h>
 #include <linux/notifier.h>
 #include <linux/rfkill.h>
+#include <linux/timer.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+#define AUTO_OFF_TIMEOUT 2000
+
 static void hci_cmd_task(unsigned long arg);
 static void hci_rx_task(unsigned long arg);
 static void hci_tx_task(unsigned long arg);
-static void hci_notify(struct hci_dev *hdev, int event);
 
 static DEFINE_RWLOCK(hci_task_lock);
 
@@ -91,9 +93,15 @@ static void hci_notify(struct hci_dev *hdev, int event)
 
 /* ---- HCI requests ---- */
 
-void hci_req_complete(struct hci_dev *hdev, int result)
+void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
 {
-        BT_DBG("%s result 0x%2.2x", hdev->name, result);
+        BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
+
+        /* If this is the init phase check if the completed command matches
+         * the last init command, and if not just return.
+         */
+        if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
+                return;
 
         if (hdev->req_status == HCI_REQ_PEND) {
                 hdev->req_result = result;
@@ -115,7 +123,7 @@ static void hci_req_cancel(struct hci_dev *hdev, int err)
 
 /* Execute request and wait for completion. */
 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
-                                unsigned long opt, __u32 timeout)
+                                        unsigned long opt, __u32 timeout)
 {
         DECLARE_WAITQUEUE(wait, current);
         int err = 0;
@@ -157,7 +165,7 @@ static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev,
 }
 
 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
-                                unsigned long opt, __u32 timeout)
+                                        unsigned long opt, __u32 timeout)
 {
         int ret;
 
@@ -177,11 +185,13 @@ static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %ld", hdev->name, opt);
 
         /* Reset device */
+        set_bit(HCI_RESET, &hdev->flags);
         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 }
 
 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 {
+        struct hci_cp_delete_stored_link_key cp;
         struct sk_buff *skb;
         __le16 param;
         __u8 flt_type;
@@ -203,8 +213,10 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         /* Mandatory initialization */
 
         /* Reset */
-        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
+        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
+                        set_bit(HCI_RESET, &hdev->flags);
                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
+        }
 
         /* Read Local Supported Features */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
@@ -245,13 +257,21 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         flt_type = HCI_FLT_CLEAR_ALL;
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 
-        /* Page timeout ~20 secs */
-        param = cpu_to_le16(0x8000);
-        hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
-
         /* Connection accept timeout ~20 secs */
         param = cpu_to_le16(0x7d00);
         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
+
+        bacpy(&cp.bdaddr, BDADDR_ANY);
+        cp.delete_all = 1;
+        hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
+}
+
+static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
+{
+        BT_DBG("%s", hdev->name);
+
+        /* Read LE buffer size */
+        hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 }
 
 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
@@ -349,20 +369,23 @@ struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *b
 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 {
         struct inquiry_cache *cache = &hdev->inq_cache;
-        struct inquiry_entry *e;
+        struct inquiry_entry *ie;
 
         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 
-        if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
+        ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
+        if (!ie) {
                 /* Entry not in the cache. Add new one. */
-                if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
+                ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
+                if (!ie)
                         return;
-                e->next     = cache->list;
-                cache->list = e;
+
+                ie->next = cache->list;
+                cache->list = ie;
         }
 
-        memcpy(&e->data, data, sizeof(*data));
-        e->timestamp = jiffies;
+        memcpy(&ie->data, data, sizeof(*data));
+        ie->timestamp = jiffies;
         cache->timestamp = jiffies;
 }
 
@@ -417,21 +440,26 @@ int hci_inquiry(void __user *arg)
         if (copy_from_user(&ir, ptr, sizeof(ir)))
                 return -EFAULT;
 
-        if (!(hdev = hci_dev_get(ir.dev_id)))
+        hdev = hci_dev_get(ir.dev_id);
+        if (!hdev)
                 return -ENODEV;
 
         hci_dev_lock_bh(hdev);
         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
-                                        inquiry_cache_empty(hdev) ||
-                                        ir.flags & IREQ_CACHE_FLUSH) {
+                                inquiry_cache_empty(hdev) ||
+                                ir.flags & IREQ_CACHE_FLUSH) {
                 inquiry_cache_flush(hdev);
                 do_inquiry = 1;
         }
         hci_dev_unlock_bh(hdev);
 
         timeo = ir.length * msecs_to_jiffies(2000);
-        if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
-                goto done;
+
+        if (do_inquiry) {
+                err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
+                if (err < 0)
+                        goto done;
+        }
 
         /* for unlimited number of responses we will use buffer with 255 entries */
         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
@@ -439,7 +467,8 @@ int hci_inquiry(void __user *arg)
         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
          * copy it to the user space.
          */
-        if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
+        buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
+        if (!buf) {
                 err = -ENOMEM;
                 goto done;
         }
@@ -472,7 +501,8 @@ int hci_dev_open(__u16 dev)
         struct hci_dev *hdev;
         int ret = 0;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
 
         BT_DBG("%s %p", hdev->name, hdev);
@@ -504,11 +534,15 @@ int hci_dev_open(__u16 dev)
         if (!test_bit(HCI_RAW, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 set_bit(HCI_INIT, &hdev->flags);
+                hdev->init_last_cmd = 0;
 
-                //__hci_request(hdev, hci_reset_req, 0, HZ);
                 ret = __hci_request(hdev, hci_init_req, 0,
                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
+                if (lmp_le_capable(hdev))
+                        ret = __hci_request(hdev, hci_le_init_req, 0,
+                                        msecs_to_jiffies(HCI_INIT_TIMEOUT));
+
                 clear_bit(HCI_INIT, &hdev->flags);
         }
 
@@ -516,6 +550,8 @@ int hci_dev_open(__u16 dev)
                 hci_dev_hold(hdev);
                 set_bit(HCI_UP, &hdev->flags);
                 hci_notify(hdev, HCI_DEV_UP);
+                if (!test_bit(HCI_SETUP, &hdev->flags))
+                        mgmt_powered(hdev->id, 1);
         } else {
                 /* Init failed, cleanup */
                 tasklet_kill(&hdev->rx_task);
@@ -551,6 +587,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hci_req_lock(hdev);
 
         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+                del_timer_sync(&hdev->cmd_timer);
                 hci_req_unlock(hdev);
                 return 0;
         }
@@ -562,7 +599,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hci_dev_lock_bh(hdev);
         inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
-        hci_blacklist_clear(hdev);
         hci_dev_unlock_bh(hdev);
 
         hci_notify(hdev, HCI_DEV_DOWN);
@@ -590,6 +626,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         /* Drop last sent command */
         if (hdev->sent_cmd) {
+                del_timer_sync(&hdev->cmd_timer);
                 kfree_skb(hdev->sent_cmd);
                 hdev->sent_cmd = NULL;
         }
@@ -598,6 +635,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
          * and no tasks are scheduled. */
         hdev->close(hdev);
 
+        mgmt_powered(hdev->id, 0);
+
         /* Clear flags */
         hdev->flags = 0;
 
@@ -612,7 +651,8 @@ int hci_dev_close(__u16 dev)
         struct hci_dev *hdev;
         int err;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
         err = hci_dev_do_close(hdev);
         hci_dev_put(hdev);
@@ -624,7 +664,8 @@ int hci_dev_reset(__u16 dev)
         struct hci_dev *hdev;
         int ret = 0;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
 
         hci_req_lock(hdev);
@@ -646,7 +687,7 @@ int hci_dev_reset(__u16 dev)
                 hdev->flush(hdev);
 
         atomic_set(&hdev->cmd_cnt, 1);
-        hdev->acl_cnt = 0; hdev->sco_cnt = 0;
+        hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 
         if (!test_bit(HCI_RAW, &hdev->flags))
                 ret = __hci_request(hdev, hci_reset_req, 0,
@@ -664,7 +705,8 @@ int hci_dev_reset_stat(__u16 dev)
         struct hci_dev *hdev;
         int ret = 0;
 
-        if (!(hdev = hci_dev_get(dev)))
+        hdev = hci_dev_get(dev);
+        if (!hdev)
                 return -ENODEV;
 
         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
@@ -683,7 +725,8 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
         if (copy_from_user(&dr, arg, sizeof(dr)))
                 return -EFAULT;
 
-        if (!(hdev = hci_dev_get(dr.dev_id)))
+        hdev = hci_dev_get(dr.dev_id);
+        if (!hdev)
                 return -ENODEV;
 
         switch (cmd) {
@@ -764,7 +807,8 @@ int hci_get_dev_list(void __user *arg)
 
         size = sizeof(*dl) + dev_num * sizeof(*dr);
 
-        if (!(dl = kzalloc(size, GFP_KERNEL)))
+        dl = kzalloc(size, GFP_KERNEL);
+        if (!dl)
                 return -ENOMEM;
 
         dr = dl->dev_req;
@@ -772,9 +816,17 @@ int hci_get_dev_list(void __user *arg)
         read_lock_bh(&hci_dev_list_lock);
         list_for_each(p, &hci_dev_list) {
                 struct hci_dev *hdev;
+
                 hdev = list_entry(p, struct hci_dev, list);
+
+                hci_del_off_timer(hdev);
+
+                if (!test_bit(HCI_MGMT, &hdev->flags))
+                        set_bit(HCI_PAIRABLE, &hdev->flags);
+
                 (dr + n)->dev_id  = hdev->id;
                 (dr + n)->dev_opt = hdev->flags;
+
                 if (++n >= dev_num)
                         break;
         }
@@ -798,9 +850,15 @@ int hci_get_dev_info(void __user *arg)
         if (copy_from_user(&di, arg, sizeof(di)))
                 return -EFAULT;
 
-        if (!(hdev = hci_dev_get(di.dev_id)))
+        hdev = hci_dev_get(di.dev_id);
+        if (!hdev)
                 return -ENODEV;
 
+        hci_del_off_timer(hdev);
+
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                set_bit(HCI_PAIRABLE, &hdev->flags);
+
         strcpy(di.name, hdev->name);
         di.bdaddr   = hdev->bdaddr;
         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
@@ -869,6 +927,281 @@ void hci_free_dev(struct hci_dev *hdev)
 }
 EXPORT_SYMBOL(hci_free_dev);
 
+static void hci_power_on(struct work_struct *work)
+{
+        struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
+
+        BT_DBG("%s", hdev->name);
+
+        if (hci_dev_open(hdev->id) < 0)
+                return;
+
+        if (test_bit(HCI_AUTO_OFF, &hdev->flags))
+                mod_timer(&hdev->off_timer,
+                                jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
+
+        if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
+                mgmt_index_added(hdev->id);
+}
+
+static void hci_power_off(struct work_struct *work)
+{
+        struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_close(hdev->id);
+}
+
+static void hci_auto_off(unsigned long data)
+{
+        struct hci_dev *hdev = (struct hci_dev *) data;
+
+        BT_DBG("%s", hdev->name);
+
+        clear_bit(HCI_AUTO_OFF, &hdev->flags);
+
+        queue_work(hdev->workqueue, &hdev->power_off);
+}
+
+void hci_del_off_timer(struct hci_dev *hdev)
+{
+        BT_DBG("%s", hdev->name);
+
+        clear_bit(HCI_AUTO_OFF, &hdev->flags);
+        del_timer(&hdev->off_timer);
+}
+
+int hci_uuids_clear(struct hci_dev *hdev)
+{
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &hdev->uuids) {
+                struct bt_uuid *uuid;
+
+                uuid = list_entry(p, struct bt_uuid, list);
+
+                list_del(p);
+                kfree(uuid);
+        }
+
+        return 0;
+}
+
+int hci_link_keys_clear(struct hci_dev *hdev)
+{
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &hdev->link_keys) {
+                struct link_key *key;
+
+                key = list_entry(p, struct link_key, list);
+
+                list_del(p);
+                kfree(key);
+        }
+
+        return 0;
+}
+
+struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct list_head *p;
+
+        list_for_each(p, &hdev->link_keys) {
+                struct link_key *k;
+
+                k = list_entry(p, struct link_key, list);
+
+                if (bacmp(bdaddr, &k->bdaddr) == 0)
+                        return k;
+        }
+
+        return NULL;
+}
+
+static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
+                                                u8 key_type, u8 old_key_type)
+{
+        /* Legacy key */
+        if (key_type < 0x03)
+                return 1;
+
+        /* Debug keys are insecure so don't store them persistently */
+        if (key_type == HCI_LK_DEBUG_COMBINATION)
+                return 0;
+
+        /* Changed combination key and there's no previous one */
+        if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
+                return 0;
+
+        /* Security mode 3 case */
+        if (!conn)
+                return 1;
+
+        /* Neither local nor remote side had no-bonding as requirement */
+        if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
+                return 1;
+
+        /* Local side had dedicated bonding as requirement */
+        if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
+                return 1;
+
+        /* Remote side had dedicated bonding as requirement */
+        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
+                return 1;
+
+        /* If none of the above criteria match, then don't store the key
+         * persistently */
+        return 0;
+}
+
+int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
+                                bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
+{
+        struct link_key *key, *old_key;
+        u8 old_key_type, persistent;
+
+        old_key = hci_find_link_key(hdev, bdaddr);
+        if (old_key) {
+                old_key_type = old_key->type;
+                key = old_key;
+        } else {
+                old_key_type = conn ? conn->key_type : 0xff;
+                key = kzalloc(sizeof(*key), GFP_ATOMIC);
+                if (!key)
+                        return -ENOMEM;
+                list_add(&key->list, &hdev->link_keys);
+        }
+
+        BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
+
+        /* Some buggy controller combinations generate a changed
+         * combination key for legacy pairing even when there's no
+         * previous key */
+        if (type == HCI_LK_CHANGED_COMBINATION &&
+                                        (!conn || conn->remote_auth == 0xff) &&
+                                        old_key_type == 0xff) {
+                type = HCI_LK_COMBINATION;
+                if (conn)
+                        conn->key_type = type;
+        }
+
+        bacpy(&key->bdaddr, bdaddr);
+        memcpy(key->val, val, 16);
+        key->pin_len = pin_len;
+
+        if (type == HCI_LK_CHANGED_COMBINATION)
+                key->type = old_key_type;
+        else
+                key->type = type;
+
+        if (!new_key)
+                return 0;
+
+        persistent = hci_persistent_key(hdev, conn, type, old_key_type);
+
+        mgmt_new_key(hdev->id, key, persistent);
+
+        if (!persistent) {
+                list_del(&key->list);
+                kfree(key);
+        }
+
+        return 0;
+}
+
+int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct link_key *key;
+
+        key = hci_find_link_key(hdev, bdaddr);
+        if (!key)
+                return -ENOENT;
+
+        BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+        list_del(&key->list);
+        kfree(key);
+
+        return 0;
+}
+
+/* HCI command timer function */
+static void hci_cmd_timer(unsigned long arg)
+{
+        struct hci_dev *hdev = (void *) arg;
+
+        BT_ERR("%s command tx timeout", hdev->name);
+        atomic_set(&hdev->cmd_cnt, 1);
+        clear_bit(HCI_RESET, &hdev->flags);
+        tasklet_schedule(&hdev->cmd_task);
+}
+
+struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
+                                                        bdaddr_t *bdaddr)
+{
+        struct oob_data *data;
+
+        list_for_each_entry(data, &hdev->remote_oob_data, list)
+                if (bacmp(bdaddr, &data->bdaddr) == 0)
+                        return data;
+
+        return NULL;
+}
+
+int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct oob_data *data;
+
+        data = hci_find_remote_oob_data(hdev, bdaddr);
+        if (!data)
+                return -ENOENT;
+
+        BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
+
+        list_del(&data->list);
+        kfree(data);
+
+        return 0;
+}
+
+int hci_remote_oob_data_clear(struct hci_dev *hdev)
+{
+        struct oob_data *data, *n;
+
+        list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
+                list_del(&data->list);
+                kfree(data);
+        }
+
+        return 0;
+}
+
+int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
+                                                                u8 *randomizer)
+{
+        struct oob_data *data;
+
+        data = hci_find_remote_oob_data(hdev, bdaddr);
+
+        if (!data) {
+                data = kmalloc(sizeof(*data), GFP_ATOMIC);
+                if (!data)
+                        return -ENOMEM;
+
+                bacpy(&data->bdaddr, bdaddr);
+                list_add(&data->list, &hdev->remote_oob_data);
+        }
+
+        memcpy(data->hash, hash, sizeof(data->hash));
+        memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
+
+        BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
+
+        return 0;
+}
+
 /* Register HCI device */
 int hci_register_dev(struct hci_dev *hdev)
 {
@@ -901,12 +1234,13 @@ int hci_register_dev(struct hci_dev *hdev)
         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
         hdev->esco_type = (ESCO_HV1);
         hdev->link_mode = (HCI_LM_ACCEPT);
+        hdev->io_capability = 0x03; /* No Input No Output */
 
         hdev->idle_timeout = 0;
         hdev->sniff_max_interval = 800;
         hdev->sniff_min_interval = 80;
 
-        tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
+        tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
 
@@ -914,6 +1248,8 @@ int hci_register_dev(struct hci_dev *hdev)
         skb_queue_head_init(&hdev->cmd_q);
         skb_queue_head_init(&hdev->raw_q);
 
+        setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
+
         for (i = 0; i < NUM_REASSEMBLY; i++)
                 hdev->reassembly[i] = NULL;
 
@@ -926,6 +1262,16 @@ int hci_register_dev(struct hci_dev *hdev)
 
         INIT_LIST_HEAD(&hdev->blacklist);
 
+        INIT_LIST_HEAD(&hdev->uuids);
+
+        INIT_LIST_HEAD(&hdev->link_keys);
+
+        INIT_LIST_HEAD(&hdev->remote_oob_data);
+
+        INIT_WORK(&hdev->power_on, hci_power_on);
+        INIT_WORK(&hdev->power_off, hci_power_off);
+        setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
+
         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 
         atomic_set(&hdev->promisc, 0);
@@ -947,6 +1293,10 @@ int hci_register_dev(struct hci_dev *hdev)
                 }
         }
 
+        set_bit(HCI_AUTO_OFF, &hdev->flags);
+        set_bit(HCI_SETUP, &hdev->flags);
+        queue_work(hdev->workqueue, &hdev->power_on);
+
         hci_notify(hdev, HCI_DEV_REG);
 
         return id;
@@ -976,6 +1326,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
         for (i = 0; i < NUM_REASSEMBLY; i++)
                 kfree_skb(hdev->reassembly[i]);
 
+        if (!test_bit(HCI_INIT, &hdev->flags) &&
+                                        !test_bit(HCI_SETUP, &hdev->flags))
+                mgmt_index_removed(hdev->id);
+
         hci_notify(hdev, HCI_DEV_UNREG);
 
         if (hdev->rfkill) {
@@ -985,8 +1339,17 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         hci_unregister_sysfs(hdev);
 
+        hci_del_off_timer(hdev);
+
         destroy_workqueue(hdev->workqueue);
 
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_uuids_clear(hdev);
+        hci_link_keys_clear(hdev);
+        hci_remote_oob_data_clear(hdev);
+        hci_dev_unlock_bh(hdev);
+
         __hci_dev_put(hdev);
 
         return 0;
@@ -1034,7 +1397,7 @@ int hci_recv_frame(struct sk_buff *skb)
 EXPORT_SYMBOL(hci_recv_frame);
 
 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
-                          int count, __u8 index, gfp_t gfp_mask)
+                                                  int count, __u8 index)
 {
         int len = 0;
         int hlen = 0;
@@ -1064,7 +1427,7 @@ static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
                         break;
                 }
 
-                skb = bt_skb_alloc(len, gfp_mask);
+                skb = bt_skb_alloc(len, GFP_ATOMIC);
                 if (!skb)
                         return -ENOMEM;
 
@@ -1150,8 +1513,7 @@ int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
                 return -EILSEQ;
 
         while (count) {
-                rem = hci_reassembly(hdev, type, data, count,
-                                                type - 1, GFP_ATOMIC);
+                rem = hci_reassembly(hdev, type, data, count, type - 1);
                 if (rem < 0)
                         return rem;
 
@@ -1185,8 +1547,8 @@ int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
                 } else
                         type = bt_cb(skb)->pkt_type;
 
-                rem = hci_reassembly(hdev, type, data,
-                                        count, STREAM_REASSEMBLY, GFP_ATOMIC);
+                rem = hci_reassembly(hdev, type, data, count,
+                                                        STREAM_REASSEMBLY);
                 if (rem < 0)
                         return rem;
 
@@ -1285,7 +1647,7 @@ static int hci_send_frame(struct sk_buff *skb)
                 /* Time stamp */
                 __net_timestamp(skb);
 
-                hci_send_to_sock(hdev, skb);
+                hci_send_to_sock(hdev, skb, NULL);
         }
 
         /* Get rid of skb owner, prior to sending to the driver. */
@@ -1321,6 +1683,9 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
 
+        if (test_bit(HCI_INIT, &hdev->flags))
+                hdev->init_last_cmd = opcode;
+
         skb_queue_tail(&hdev->cmd_q, skb);
         tasklet_schedule(&hdev->cmd_task);
 
@@ -1367,9 +1732,10 @@ void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
 
         skb->dev = (void *) hdev;
         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
-        hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
+        hci_add_acl_hdr(skb, conn->handle, flags);
 
-        if (!(list = skb_shinfo(skb)->frag_list)) {
+        list = skb_shinfo(skb)->frag_list;
+        if (!list) {
                 /* Non fragmented */
                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
 
@@ -1384,12 +1750,15 @@ void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
                 spin_lock_bh(&conn->data_q.lock);
 
                 __skb_queue_tail(&conn->data_q, skb);
+
+                flags &= ~ACL_START;
+                flags |= ACL_CONT;
                 do {
                         skb = list; list = list->next;
 
                         skb->dev = (void *) hdev;
                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
-                        hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
+                        hci_add_acl_hdr(skb, conn->handle, flags);
 
                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
 
@@ -1457,8 +1826,25 @@ static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int
         }
 
         if (conn) {
-                int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
-                int q = cnt / num;
+                int cnt, q;
+
+                switch (conn->type) {
+                case ACL_LINK:
+                        cnt = hdev->acl_cnt;
+                        break;
+                case SCO_LINK:
+                case ESCO_LINK:
+                        cnt = hdev->sco_cnt;
+                        break;
+                case LE_LINK:
+                        cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
+                        break;
+                default:
+                        cnt = 0;
+                        BT_ERR("Unknown link type");
+                }
+
+                q = cnt / num;
                 *quote = q ? q : 1;
         } else
                 *quote = 0;
@@ -1467,19 +1853,19 @@ static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int
         return conn;
 }
 
-static inline void hci_acl_tx_to(struct hci_dev *hdev)
+static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
 {
         struct hci_conn_hash *h = &hdev->conn_hash;
         struct list_head *p;
         struct hci_conn  *c;
 
-        BT_ERR("%s ACL tx timeout", hdev->name);
+        BT_ERR("%s link tx timeout", hdev->name);
 
         /* Kill stalled connections */
         list_for_each(p, &h->list) {
                 c = list_entry(p, struct hci_conn, list);
-                if (c->type == ACL_LINK && c->sent) {
-                        BT_ERR("%s killing stalled ACL connection %s",
+                if (c->type == type && c->sent) {
+                        BT_ERR("%s killing stalled connection %s",
                                 hdev->name, batostr(&c->dst));
                         hci_acl_disconn(c, 0x13);
                 }
@@ -1498,7 +1884,7 @@ static inline void hci_sched_acl(struct hci_dev *hdev)
                 /* ACL tx timeout must be longer than maximum
                  * link supervision timeout (40.9 seconds) */
                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
-                        hci_acl_tx_to(hdev);
+                        hci_link_tx_to(hdev, ACL_LINK);
         }
 
         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
@@ -1557,6 +1943,40 @@ static inline void hci_sched_esco(struct hci_dev *hdev)
         }
 }
 
+static inline void hci_sched_le(struct hci_dev *hdev)
+{
+        struct hci_conn *conn;
+        struct sk_buff *skb;
+        int quote, cnt;
+
+        BT_DBG("%s", hdev->name);
+
+        if (!test_bit(HCI_RAW, &hdev->flags)) {
+                /* LE tx timeout must be longer than maximum
+                 * link supervision timeout (40.9 seconds) */
+                if (!hdev->le_cnt && hdev->le_pkts &&
+                                time_after(jiffies, hdev->le_last_tx + HZ * 45))
+                        hci_link_tx_to(hdev, LE_LINK);
+        }
+
+        cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
+        while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
+                while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
+                        BT_DBG("skb %p len %d", skb, skb->len);
+
+                        hci_send_frame(skb);
+                        hdev->le_last_tx = jiffies;
+
+                        cnt--;
+                        conn->sent++;
+                }
+        }
+        if (hdev->le_pkts)
+                hdev->le_cnt = cnt;
+        else
+                hdev->acl_cnt = cnt;
+}
+
 static void hci_tx_task(unsigned long arg)
 {
         struct hci_dev *hdev = (struct hci_dev *) arg;
@@ -1564,7 +1984,8 @@ static void hci_tx_task(unsigned long arg)
 
         read_lock(&hci_task_lock);
 
-        BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
+        BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
+                hdev->sco_cnt, hdev->le_cnt);
 
         /* Schedule queues and send stuff to HCI driver */
 
@@ -1574,6 +1995,8 @@ static void hci_tx_task(unsigned long arg)
 
         hci_sched_esco(hdev);
 
+        hci_sched_le(hdev);
+
         /* Send next queued raw (unknown type) packet */
         while ((skb = skb_dequeue(&hdev->raw_q)))
                 hci_send_frame(skb);
@@ -1581,7 +2004,7 @@ static void hci_tx_task(unsigned long arg)
         read_unlock(&hci_task_lock);
 }
 
-/* ----- HCI RX task (incoming data proccessing) ----- */
+/* ----- HCI RX task (incoming data processing) ----- */
 
 /* ACL data packet */
 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1610,7 +2033,8 @@ static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_conn_enter_active_mode(conn);
 
                 /* Send to upper protocol */
-                if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
+                hp = hci_proto[HCI_PROTO_L2CAP];
+                if (hp && hp->recv_acldata) {
                         hp->recv_acldata(conn, skb, flags);
                         return;
                 }
@@ -1645,7 +2069,8 @@ static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 register struct hci_proto *hp;
 
                 /* Send to upper protocol */
-                if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
+                hp = hci_proto[HCI_PROTO_SCO];
+                if (hp && hp->recv_scodata) {
                         hp->recv_scodata(conn, skb);
                         return;
                 }
@@ -1669,7 +2094,7 @@ static void hci_rx_task(unsigned long arg)
         while ((skb = skb_dequeue(&hdev->rx_q))) {
                 if (atomic_read(&hdev->promisc)) {
                         /* Send copy to the sockets */
-                        hci_send_to_sock(hdev, skb);
+                        hci_send_to_sock(hdev, skb, NULL);
                 }
 
                 if (test_bit(HCI_RAW, &hdev->flags)) {
@@ -1719,19 +2144,20 @@ static void hci_cmd_task(unsigned long arg)
 
         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
 
-        if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
-                BT_ERR("%s command tx timeout", hdev->name);
-                atomic_set(&hdev->cmd_cnt, 1);
-        }
-
         /* Send queued commands */
-        if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
+        if (atomic_read(&hdev->cmd_cnt)) {
+                skb = skb_dequeue(&hdev->cmd_q);
+                if (!skb)
+                        return;
+
                 kfree_skb(hdev->sent_cmd);
 
-                if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
+                hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
+                if (hdev->sent_cmd) {
                         atomic_dec(&hdev->cmd_cnt);
                         hci_send_frame(skb);
-                        hdev->cmd_last_tx = jiffies;
+                        mod_timer(&hdev->cmd_timer,
+                                  jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
                 } else {
                         skb_queue_head(&hdev->cmd_q, skb);
                         tasklet_schedule(&hdev->cmd_task);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index bfef5bae0b3a..77930aa522e3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -39,7 +39,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -56,9 +56,11 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
 
         hci_conn_check_pending(hdev);
 }
@@ -72,7 +74,9 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
         hci_conn_check_pending(hdev);
 }
@@ -174,7 +178,7 @@ static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *s
         if (!status)
                 hdev->link_policy = get_unaligned_le16(sent);
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 }
 
 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
@@ -183,7 +187,9 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        hci_req_complete(hdev, status);
+        clear_bit(HCI_RESET, &hdev->flags);
+
+        hci_req_complete(hdev, HCI_OP_RESET, status);
 }
 
 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -193,14 +199,17 @@ static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        if (status)
-                return;
-
         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
         if (!sent)
                 return;
 
-        memcpy(hdev->dev_name, sent, 248);
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_set_local_name_complete(hdev->id, sent, status);
+
+        if (status)
+                return;
+
+        memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 }
 
 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
@@ -212,7 +221,7 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
         if (rp->status)
                 return;
 
-        memcpy(hdev->dev_name, rp->name, 248);
+        memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
 
 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -235,7 +244,7 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
                         clear_bit(HCI_AUTH, &hdev->flags);
         }
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 }
 
 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -258,7 +267,7 @@ static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
                         clear_bit(HCI_ENCRYPT, &hdev->flags);
         }
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 }
 
 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
@@ -274,18 +283,27 @@ static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (!status) {
                 __u8 param = *((__u8 *) sent);
+                int old_pscan, old_iscan;
 
-                clear_bit(HCI_PSCAN, &hdev->flags);
-                clear_bit(HCI_ISCAN, &hdev->flags);
+                old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
+                old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 
-                if (param & SCAN_INQUIRY)
+                if (param & SCAN_INQUIRY) {
                         set_bit(HCI_ISCAN, &hdev->flags);
+                        if (!old_iscan)
+                                mgmt_discoverable(hdev->id, 1);
+                } else if (old_iscan)
+                        mgmt_discoverable(hdev->id, 0);
 
-                if (param & SCAN_PAGE)
+                if (param & SCAN_PAGE) {
                         set_bit(HCI_PSCAN, &hdev->flags);
+                        if (!old_pscan)
+                                mgmt_connectable(hdev->id, 1);
+                } else if (old_pscan)
+                        mgmt_connectable(hdev->id, 0);
         }
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 }
 
 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
@@ -383,7 +401,7 @@ static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 }
 
 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -415,6 +433,117 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
         hdev->ssp_mode = *((__u8 *) sent);
 }
 
+static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
+{
+        if (hdev->features[6] & LMP_EXT_INQ)
+                return 2;
+
+        if (hdev->features[3] & LMP_RSSI_INQ)
+                return 1;
+
+        if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
+                                                hdev->lmp_subver == 0x0757)
+                return 1;
+
+        if (hdev->manufacturer == 15) {
+                if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
+                        return 1;
+                if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
+                        return 1;
+                if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
+                        return 1;
+        }
+
+        if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
+                                                hdev->lmp_subver == 0x1805)
+                return 1;
+
+        return 0;
+}
+
+static void hci_setup_inquiry_mode(struct hci_dev *hdev)
+{
+        u8 mode;
+
+        mode = hci_get_inquiry_mode(hdev);
+
+        hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
+}
+
+static void hci_setup_event_mask(struct hci_dev *hdev)
+{
+        /* The second byte is 0xff instead of 0x9f (two reserved bits
+         * disabled) since a Broadcom 1.2 dongle doesn't respond to the
+         * command otherwise */
+        u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
+
+        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
+         * any event mask for pre 1.2 devices */
+        if (hdev->lmp_ver <= 1)
+                return;
+
+        events[4] |= 0x01; /* Flow Specification Complete */
+        events[4] |= 0x02; /* Inquiry Result with RSSI */
+        events[4] |= 0x04; /* Read Remote Extended Features Complete */
+        events[5] |= 0x08; /* Synchronous Connection Complete */
+        events[5] |= 0x10; /* Synchronous Connection Changed */
+
+        if (hdev->features[3] & LMP_RSSI_INQ)
+                events[4] |= 0x04; /* Inquiry Result with RSSI */
+
+        if (hdev->features[5] & LMP_SNIFF_SUBR)
+                events[5] |= 0x20; /* Sniff Subrating */
+
+        if (hdev->features[5] & LMP_PAUSE_ENC)
+                events[5] |= 0x80; /* Encryption Key Refresh Complete */
+
+        if (hdev->features[6] & LMP_EXT_INQ)
+                events[5] |= 0x40; /* Extended Inquiry Result */
+
+        if (hdev->features[6] & LMP_NO_FLUSH)
+                events[7] |= 0x01; /* Enhanced Flush Complete */
+
+        if (hdev->features[7] & LMP_LSTO)
+                events[6] |= 0x80; /* Link Supervision Timeout Changed */
+
+        if (hdev->features[6] & LMP_SIMPLE_PAIR) {
+                events[6] |= 0x01;      /* IO Capability Request */
+                events[6] |= 0x02;      /* IO Capability Response */
+                events[6] |= 0x04;      /* User Confirmation Request */
+                events[6] |= 0x08;      /* User Passkey Request */
+                events[6] |= 0x10;      /* Remote OOB Data Request */
+                events[6] |= 0x20;      /* Simple Pairing Complete */
+                events[7] |= 0x04;      /* User Passkey Notification */
+                events[7] |= 0x08;      /* Keypress Notification */
+                events[7] |= 0x10;      /* Remote Host Supported
+                                         * Features Notification */
+        }
+
+        if (hdev->features[4] & LMP_LE)
+                events[7] |= 0x20;      /* LE Meta-Event */
+
+        hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
+}
+
+static void hci_setup(struct hci_dev *hdev)
+{
+        hci_setup_event_mask(hdev);
+
+        if (hdev->lmp_ver > 1)
+                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
+
+        if (hdev->features[6] & LMP_SIMPLE_PAIR) {
+                u8 mode = 0x01;
+                hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
+        }
+
+        if (hdev->features[3] & LMP_RSSI_INQ)
+                hci_setup_inquiry_mode(hdev);
+
+        if (hdev->features[7] & LMP_INQ_TX_PWR)
+                hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
+}
+
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_read_local_version *rp = (void *) skb->data;
@@ -426,11 +555,34 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 
         hdev->hci_ver = rp->hci_ver;
         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
+        hdev->lmp_ver = rp->lmp_ver;
         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
+        hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 
         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
                                         hdev->manufacturer,
                                         hdev->hci_ver, hdev->hci_rev);
+
+        if (test_bit(HCI_INIT, &hdev->flags))
+                hci_setup(hdev);
+}
+
+static void hci_setup_link_policy(struct hci_dev *hdev)
+{
+        u16 link_policy = 0;
+
+        if (hdev->features[0] & LMP_RSWITCH)
+                link_policy |= HCI_LP_RSWITCH;
+        if (hdev->features[0] & LMP_HOLD)
+                link_policy |= HCI_LP_HOLD;
+        if (hdev->features[0] & LMP_SNIFF)
+                link_policy |= HCI_LP_SNIFF;
+        if (hdev->features[1] & LMP_PARK)
+                link_policy |= HCI_LP_PARK;
+
+        link_policy = cpu_to_le16(link_policy);
+        hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
+                                        sizeof(link_policy), &link_policy);
 }
 
 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
@@ -440,9 +592,15 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb
         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 
         if (rp->status)
-                return;
+                goto done;
 
         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
+
+        if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
+                hci_setup_link_policy(hdev);
+
+done:
+        hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 }
 
 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
@@ -536,7 +694,151 @@ static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
         if (!rp->status)
                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 
-        hci_req_complete(hdev, rp->status);
+        hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
+}
+
+static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
+}
+
+static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
+}
+
+static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
+}
+
+static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
+}
+
+static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
+}
+
+static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
+}
+
+static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_pin_code_reply *rp = (void *) skb->data;
+        struct hci_cp_pin_code_reply *cp;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
+
+        if (rp->status != 0)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
+        if (!cp)
+                return;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (conn)
+                conn->pin_length = cp->pin_len;
+}
+
+static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
+                                                                rp->status);
+}
+static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
+                                       struct sk_buff *skb)
+{
+        struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
+        hdev->le_pkts = rp->le_max_pkt;
+
+        hdev->le_cnt = hdev->le_pkts;
+
+        BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
+
+        hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
+}
+
+static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
+                                                                rp->status);
+}
+
+static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
+                                                                rp->status);
+}
+
+static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
+                                                rp->randomizer, rp->status);
 }
 
 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
@@ -544,11 +846,15 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
         BT_DBG("%s status 0x%x", hdev->name, status);
 
         if (status) {
-                hci_req_complete(hdev, status);
-
+                hci_req_complete(hdev, HCI_OP_INQUIRY, status);
                 hci_conn_check_pending(hdev);
-        } else
-                set_bit(HCI_INQUIRY, &hdev->flags);
+                return;
+        }
+
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                        !test_and_set_bit(HCI_INQUIRY,
+                                                        &hdev->flags))
+                mgmt_discovering(hdev->id, 1);
 }
 
 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
@@ -613,11 +919,14 @@ static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
         hci_dev_lock(hdev);
 
         acl = hci_conn_hash_lookup_handle(hdev, handle);
-        if (acl && (sco = acl->link)) {
-                sco->state = BT_CLOSED;
+        if (acl) {
+                sco = acl->link;
+                if (sco) {
+                        sco->state = BT_CLOSED;
 
-                hci_proto_connect_cfm(sco, status);
-                hci_conn_del(sco);
+                        hci_proto_connect_cfm(sco, status);
+                        hci_conn_del(sco);
+                }
         }
 
         hci_dev_unlock(hdev);
@@ -677,9 +986,57 @@ static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
         hci_dev_unlock(hdev);
 }
 
+static int hci_outgoing_auth_needed(struct hci_dev *hdev,
+                                                        struct hci_conn *conn)
+{
+        if (conn->state != BT_CONFIG || !conn->out)
+                return 0;
+
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
+                return 0;
+
+        /* Only request authentication for SSP connections or non-SSP
+         * devices with sec_level HIGH */
+        if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
+                return 0;
+
+        return 1;
+}
+
 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
 {
+        struct hci_cp_remote_name_req *cp;
+        struct hci_conn *conn;
+
         BT_DBG("%s status 0x%x", hdev->name, status);
+
+        /* If successful wait for the name req complete event before
+         * checking for the need to do authentication */
+        if (!status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        if (!hci_outgoing_auth_needed(hdev, conn))
+                goto unlock;
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                struct hci_cp_auth_requested cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
@@ -758,11 +1115,14 @@ static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
         hci_dev_lock(hdev);
 
         acl = hci_conn_hash_lookup_handle(hdev, handle);
-        if (acl && (sco = acl->link)) {
-                sco->state = BT_CLOSED;
+        if (acl) {
+                sco = acl->link;
+                if (sco) {
+                        sco->state = BT_CLOSED;
 
-                hci_proto_connect_cfm(sco, status);
-                hci_conn_del(sco);
+                        hci_proto_connect_cfm(sco, status);
+                        hci_conn_del(sco);
+                }
         }
 
         hci_dev_unlock(hdev);
@@ -822,15 +1182,54 @@ static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
         hci_dev_unlock(hdev);
 }
 
+static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
+{
+        struct hci_cp_le_create_conn *cp;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
+
+        BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
+                conn);
+
+        if (status) {
+                if (conn && conn->state == BT_CONNECT) {
+                        conn->state = BT_CLOSED;
+                        hci_proto_connect_cfm(conn, status);
+                        hci_conn_del(conn);
+                }
+        } else {
+                if (!conn) {
+                        conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
+                        if (conn)
+                                conn->out = 1;
+                        else
+                                BT_ERR("No memory for new connection");
+                }
+        }
+
+        hci_dev_unlock(hdev);
+}
+
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
 
         BT_DBG("%s status %d", hdev->name, status);
 
-        clear_bit(HCI_INQUIRY, &hdev->flags);
+        if (test_bit(HCI_MGMT, &hdev->flags) &&
+                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                mgmt_discovering(hdev->id, 0);
 
-        hci_req_complete(hdev, status);
+        hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 
         hci_conn_check_pending(hdev);
 }
@@ -848,7 +1247,13 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
 
         hci_dev_lock(hdev);
 
-        for (; num_rsp; num_rsp--) {
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
+        for (; num_rsp; num_rsp--, info++) {
                 bacpy(&data.bdaddr, &info->bdaddr);
                 data.pscan_rep_mode     = info->pscan_rep_mode;
                 data.pscan_period_mode  = info->pscan_period_mode;
@@ -857,8 +1262,9 @@ static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *
                 data.clock_offset       = info->clock_offset;
                 data.rssi               = 0x00;
                 data.ssp_mode           = 0x00;
-                info++;
                 hci_inquiry_cache_update(hdev, &data);
+                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
+                                                                        NULL);
         }
 
         hci_dev_unlock(hdev);
@@ -892,6 +1298,7 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->state = BT_CONFIG;
                         hci_conn_hold(conn);
                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        mgmt_connected(hdev->id, &ev->bdaddr);
                 } else
                         conn->state = BT_CONNECTED;
 
@@ -920,8 +1327,11 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
                                                         sizeof(cp), &cp);
                 }
-        } else
+        } else {
                 conn->state = BT_CLOSED;
+                if (conn->type == ACL_LINK)
+                        mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
+        }
 
         if (conn->type == ACL_LINK)
                 hci_sco_setup(conn, ev->status);
@@ -948,19 +1358,22 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
 
-        if ((mask & HCI_LM_ACCEPT) && !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
+        if ((mask & HCI_LM_ACCEPT) &&
+                        !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
                 /* Connection accepted */
                 struct inquiry_entry *ie;
                 struct hci_conn *conn;
 
                 hci_dev_lock(hdev);
 
-                if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
+                ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+                if (ie)
                         memcpy(ie->data.dev_class, ev->dev_class, 3);
 
                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
                 if (!conn) {
-                        if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
+                        conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
+                        if (!conn) {
                                 BT_ERR("No memory for new connection");
                                 hci_dev_unlock(hdev);
                                 return;
@@ -1016,19 +1429,26 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         BT_DBG("%s status %d", hdev->name, ev->status);
 
-        if (ev->status)
+        if (ev->status) {
+                mgmt_disconnect_failed(hdev->id);
                 return;
+        }
 
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                conn->state = BT_CLOSED;
+        if (!conn)
+                goto unlock;
 
-                hci_proto_disconn_cfm(conn, ev->reason);
-                hci_conn_del(conn);
-        }
+        conn->state = BT_CLOSED;
+
+        if (conn->type == ACL_LINK || conn->type == LE_LINK)
+                mgmt_disconnected(hdev->id, &conn->dst);
 
+        hci_proto_disconn_cfm(conn, ev->reason);
+        hci_conn_del(conn);
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1043,10 +1463,12 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                         conn->link_mode |= HCI_LM_AUTH;
-                else
-                        conn->sec_level = BT_SECURITY_LOW;
+                        conn->sec_level = conn->pending_sec_level;
+                } else {
+                        mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+                }
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 
@@ -1090,9 +1512,33 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_remote_name *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
         BT_DBG("%s", hdev->name);
 
         hci_conn_check_pending(hdev);
+
+        hci_dev_lock(hdev);
+
+        if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
+                mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        if (!hci_outgoing_auth_needed(hdev, conn))
+                goto unlock;
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                struct hci_cp_auth_requested cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1162,27 +1608,39 @@ static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status)
-                        memcpy(conn->features, ev->features, 8);
+        if (!conn)
+                goto unlock;
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && lmp_ssp_capable(hdev) &&
-                                                lmp_ssp_capable(conn)) {
-                                struct hci_cp_read_remote_ext_features cp;
-                                cp.handle = ev->handle;
-                                cp.page = 0x01;
-                                hci_send_cmd(hdev,
-                                        HCI_OP_READ_REMOTE_EXT_FEATURES,
+        if (!ev->status)
+                memcpy(conn->features, ev->features, 8);
+
+        if (conn->state != BT_CONFIG)
+                goto unlock;
+
+        if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
+                struct hci_cp_read_remote_ext_features cp;
+                cp.handle = ev->handle;
+                cp.page = 0x01;
+                hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
                                                         sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
-                }
+                goto unlock;
         }
 
+        if (!ev->status) {
+                struct hci_cp_remote_name_req cp;
+                memset(&cp, 0, sizeof(cp));
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.pscan_rep_mode = 0x02;
+                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+        }
+
+        if (!hci_outgoing_auth_needed(hdev, conn)) {
+                conn->state = BT_CONNECTED;
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
+        }
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1310,11 +1768,62 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_read_bd_addr(hdev, skb);
                 break;
 
+        case HCI_OP_WRITE_CA_TIMEOUT:
+                hci_cc_write_ca_timeout(hdev, skb);
+                break;
+
+        case HCI_OP_DELETE_STORED_LINK_KEY:
+                hci_cc_delete_stored_link_key(hdev, skb);
+                break;
+
+        case HCI_OP_SET_EVENT_MASK:
+                hci_cc_set_event_mask(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_INQUIRY_MODE:
+                hci_cc_write_inquiry_mode(hdev, skb);
+                break;
+
+        case HCI_OP_READ_INQ_RSP_TX_POWER:
+                hci_cc_read_inq_rsp_tx_power(hdev, skb);
+                break;
+
+        case HCI_OP_SET_EVENT_FLT:
+                hci_cc_set_event_flt(hdev, skb);
+                break;
+
+        case HCI_OP_PIN_CODE_REPLY:
+                hci_cc_pin_code_reply(hdev, skb);
+                break;
+
+        case HCI_OP_PIN_CODE_NEG_REPLY:
+                hci_cc_pin_code_neg_reply(hdev, skb);
+                break;
+
+        case HCI_OP_READ_LOCAL_OOB_DATA:
+                hci_cc_read_local_oob_data_reply(hdev, skb);
+                break;
+
+        case HCI_OP_LE_READ_BUFFER_SIZE:
+                hci_cc_le_read_buffer_size(hdev, skb);
+                break;
+
+        case HCI_OP_USER_CONFIRM_REPLY:
+                hci_cc_user_confirm_reply(hdev, skb);
+                break;
+
+        case HCI_OP_USER_CONFIRM_NEG_REPLY:
+                hci_cc_user_confirm_neg_reply(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
         }
 
+        if (ev->opcode != HCI_OP_NOP)
+                del_timer(&hdev->cmd_timer);
+
         if (ev->ncmd) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
@@ -1376,12 +1885,24 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_exit_sniff_mode(hdev, ev->status);
                 break;
 
+        case HCI_OP_DISCONNECT:
+                if (ev->status != 0)
+                        mgmt_disconnect_failed(hdev->id);
+                break;
+
+        case HCI_OP_LE_CREATE_CONN:
+                hci_cs_le_create_conn(hdev, ev->status);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
         }
 
-        if (ev->ncmd) {
+        if (ev->opcode != HCI_OP_NOP)
+                del_timer(&hdev->cmd_timer);
+
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
                         tasklet_schedule(&hdev->cmd_task);
@@ -1443,10 +1964,22 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
                         conn->sent -= count;
 
                         if (conn->type == ACL_LINK) {
-                                if ((hdev->acl_cnt += count) > hdev->acl_pkts)
+                                hdev->acl_cnt += count;
+                                if (hdev->acl_cnt > hdev->acl_pkts)
                                         hdev->acl_cnt = hdev->acl_pkts;
+                        } else if (conn->type == LE_LINK) {
+                                if (hdev->le_pkts) {
+                                        hdev->le_cnt += count;
+                                        if (hdev->le_cnt > hdev->le_pkts)
+                                                hdev->le_cnt = hdev->le_pkts;
+                                } else {
+                                        hdev->acl_cnt += count;
+                                        if (hdev->acl_cnt > hdev->acl_pkts)
+                                                hdev->acl_cnt = hdev->acl_pkts;
+                                }
                         } else {
-                                if ((hdev->sco_cnt += count) > hdev->sco_pkts)
+                                hdev->sco_cnt += count;
+                                if (hdev->sco_cnt > hdev->sco_pkts)
                                         hdev->sco_cnt = hdev->sco_pkts;
                         }
                 }
@@ -1501,18 +2034,92 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff
                 hci_conn_put(conn);
         }
 
+        if (!test_bit(HCI_PAIRABLE, &hdev->flags))
+                hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
+                                        sizeof(ev->bdaddr), &ev->bdaddr);
+        else if (test_bit(HCI_MGMT, &hdev->flags)) {
+                u8 secure;
+
+                if (conn->pending_sec_level == BT_SECURITY_HIGH)
+                        secure = 1;
+                else
+                        secure = 0;
+
+                mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
+        }
+
         hci_dev_unlock(hdev);
 }
 
 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
+        struct hci_ev_link_key_req *ev = (void *) skb->data;
+        struct hci_cp_link_key_reply cp;
+        struct hci_conn *conn;
+        struct link_key *key;
+
         BT_DBG("%s", hdev->name);
+
+        if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
+                return;
+
+        hci_dev_lock(hdev);
+
+        key = hci_find_link_key(hdev, &ev->bdaddr);
+        if (!key) {
+                BT_DBG("%s link key not found for %s", hdev->name,
+                                                        batostr(&ev->bdaddr));
+                goto not_found;
+        }
+
+        BT_DBG("%s found key type %u for %s", hdev->name, key->type,
+                                                        batostr(&ev->bdaddr));
+
+        if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
+                                key->type == HCI_LK_DEBUG_COMBINATION) {
+                BT_DBG("%s ignoring debug key", hdev->name);
+                goto not_found;
+        }
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                if (key->type == HCI_LK_UNAUTH_COMBINATION &&
+                                conn->auth_type != 0xff &&
+                                (conn->auth_type & 0x01)) {
+                        BT_DBG("%s ignoring unauthenticated key", hdev->name);
+                        goto not_found;
+                }
+
+                if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
+                                conn->pending_sec_level == BT_SECURITY_HIGH) {
+                        BT_DBG("%s ignoring key unauthenticated for high \
+                                                        security", hdev->name);
+                        goto not_found;
+                }
+
+                conn->key_type = key->type;
+                conn->pin_length = key->pin_len;
+        }
+
+        bacpy(&cp.bdaddr, &ev->bdaddr);
+        memcpy(cp.link_key, key->val, 16);
+
+        hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
+
+        hci_dev_unlock(hdev);
+
+        return;
+
+not_found:
+        hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
+        hci_dev_unlock(hdev);
 }
 
 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_link_key_notify *ev = (void *) skb->data;
         struct hci_conn *conn;
+        u8 pin_len = 0;
 
         BT_DBG("%s", hdev->name);
 
@@ -1522,9 +2129,18 @@ static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff
         if (conn) {
                 hci_conn_hold(conn);
                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                pin_len = conn->pin_length;
+
+                if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
+                        conn->key_type = ev->key_type;
+
                 hci_conn_put(conn);
         }
 
+        if (test_bit(HCI_LINK_KEYS, &hdev->flags))
+                hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
+                                                        ev->key_type, pin_len);
+
         hci_dev_unlock(hdev);
 }
 
@@ -1541,7 +2157,8 @@ static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *sk
         if (conn && !ev->status) {
                 struct inquiry_entry *ie;
 
-                if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
+                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+                if (ie) {
                         ie->data.clock_offset = ev->clock_offset;
                         ie->timestamp = jiffies;
                 }
@@ -1575,7 +2192,8 @@ static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *
 
         hci_dev_lock(hdev);
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr))) {
+        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+        if (ie) {
                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
                 ie->timestamp = jiffies;
         }
@@ -1595,10 +2213,17 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
 
         hci_dev_lock(hdev);
 
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
-                struct inquiry_info_with_rssi_and_pscan_mode *info = (void *) (skb->data + 1);
+                struct inquiry_info_with_rssi_and_pscan_mode *info;
+                info = (void *) (skb->data + 1);
 
-                for (; num_rsp; num_rsp--) {
+                for (; num_rsp; num_rsp--, info++) {
                         bacpy(&data.bdaddr, &info->bdaddr);
                         data.pscan_rep_mode     = info->pscan_rep_mode;
                         data.pscan_period_mode  = info->pscan_period_mode;
@@ -1607,13 +2232,15 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        info++;
                         hci_inquiry_cache_update(hdev, &data);
+                        mgmt_device_found(hdev->id, &info->bdaddr,
+                                                info->dev_class, info->rssi,
+                                                NULL);
                 }
         } else {
                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
 
-                for (; num_rsp; num_rsp--) {
+                for (; num_rsp; num_rsp--, info++) {
                         bacpy(&data.bdaddr, &info->bdaddr);
                         data.pscan_rep_mode     = info->pscan_rep_mode;
                         data.pscan_period_mode  = info->pscan_period_mode;
@@ -1622,8 +2249,10 @@ static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct
                         data.clock_offset       = info->clock_offset;
                         data.rssi               = info->rssi;
                         data.ssp_mode           = 0x00;
-                        info++;
                         hci_inquiry_cache_update(hdev, &data);
+                        mgmt_device_found(hdev->id, &info->bdaddr,
+                                                info->dev_class, info->rssi,
+                                                NULL);
                 }
         }
 
@@ -1640,32 +2269,37 @@ static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_b
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status && ev->page == 0x01) {
-                        struct inquiry_entry *ie;
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status && ev->page == 0x01) {
+                struct inquiry_entry *ie;
 
-                        if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)))
-                                ie->data.ssp_mode = (ev->features[0] & 0x01);
+                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
+                if (ie)
+                        ie->data.ssp_mode = (ev->features[0] & 0x01);
 
-                        conn->ssp_mode = (ev->features[0] & 0x01);
-                }
+                conn->ssp_mode = (ev->features[0] & 0x01);
+        }
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && hdev->ssp_mode > 0 &&
-                                        conn->ssp_mode > 0 && conn->out &&
-                                        conn->sec_level != BT_SECURITY_SDP) {
-                                struct hci_cp_auth_requested cp;
-                                cp.handle = ev->handle;
-                                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
-                }
+        if (conn->state != BT_CONFIG)
+                goto unlock;
+
+        if (!ev->status) {
+                struct hci_cp_remote_name_req cp;
+                memset(&cp, 0, sizeof(cp));
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.pscan_rep_mode = 0x02;
+                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+        }
+
+        if (!hci_outgoing_auth_needed(hdev, conn)) {
+                conn->state = BT_CONNECTED;
+                hci_proto_connect_cfm(conn, ev->status);
+                hci_conn_put(conn);
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1732,17 +2366,8 @@ static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buf
 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
-        struct hci_conn *conn;
 
         BT_DBG("%s status %d", hdev->name, ev->status);
-
-        hci_dev_lock(hdev);
-
-        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-        }
-
-        hci_dev_unlock(hdev);
 }
 
 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1756,24 +2381,50 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
         if (!num_rsp)
                 return;
 
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
+
+                if (test_bit(HCI_MGMT, &hdev->flags))
+                        mgmt_discovering(hdev->id, 1);
+        }
+
         hci_dev_lock(hdev);
 
-        for (; num_rsp; num_rsp--) {
+        for (; num_rsp; num_rsp--, info++) {
                 bacpy(&data.bdaddr, &info->bdaddr);
-                data.pscan_rep_mode     = info->pscan_rep_mode;
-                data.pscan_period_mode  = info->pscan_period_mode;
-                data.pscan_mode         = 0x00;
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = 0x00;
                 memcpy(data.dev_class, info->dev_class, 3);
-                data.clock_offset       = info->clock_offset;
-                data.rssi               = info->rssi;
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = info->rssi;
                 data.ssp_mode           = 0x01;
-                info++;
                 hci_inquiry_cache_update(hdev, &data);
+                mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
+                                                info->rssi, info->data);
         }
 
         hci_dev_unlock(hdev);
 }
 
+static inline u8 hci_get_auth_req(struct hci_conn *conn)
+{
+        /* If remote requests dedicated bonding follow that lead */
+        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
+                /* If both remote and local IO capabilities allow MITM
+                 * protection then require it, otherwise don't */
+                if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
+                        return 0x02;
+                else
+                        return 0x03;
+        }
+
+        /* If remote requests no-bonding follow that lead */
+        if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
+                return conn->remote_auth | (conn->auth_type & 0x01);
+
+        return conn->auth_type;
+}
+
 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_io_capa_request *ev = (void *) skb->data;
@@ -1784,9 +2435,131 @@ static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-        if (conn)
-                hci_conn_hold(conn);
+        if (!conn)
+                goto unlock;
+
+        hci_conn_hold(conn);
+
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                goto unlock;
 
+        if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
+                        (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
+                struct hci_cp_io_capability_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                cp.capability = conn->io_capability;
+                conn->auth_type = hci_get_auth_req(conn);
+                cp.authentication = conn->auth_type;
+
+                if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
+                                hci_find_remote_oob_data(hdev, &conn->dst))
+                        cp.oob_data = 0x01;
+                else
+                        cp.oob_data = 0x00;
+
+                hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
+                                                        sizeof(cp), &cp);
+        } else {
+                struct hci_cp_io_capability_neg_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                cp.reason = 0x18; /* Pairing not allowed */
+
+                hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
+                                                        sizeof(cp), &cp);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_io_capa_reply *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        conn->remote_cap = ev->capability;
+        conn->remote_oob = ev->oob_data;
+        conn->remote_auth = ev->authentication;
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_ev_user_confirm_req *ev = (void *) skb->data;
+        int loc_mitm, rem_mitm, confirm_hint = 0;
+        struct hci_conn *conn;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                goto unlock;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (!conn)
+                goto unlock;
+
+        loc_mitm = (conn->auth_type & 0x01);
+        rem_mitm = (conn->remote_auth & 0x01);
+
+        /* If we require MITM but the remote device can't provide that
+         * (it has NoInputNoOutput) then reject the confirmation
+         * request. The only exception is when we're dedicated bonding
+         * initiators (connect_cfm_cb set) since then we always have the MITM
+         * bit set. */
+        if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
+                BT_DBG("Rejecting request: remote device can't provide MITM");
+                hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
+                                        sizeof(ev->bdaddr), &ev->bdaddr);
+                goto unlock;
+        }
+
+        /* If no side requires MITM protection; auto-accept */
+        if ((!loc_mitm || conn->remote_cap == 0x03) &&
+                                (!rem_mitm || conn->io_capability == 0x03)) {
+
+                /* If we're not the initiators request authorization to
+                 * proceed from user space (mgmt_user_confirm with
+                 * confirm_hint set to 1). */
+                if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                        BT_DBG("Confirming auto-accept as acceptor");
+                        confirm_hint = 1;
+                        goto confirm;
+                }
+
+                BT_DBG("Auto-accept of user confirmation with %ums delay",
+                                                hdev->auto_accept_delay);
+
+                if (hdev->auto_accept_delay > 0) {
+                        int delay = msecs_to_jiffies(hdev->auto_accept_delay);
+                        mod_timer(&conn->auto_accept_timer, jiffies + delay);
+                        goto unlock;
+                }
+
+                hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
+                                                sizeof(ev->bdaddr), &ev->bdaddr);
+                goto unlock;
+        }
+
+confirm:
+        mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
+                                                                confirm_hint);
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1800,9 +2573,20 @@ static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-        if (conn)
-                hci_conn_put(conn);
+        if (!conn)
+                goto unlock;
 
+        /* To avoid duplicate auth_failed events to user space we check
+         * the HCI_CONN_AUTH_PEND flag which will be set if we
+         * initiated the authentication. A traditional auth_complete
+         * event gets always produced as initiator and is also mapped to
+         * the mgmt_auth_failed event */
+        if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
+                mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+
+        hci_conn_put(conn);
+
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1815,12 +2599,105 @@ static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_
 
         hci_dev_lock(hdev);
 
-        if ((ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr)))
+        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
+        if (ie)
                 ie->data.ssp_mode = (ev->features[0] & 0x01);
 
         hci_dev_unlock(hdev);
 }
 
+static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
+        struct oob_data *data;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_MGMT, &hdev->flags))
+                goto unlock;
+
+        data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
+        if (data) {
+                struct hci_cp_remote_oob_data_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                memcpy(cp.hash, data->hash, sizeof(cp.hash));
+                memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
+
+                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
+                                                                        &cp);
+        } else {
+                struct hci_cp_remote_oob_data_neg_reply cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
+                                                                        &cp);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_le_conn_complete *ev = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
+        if (!conn) {
+                conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
+                if (!conn) {
+                        BT_ERR("No memory for new connection");
+                        hci_dev_unlock(hdev);
+                        return;
+                }
+        }
+
+        if (ev->status) {
+                mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
+                hci_proto_connect_cfm(conn, ev->status);
+                conn->state = BT_CLOSED;
+                hci_conn_del(conn);
+                goto unlock;
+        }
+
+        mgmt_connected(hdev->id, &ev->bdaddr);
+
+        conn->handle = __le16_to_cpu(ev->handle);
+        conn->state = BT_CONNECTED;
+
+        hci_conn_hold_device(conn);
+        hci_conn_add_sysfs(conn);
+
+        hci_proto_connect_cfm(conn, ev->status);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_le_meta *le_ev = (void *) skb->data;
+
+        skb_pull(skb, sizeof(*le_ev));
+
+        switch (le_ev->subevent) {
+        case HCI_EV_LE_CONN_COMPLETE:
+                hci_le_conn_complete_evt(hdev, skb);
+                break;
+
+        default:
+                break;
+        }
+}
+
 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_event_hdr *hdr = (void *) skb->data;
@@ -1949,6 +2826,14 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_io_capa_request_evt(hdev, skb);
                 break;
 
+        case HCI_EV_IO_CAPA_REPLY:
+                hci_io_capa_reply_evt(hdev, skb);
+                break;
+
+        case HCI_EV_USER_CONFIRM_REQUEST:
+                hci_user_confirm_request_evt(hdev, skb);
+                break;
+
         case HCI_EV_SIMPLE_PAIR_COMPLETE:
                 hci_simple_pair_complete_evt(hdev, skb);
                 break;
@@ -1957,6 +2842,14 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_remote_host_features_evt(hdev, skb);
                 break;
 
+        case HCI_EV_LE_META:
+                hci_le_meta_evt(hdev, skb);
+                break;
+
+        case HCI_EV_REMOTE_OOB_DATA_REQUEST:
+                hci_remote_oob_data_request_evt(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s event 0x%x", hdev->name, event);
                 break;
@@ -1990,6 +2883,6 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 
         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
         skb->dev = (void *) hdev;
-        hci_send_to_sock(hdev, skb);
+        hci_send_to_sock(hdev, skb, NULL);
         kfree_skb(skb);
 }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 83acd164d39e..295e4a88fff8 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -43,12 +43,14 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+static int enable_mgmt;
+
 /* ----- HCI socket interface ----- */
 
 static inline int hci_test_bit(int nr, void *addr)
@@ -83,7 +85,8 @@ static struct bt_sock_list hci_sk_list = {
 };
 
 /* Send frame to RAW socket */
-void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
+void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
+                                                        struct sock *skip_sk)
 {
         struct sock *sk;
         struct hlist_node *node;
@@ -95,6 +98,9 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 struct hci_filter *flt;
                 struct sk_buff *nskb;
 
+                if (sk == skip_sk)
+                        continue;
+
                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
                         continue;
 
@@ -102,6 +108,12 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                 if (skb->sk == sk)
                         continue;
 
+                if (bt_cb(skb)->channel != hci_pi(sk)->channel)
+                        continue;
+
+                if (bt_cb(skb)->channel == HCI_CHANNEL_CONTROL)
+                        goto clone;
+
                 /* Apply filter */
                 flt = &hci_pi(sk)->filter;
 
@@ -125,11 +137,14 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                                 continue;
                 }
 
-                if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
+clone:
+                nskb = skb_clone(skb, GFP_ATOMIC);
+                if (!nskb)
                         continue;
 
                 /* Put type byte before the data */
-                memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
+                if (bt_cb(skb)->channel == HCI_CHANNEL_RAW)
+                        memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
 
                 if (sock_queue_rcv_skb(sk, nskb))
                         kfree_skb(nskb);
@@ -352,25 +367,39 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long a
 
 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 {
-        struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
+        struct sockaddr_hci haddr;
         struct sock *sk = sock->sk;
         struct hci_dev *hdev = NULL;
-        int err = 0;
+        int len, err = 0;
 
         BT_DBG("sock %p sk %p", sock, sk);
 
-        if (!haddr || haddr->hci_family != AF_BLUETOOTH)
+        if (!addr)
+                return -EINVAL;
+
+        memset(&haddr, 0, sizeof(haddr));
+        len = min_t(unsigned int, sizeof(haddr), addr_len);
+        memcpy(&haddr, addr, len);
+
+        if (haddr.hci_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        if (haddr.hci_channel > HCI_CHANNEL_CONTROL)
+                return -EINVAL;
+
+        if (haddr.hci_channel == HCI_CHANNEL_CONTROL && !enable_mgmt)
                 return -EINVAL;
 
         lock_sock(sk);
 
-        if (hci_pi(sk)->hdev) {
+        if (sk->sk_state == BT_BOUND || hci_pi(sk)->hdev) {
                 err = -EALREADY;
                 goto done;
         }
 
-        if (haddr->hci_dev != HCI_DEV_NONE) {
-                if (!(hdev = hci_dev_get(haddr->hci_dev))) {
+        if (haddr.hci_dev != HCI_DEV_NONE) {
+                hdev = hci_dev_get(haddr.hci_dev);
+                if (!hdev) {
                         err = -ENODEV;
                         goto done;
                 }
@@ -378,6 +407,7 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
                 atomic_inc(&hdev->promisc);
         }
 
+        hci_pi(sk)->channel = haddr.hci_channel;
         hci_pi(sk)->hdev = hdev;
         sk->sk_state = BT_BOUND;
 
@@ -457,7 +487,8 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sk->sk_state == BT_CLOSED)
                 return 0;
 
-        if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
+        skb = skb_recv_datagram(sk, flags, noblock, &err);
+        if (!skb)
                 return err;
 
         msg->msg_namelen = 0;
@@ -499,7 +530,19 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         lock_sock(sk);
 
-        if (!(hdev = hci_pi(sk)->hdev)) {
+        switch (hci_pi(sk)->channel) {
+        case HCI_CHANNEL_RAW:
+                break;
+        case HCI_CHANNEL_CONTROL:
+                err = mgmt_control(sk, msg, len);
+                goto done;
+        default:
+                err = -EINVAL;
+                goto done;
+        }
+
+        hdev = hci_pi(sk)->hdev;
+        if (!hdev) {
                 err = -EBADFD;
                 goto done;
         }
@@ -509,7 +552,8 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto done;
         }
 
-        if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
+        skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
                 goto done;
 
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
@@ -817,7 +861,7 @@ error:
         return err;
 }
 
-void __exit hci_sock_cleanup(void)
+void hci_sock_cleanup(void)
 {
         if (bt_sock_unregister(BTPROTO_HCI) < 0)
                 BT_ERR("HCI socket unregistration failed");
@@ -826,3 +870,6 @@ void __exit hci_sock_cleanup(void)
 
         proto_unregister(&hci_sk_proto);
 }
+
+module_param(enable_mgmt, bool, 0644);
+MODULE_PARM_DESC(enable_mgmt, "Enable Management interface");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 8fb967beee80..a6c3aa8be1f7 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -11,7 +11,7 @@
 
 static struct class *bt_class;
 
-struct dentry *bt_debugfs = NULL;
+struct dentry *bt_debugfs;
 EXPORT_SYMBOL_GPL(bt_debugfs);
 
 static inline char *link_typetostr(int type)
@@ -37,9 +37,7 @@ static ssize_t show_link_type(struct device *dev, struct device_attribute *attr,
 static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_conn *conn = dev_get_drvdata(dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &conn->dst);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&conn->dst));
 }
 
 static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
@@ -53,8 +51,8 @@ static ssize_t show_link_features(struct device *dev, struct device_attribute *a
                                 conn->features[6], conn->features[7]);
 }
 
-#define LINK_ATTR(_name,_mode,_show,_store) \
-struct device_attribute link_attr_##_name = __ATTR(_name,_mode,_show,_store)
+#define LINK_ATTR(_name, _mode, _show, _store) \
+struct device_attribute link_attr_##_name = __ATTR(_name, _mode, _show, _store)
 
 static LINK_ATTR(type, S_IRUGO, show_link_type, NULL);
 static LINK_ATTR(address, S_IRUGO, show_link_address, NULL);
@@ -196,8 +194,8 @@ static inline char *host_typetostr(int type)
         switch (type) {
         case HCI_BREDR:
                 return "BR/EDR";
-        case HCI_80211:
-                return "802.11";
+        case HCI_AMP:
+                return "AMP";
         default:
                 return "UNKNOWN";
         }
@@ -218,13 +216,13 @@ static ssize_t show_type(struct device *dev, struct device_attribute *attr, char
 static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        char name[249];
+        char name[HCI_MAX_NAME_LENGTH + 1];
         int i;
 
-        for (i = 0; i < 248; i++)
+        for (i = 0; i < HCI_MAX_NAME_LENGTH; i++)
                 name[i] = hdev->dev_name[i];
 
-        name[248] = '\0';
+        name[HCI_MAX_NAME_LENGTH] = '\0';
         return sprintf(buf, "%s\n", name);
 }
 
@@ -238,9 +236,7 @@ static ssize_t show_class(struct device *dev, struct device_attribute *attr, cha
 static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &hdev->bdaddr);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&hdev->bdaddr));
 }
 
 static ssize_t show_features(struct device *dev, struct device_attribute *attr, char *buf)
@@ -281,10 +277,12 @@ static ssize_t show_idle_timeout(struct device *dev, struct device_attribute *at
 static ssize_t store_idle_timeout(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
+        unsigned int val;
+        int rv;
 
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
+        rv = kstrtouint(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
         if (val != 0 && (val < 500 || val > 3600000))
                 return -EINVAL;
@@ -303,15 +301,14 @@ static ssize_t show_sniff_max_interval(struct device *dev, struct device_attribu
 static ssize_t store_sniff_max_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
-
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
+        u16 val;
+        int rv;
 
-        if (val < 0x0002 || val > 0xFFFE || val % 2)
-                return -EINVAL;
+        rv = kstrtou16(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
-        if (val < hdev->sniff_min_interval)
+        if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
                 return -EINVAL;
 
         hdev->sniff_max_interval = val;
@@ -328,15 +325,14 @@ static ssize_t show_sniff_min_interval(struct device *dev, struct device_attribu
 static ssize_t store_sniff_min_interval(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        unsigned long val;
+        u16 val;
+        int rv;
 
-        if (strict_strtoul(buf, 0, &val) < 0)
-                return -EINVAL;
-
-        if (val < 0x0002 || val > 0xFFFE || val % 2)
-                return -EINVAL;
+        rv = kstrtou16(buf, 0, &val);
+        if (rv < 0)
+                return rv;
 
-        if (val > hdev->sniff_max_interval)
+        if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
                 return -EINVAL;
 
         hdev->sniff_min_interval = val;
@@ -408,10 +404,8 @@ static int inquiry_cache_show(struct seq_file *f, void *p)
 
         for (e = cache->list; e; e = e->next) {
                 struct inquiry_data *data = &e->data;
-                bdaddr_t bdaddr;
-                baswap(&bdaddr, &data->bdaddr);
                 seq_printf(f, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
-                           batostr(&bdaddr),
+                           batostr(&data->bdaddr),
                            data->pscan_rep_mode, data->pscan_period_mode,
                            data->pscan_mode, data->dev_class[2],
                            data->dev_class[1], data->dev_class[0],
@@ -445,13 +439,10 @@ static int blacklist_show(struct seq_file *f, void *p)
 
         list_for_each(l, &hdev->blacklist) {
                 struct bdaddr_list *b;
-                bdaddr_t bdaddr;
 
                 b = list_entry(l, struct bdaddr_list, list);
 
-                baswap(&bdaddr, &b->bdaddr);
-
-                seq_printf(f, "%s\n", batostr(&bdaddr));
+                seq_printf(f, "%s\n", batostr(&b->bdaddr));
         }
 
         hci_dev_unlock_bh(hdev);
@@ -470,6 +461,85 @@ static const struct file_operations blacklist_fops = {
         .llseek         = seq_lseek,
         .release        = single_release,
 };
+
+static void print_bt_uuid(struct seq_file *f, u8 *uuid)
+{
+        u32 data0, data4;
+        u16 data1, data2, data3, data5;
+
+        memcpy(&data0, &uuid[0], 4);
+        memcpy(&data1, &uuid[4], 2);
+        memcpy(&data2, &uuid[6], 2);
+        memcpy(&data3, &uuid[8], 2);
+        memcpy(&data4, &uuid[10], 4);
+        memcpy(&data5, &uuid[14], 2);
+
+        seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.8x%.4x\n",
+                                ntohl(data0), ntohs(data1), ntohs(data2),
+                                ntohs(data3), ntohl(data4), ntohs(data5));
+}
+
+static int uuids_show(struct seq_file *f, void *p)
+{
+        struct hci_dev *hdev = f->private;
+        struct list_head *l;
+
+        hci_dev_lock_bh(hdev);
+
+        list_for_each(l, &hdev->uuids) {
+                struct bt_uuid *uuid;
+
+                uuid = list_entry(l, struct bt_uuid, list);
+
+                print_bt_uuid(f, uuid->uuid);
+        }
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+static int uuids_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, uuids_show, inode->i_private);
+}
+
+static const struct file_operations uuids_fops = {
+        .open           = uuids_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static int auto_accept_delay_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock_bh(hdev);
+
+        hdev->auto_accept_delay = val;
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+static int auto_accept_delay_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock_bh(hdev);
+
+        *val = hdev->auto_accept_delay;
+
+        hci_dev_unlock_bh(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
+                                        auto_accept_delay_set, "%llu\n");
+
 int hci_register_sysfs(struct hci_dev *hdev)
 {
         struct device *dev = &hdev->dev;
@@ -502,6 +572,10 @@ int hci_register_sysfs(struct hci_dev *hdev)
         debugfs_create_file("blacklist", 0444, hdev->debugfs,
                                                 hdev, &blacklist_fops);
 
+        debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
+
+        debugfs_create_file("auto_accept_delay", 0444, hdev->debugfs, hdev,
+                                                &auto_accept_delay_fops);
         return 0;
 }
 
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 98fdfa1fbddd..86a91543172a 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && INPUT
+        depends on BT && BT_L2CAP && INPUT && HID_SUPPORT
         select HID
         help
           HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index bfe641b7dfaf..43b4c2deb7cc 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -36,6 +36,8 @@
 #include <linux/file.h>
 #include <linux/init.h>
 #include <linux/wait.h>
+#include <linux/mutex.h>
+#include <linux/kthread.h>
 #include <net/sock.h>
 
 #include <linux/input.h>
@@ -54,22 +56,24 @@ static DECLARE_RWSEM(hidp_session_sem);
 static LIST_HEAD(hidp_session_list);
 
 static unsigned char hidp_keycode[256] = {
-          0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
-         50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
-          4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
-         27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
-         65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
-        105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
-         72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
-        191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
-        115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
-        122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
-         29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
-        150,158,159,128,136,177,178,176,142,152,173,140
+          0,   0,   0,   0,  30,  48,  46,  32,  18,  33,  34,  35,  23,  36,
+         37,  38,  50,  49,  24,  25,  16,  19,  31,  20,  22,  47,  17,  45,
+         21,  44,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  28,   1,
+         14,  15,  57,  12,  13,  26,  27,  43,  43,  39,  40,  41,  51,  52,
+         53,  58,  59,  60,  61,  62,  63,  64,  65,  66,  67,  68,  87,  88,
+         99,  70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103,  69,
+         98,  55,  74,  78,  96,  79,  80,  81,  75,  76,  77,  71,  72,  73,
+         82,  83,  86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190,
+        191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135,
+        136, 113, 115, 114,   0,   0,   0, 121,   0,  89,  93, 124,  92,  94,
+         95,   0,   0,   0, 122, 123,  90,  91,  85,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+          0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+         29,  42,  56, 125,  97,  54, 100, 126, 164, 166, 165, 163, 161, 115,
+        114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140
 };
 
 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
@@ -107,6 +111,7 @@ static void __hidp_unlink_session(struct hidp_session *session)
 
 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 {
+        memset(ci, 0, sizeof(*ci));
         bacpy(&ci->bdaddr, &session->bdaddr);
 
         ci->flags = session->flags;
@@ -115,7 +120,6 @@ static void __hidp_copy_session(struct hidp_session *session, struct hidp_connin
         ci->vendor  = 0x0000;
         ci->product = 0x0000;
         ci->version = 0x0000;
-        memset(ci->name, 0, 128);
 
         if (session->input) {
                 ci->vendor  = session->input->id.vendor;
@@ -157,7 +161,8 @@ static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 
         session->leds = newleds;
 
-        if (!(skb = alloc_skb(3, GFP_ATOMIC))) {
+        skb = alloc_skb(3, GFP_ATOMIC);
+        if (!skb) {
                 BT_ERR("Can't allocate memory for new frame");
                 return -ENOMEM;
         }
@@ -250,7 +255,8 @@ static int __hidp_send_ctrl_message(struct hidp_session *session,
 
         BT_DBG("session %p data %p size %d", session, data, size);
 
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+        skb = alloc_skb(size + 1, GFP_ATOMIC);
+        if (!skb) {
                 BT_ERR("Can't allocate memory for new frame");
                 return -ENOMEM;
         }
@@ -283,7 +289,8 @@ static int hidp_queue_report(struct hidp_session *session,
 
         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+        skb = alloc_skb(size + 1, GFP_ATOMIC);
+        if (!skb) {
                 BT_ERR("Can't allocate memory for new frame");
                 return -ENOMEM;
         }
@@ -313,24 +320,144 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_queue_report(session, buf, rsize);
 }
 
+static int hidp_get_raw_report(struct hid_device *hid,
+                unsigned char report_number,
+                unsigned char *data, size_t count,
+                unsigned char report_type)
+{
+        struct hidp_session *session = hid->driver_data;
+        struct sk_buff *skb;
+        size_t len;
+        int numbered_reports = hid->report_enum[report_type].numbered;
+
+        switch (report_type) {
+        case HID_FEATURE_REPORT:
+                report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
+                break;
+        case HID_INPUT_REPORT:
+                report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;
+                break;
+        case HID_OUTPUT_REPORT:
+                report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (mutex_lock_interruptible(&session->report_mutex))
+                return -ERESTARTSYS;
+
+        /* Set up our wait, and send the report request to the device. */
+        session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK;
+        session->waiting_report_number = numbered_reports ? report_number : -1;
+        set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+        data[0] = report_number;
+        if (hidp_send_ctrl_message(hid->driver_data, report_type, data, 1))
+                goto err_eio;
+
+        /* Wait for the return of the report. The returned report
+           gets put in session->report_return.  */
+        while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) {
+                int res;
+
+                res = wait_event_interruptible_timeout(session->report_queue,
+                        !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags),
+                        5*HZ);
+                if (res == 0) {
+                        /* timeout */
+                        goto err_eio;
+                }
+                if (res < 0) {
+                        /* signal */
+                        goto err_restartsys;
+                }
+        }
+
+        skb = session->report_return;
+        if (skb) {
+                len = skb->len < count ? skb->len : count;
+                memcpy(data, skb->data, len);
+
+                kfree_skb(skb);
+                session->report_return = NULL;
+        } else {
+                /* Device returned a HANDSHAKE, indicating  protocol error. */
+                len = -EIO;
+        }
+
+        clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+        mutex_unlock(&session->report_mutex);
+
+        return len;
+
+err_restartsys:
+        clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+        mutex_unlock(&session->report_mutex);
+        return -ERESTARTSYS;
+err_eio:
+        clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+        mutex_unlock(&session->report_mutex);
+        return -EIO;
+}
+
 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
                 unsigned char report_type)
 {
+        struct hidp_session *session = hid->driver_data;
+        int ret;
+
         switch (report_type) {
         case HID_FEATURE_REPORT:
                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
                 break;
         case HID_OUTPUT_REPORT:
-                report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
+                report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT;
                 break;
         default:
                 return -EINVAL;
         }
 
+        if (mutex_lock_interruptible(&session->report_mutex))
+                return -ERESTARTSYS;
+
+        /* Set up our wait, and send the report request to the device. */
+        set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
         if (hidp_send_ctrl_message(hid->driver_data, report_type,
-                        data, count))
-                return -ENOMEM;
-        return count;
+                        data, count)) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        /* Wait for the ACK from the device. */
+        while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) {
+                int res;
+
+                res = wait_event_interruptible_timeout(session->report_queue,
+                        !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags),
+                        10*HZ);
+                if (res == 0) {
+                        /* timeout */
+                        ret = -EIO;
+                        goto err;
+                }
+                if (res < 0) {
+                        /* signal */
+                        ret = -ERESTARTSYS;
+                        goto err;
+                }
+        }
+
+        if (!session->output_report_success) {
+                ret = -EIO;
+                goto err;
+        }
+
+        ret = count;
+
+err:
+        clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
+        mutex_unlock(&session->report_mutex);
+        return ret;
 }
 
 static void hidp_idle_timeout(unsigned long arg)
@@ -338,7 +465,7 @@ static void hidp_idle_timeout(unsigned long arg)
         struct hidp_session *session = (struct hidp_session *) arg;
 
         atomic_inc(&session->terminate);
-        hidp_schedule(session);
+        wake_up_process(session->task);
 }
 
 static void hidp_set_timer(struct hidp_session *session)
@@ -357,16 +484,22 @@ static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
         BT_DBG("session %p param 0x%02x", session, param);
+        session->output_report_success = 0; /* default condition */
 
         switch (param) {
         case HIDP_HSHK_SUCCESSFUL:
                 /* FIXME: Call into SET_ GET_ handlers here */
+                session->output_report_success = 1;
                 break;
 
         case HIDP_HSHK_NOT_READY:
         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
         case HIDP_HSHK_ERR_INVALID_PARAMETER:
+                if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) {
+                        clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+                        wake_up_interruptible(&session->report_queue);
+                }
                 /* FIXME: Call into SET_ GET_ handlers here */
                 break;
 
@@ -385,6 +518,12 @@ static void hidp_process_handshake(struct hidp_session *session,
                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
                 break;
         }
+
+        /* Wake up the waiting thread. */
+        if (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) {
+                clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
+                wake_up_interruptible(&session->report_queue);
+        }
 }
 
 static void hidp_process_hid_control(struct hidp_session *session,
@@ -397,15 +536,16 @@ static void hidp_process_hid_control(struct hidp_session *session,
                 skb_queue_purge(&session->ctrl_transmit);
                 skb_queue_purge(&session->intr_transmit);
 
-                /* Kill session thread */
                 atomic_inc(&session->terminate);
-                hidp_schedule(session);
+                wake_up_process(current);
         }
 }
 
-static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
+/* Returns true if the passed-in skb should be freed by the caller. */
+static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
                                 unsigned char param)
 {
+        int done_with_skb = 1;
         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 
         switch (param) {
@@ -417,7 +557,6 @@ static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 
                 if (session->hid)
                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
-
                 break;
 
         case HIDP_DATA_RTYPE_OTHER:
@@ -429,12 +568,27 @@ static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
                 __hidp_send_ctrl_message(session,
                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
         }
+
+        if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
+                                param == session->waiting_report_type) {
+                if (session->waiting_report_number < 0 ||
+                    session->waiting_report_number == skb->data[0]) {
+                        /* hidp_get_raw_report() is waiting on this report. */
+                        session->report_return = skb;
+                        done_with_skb = 0;
+                        clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
+                        wake_up_interruptible(&session->report_queue);
+                }
+        }
+
+        return done_with_skb;
 }
 
 static void hidp_recv_ctrl_frame(struct hidp_session *session,
                                         struct sk_buff *skb)
 {
         unsigned char hdr, type, param;
+        int free_skb = 1;
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 
@@ -454,7 +608,7 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
                 break;
 
         case HIDP_TRANS_DATA:
-                hidp_process_data(session, skb, param);
+                free_skb = hidp_process_data(session, skb, param);
                 break;
 
         default:
@@ -463,7 +617,8 @@ static void hidp_recv_ctrl_frame(struct hidp_session *session,
                 break;
         }
 
-        kfree_skb(skb);
+        if (free_skb)
+                kfree_skb(skb);
 }
 
 static void hidp_recv_intr_frame(struct hidp_session *session,
@@ -541,32 +696,22 @@ static int hidp_session(void *arg)
         struct sock *ctrl_sk = session->ctrl_sock->sk;
         struct sock *intr_sk = session->intr_sock->sk;
         struct sk_buff *skb;
-        int vendor = 0x0000, product = 0x0000;
         wait_queue_t ctrl_wait, intr_wait;
 
         BT_DBG("session %p", session);
 
-        if (session->input) {
-                vendor  = session->input->id.vendor;
-                product = session->input->id.product;
-        }
-
-        if (session->hid) {
-                vendor  = session->hid->vendor;
-                product = session->hid->product;
-        }
-
-        daemonize("khidpd_%04x%04x", vendor, product);
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&ctrl_wait, current);
         init_waitqueue_entry(&intr_wait, current);
         add_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
+        session->waiting_for_startup = 0;
+        wake_up_interruptible(&session->startup_queue);
+        set_current_state(TASK_INTERRUPTIBLE);
         while (!atomic_read(&session->terminate)) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
+                if (ctrl_sk->sk_state != BT_CONNECTED ||
+                                intr_sk->sk_state != BT_CONNECTED)
                         break;
 
                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
@@ -582,6 +727,7 @@ static int hidp_session(void *arg)
                 hidp_process_transmit(session);
 
                 schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
@@ -754,11 +900,12 @@ static struct hid_ll_driver hidp_hid_driver = {
         .hidinput_input_event = hidp_hidinput_event,
 };
 
+/* This function sets up the hid device. It does not add it
+   to the HID system. That is done in hidp_add_connection(). */
 static int hidp_setup_hid(struct hidp_session *session,
                                 struct hidp_connadd_req *req)
 {
         struct hid_device *hid;
-        bdaddr_t src, dst;
         int err;
 
         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
@@ -781,9 +928,6 @@ static int hidp_setup_hid(struct hidp_session *session,
 
         hid->driver_data = session;
 
-        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
-        baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
-
         hid->bus     = BUS_BLUETOOTH;
         hid->vendor  = req->vendor;
         hid->product = req->product;
@@ -791,24 +935,17 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->country = req->country;
 
         strncpy(hid->name, req->name, 128);
-        strncpy(hid->phys, batostr(&src), 64);
-        strncpy(hid->uniq, batostr(&dst), 64);
+        strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
+        strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
 
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
 
+        hid->hid_get_raw_report = hidp_get_raw_report;
         hid->hid_output_raw_report = hidp_output_raw_report;
 
-        err = hid_add_device(hid);
-        if (err < 0)
-                goto failed;
-
         return 0;
 
-failed:
-        hid_destroy_device(hid);
-        session->hid = NULL;
-
 fault:
         kfree(session->rd_data);
         session->rd_data = NULL;
@@ -819,6 +956,7 @@ fault:
 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 {
         struct hidp_session *session, *s;
+        int vendor, product;
         int err;
 
         BT_DBG("");
@@ -843,8 +981,10 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 
         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 
-        session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
-        session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
+        session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->chan->omtu,
+                                        l2cap_pi(ctrl_sock->sk)->chan->imtu);
+        session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->chan->omtu,
+                                        l2cap_pi(intr_sock->sk)->chan->imtu);
 
         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 
@@ -857,6 +997,10 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         skb_queue_head_init(&session->ctrl_transmit);
         skb_queue_head_init(&session->intr_transmit);
 
+        mutex_init(&session->report_mutex);
+        init_waitqueue_head(&session->report_queue);
+        init_waitqueue_head(&session->startup_queue);
+        session->waiting_for_startup = 1;
         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
         session->idle_to = req->idle_to;
 
@@ -876,9 +1020,32 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 
         hidp_set_timer(session);
 
-        err = kernel_thread(hidp_session, session, CLONE_KERNEL);
-        if (err < 0)
+        if (session->hid) {
+                vendor  = session->hid->vendor;
+                product = session->hid->product;
+        } else if (session->input) {
+                vendor  = session->input->id.vendor;
+                product = session->input->id.product;
+        } else {
+                vendor = 0x0000;
+                product = 0x0000;
+        }
+
+        session->task = kthread_run(hidp_session, session, "khidpd_%04x%04x",
+                                                        vendor, product);
+        if (IS_ERR(session->task)) {
+                err = PTR_ERR(session->task);
                 goto unlink;
+        }
+
+        while (session->waiting_for_startup) {
+                wait_event_interruptible(session->startup_queue,
+                        !session->waiting_for_startup);
+        }
+
+        err = hid_add_device(session->hid);
+        if (err < 0)
+                goto err_add_device;
 
         if (session->input) {
                 hidp_send_ctrl_message(session,
@@ -892,6 +1059,12 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
         up_write(&hidp_session_sem);
         return 0;
 
+err_add_device:
+        hid_destroy_device(session->hid);
+        session->hid = NULL;
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
+
 unlink:
         hidp_del_timer(session);
 
@@ -941,13 +1114,8 @@ int hidp_del_connection(struct hidp_conndel_req *req)
                         skb_queue_purge(&session->ctrl_transmit);
                         skb_queue_purge(&session->intr_transmit);
 
-                        /* Wakeup user-space polling for socket errors */
-                        session->intr_sock->sk->sk_err = EUNATCH;
-                        session->ctrl_sock->sk->sk_err = EUNATCH;
-
-                        /* Kill session thread */
                         atomic_inc(&session->terminate);
-                        hidp_schedule(session);
+                        wake_up_process(session->task);
                 }
         } else
                 err = -ENOENT;
@@ -1020,8 +1188,6 @@ static int __init hidp_init(void)
 {
         int ret;
 
-        l2cap_load();
-
         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
 
         ret = hid_register_driver(&hidp_driver);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 8d934a19da0a..af1bcc823f26 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -80,10 +80,12 @@
 #define HIDP_VIRTUAL_CABLE_UNPLUG       0
 #define HIDP_BOOT_PROTOCOL_MODE         1
 #define HIDP_BLUETOOTH_VENDOR_ID        9
+#define HIDP_WAITING_FOR_RETURN         10
+#define HIDP_WAITING_FOR_SEND_ACK       11
 
 struct hidp_connadd_req {
-        int   ctrl_sock;        // Connected control socket
-        int   intr_sock;        // Connteted interrupt socket
+        int   ctrl_sock;        /* Connected control socket */
+        int   intr_sock;        /* Connected interrupt socket */
         __u16 parser;
         __u16 rd_size;
         __u8 __user *rd_data;
@@ -141,6 +143,7 @@ struct hidp_session {
         uint intr_mtu;
 
         atomic_t terminate;
+        struct task_struct *task;
 
         unsigned char keys[8];
         unsigned char leds;
@@ -154,9 +157,22 @@ struct hidp_session {
         struct sk_buff_head ctrl_transmit;
         struct sk_buff_head intr_transmit;
 
+        /* Used in hidp_get_raw_report() */
+        int waiting_report_type; /* HIDP_DATA_RTYPE_* */
+        int waiting_report_number; /* -1 for not numbered */
+        struct mutex report_mutex;
+        struct sk_buff *report_return;
+        wait_queue_head_t report_queue;
+
+        /* Used in hidp_output_raw_report() */
+        int output_report_success; /* boolean */
+
         /* Report descriptor */
         __u8 *rd_data;
         uint rd_size;
+
+        wait_queue_head_t startup_queue;
+        int waiting_for_startup;
 };
 
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 250dfd46237d..178ac7f127ad 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -85,7 +85,8 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
                         return err;
                 }
 
-                if (csock->sk->sk_state != BT_CONNECTED || isock->sk->sk_state != BT_CONNECTED) {
+                if (csock->sk->sk_state != BT_CONNECTED ||
+                                isock->sk->sk_state != BT_CONNECTED) {
                         sockfd_put(csock);
                         sockfd_put(isock);
                         return -EBADFD;
@@ -140,8 +141,8 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
 
 #ifdef CONFIG_COMPAT
 struct compat_hidp_connadd_req {
-        int   ctrl_sock;        // Connected control socket
-        int   intr_sock;        // Connteted interrupt socket
+        int   ctrl_sock;        /* Connected control socket */
+        int   intr_sock;        /* Connected interrupt socket */
         __u16 parser;
         __u16 rd_size;
         compat_uptr_t rd_data;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
deleted file mode 100644
index 0b54b7dd8401..000000000000
--- a/net/bluetooth/l2cap.c
+++ /dev/null
@@ -1,4873 +0,0 @@
-/*
-   BlueZ - Bluetooth protocol stack for Linux
-   Copyright (C) 2000-2001 Qualcomm Incorporated
-   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
-   Copyright (C) 2010 Google Inc.
-
-   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License version 2 as
-   published by the Free Software Foundation;
-
-   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
-   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
-   SOFTWARE IS DISCLAIMED.
-*/
-
-/* Bluetooth L2CAP core and sockets. */
-
-#include <linux/module.h>
-
-#include <linux/types.h>
-#include <linux/capability.h>
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
-#include <linux/poll.h>
-#include <linux/fcntl.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/socket.h>
-#include <linux/skbuff.h>
-#include <linux/list.h>
-#include <linux/device.h>
-#include <linux/debugfs.h>
-#include <linux/seq_file.h>
-#include <linux/uaccess.h>
-#include <linux/crc16.h>
-#include <net/sock.h>
-
-#include <asm/system.h>
-#include <asm/unaligned.h>
-
-#include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/hci_core.h>
-#include <net/bluetooth/l2cap.h>
-
-#define VERSION "2.15"
-
-static int disable_ertm = 0;
-
-static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
-static u8 l2cap_fixed_chan[8] = { 0x02, };
-
-static const struct proto_ops l2cap_sock_ops;
-
-static struct workqueue_struct *_busy_wq;
-
-static struct bt_sock_list l2cap_sk_list = {
-        .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
-};
-
-static void l2cap_busy_work(struct work_struct *work);
-
-static void __l2cap_sock_close(struct sock *sk, int reason);
-static void l2cap_sock_close(struct sock *sk);
-static void l2cap_sock_kill(struct sock *sk);
-
-static int l2cap_build_conf_req(struct sock *sk, void *data);
-static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
-                                u8 code, u8 ident, u16 dlen, void *data);
-
-static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
-
-/* ---- L2CAP timers ---- */
-static void l2cap_sock_timeout(unsigned long arg)
-{
-        struct sock *sk = (struct sock *) arg;
-        int reason;
-
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-
-        bh_lock_sock(sk);
-
-        if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
-                reason = ECONNREFUSED;
-        else if (sk->sk_state == BT_CONNECT &&
-                                l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
-                reason = ECONNREFUSED;
-        else
-                reason = ETIMEDOUT;
-
-        __l2cap_sock_close(sk, reason);
-
-        bh_unlock_sock(sk);
-
-        l2cap_sock_kill(sk);
-        sock_put(sk);
-}
-
-static void l2cap_sock_set_timer(struct sock *sk, long timeout)
-{
-        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
-        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
-}
-
-static void l2cap_sock_clear_timer(struct sock *sk)
-{
-        BT_DBG("sock %p state %d", sk, sk->sk_state);
-        sk_stop_timer(sk, &sk->sk_timer);
-}
-
-/* ---- L2CAP channels ---- */
-static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
-{
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->dcid == cid)
-                        break;
-        }
-        return s;
-}
-
-static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
-{
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->scid == cid)
-                        break;
-        }
-        return s;
-}
-
-/* Find channel with given SCID.
- * Returns locked socket */
-static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
-{
-        struct sock *s;
-        read_lock(&l->lock);
-        s = __l2cap_get_chan_by_scid(l, cid);
-        if (s)
-                bh_lock_sock(s);
-        read_unlock(&l->lock);
-        return s;
-}
-
-static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
-{
-        struct sock *s;
-        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
-                if (l2cap_pi(s)->ident == ident)
-                        break;
-        }
-        return s;
-}
-
-static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
-{
-        struct sock *s;
-        read_lock(&l->lock);
-        s = __l2cap_get_chan_by_ident(l, ident);
-        if (s)
-                bh_lock_sock(s);
-        read_unlock(&l->lock);
-        return s;
-}
-
-static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
-{
-        u16 cid = L2CAP_CID_DYN_START;
-
-        for (; cid < L2CAP_CID_DYN_END; cid++) {
-                if (!__l2cap_get_chan_by_scid(l, cid))
-                        return cid;
-        }
-
-        return 0;
-}
-
-static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
-{
-        sock_hold(sk);
-
-        if (l->head)
-                l2cap_pi(l->head)->prev_c = sk;
-
-        l2cap_pi(sk)->next_c = l->head;
-        l2cap_pi(sk)->prev_c = NULL;
-        l->head = sk;
-}
-
-static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
-{
-        struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
-
-        write_lock_bh(&l->lock);
-        if (sk == l->head)
-                l->head = next;
-
-        if (next)
-                l2cap_pi(next)->prev_c = prev;
-        if (prev)
-                l2cap_pi(prev)->next_c = next;
-        write_unlock_bh(&l->lock);
-
-        __sock_put(sk);
-}
-
-static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-
-        BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
-                        l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
-
-        conn->disc_reason = 0x13;
-
-        l2cap_pi(sk)->conn = conn;
-
-        if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
-                /* Alloc CID for connection-oriented socket */
-                l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
-        } else if (sk->sk_type == SOCK_DGRAM) {
-                /* Connectionless socket */
-                l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
-                l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
-                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
-        } else {
-                /* Raw socket can send/recv signalling messages only */
-                l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
-                l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
-                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
-        }
-
-        __l2cap_chan_link(l, sk);
-
-        if (parent)
-                bt_accept_enqueue(parent, sk);
-}
-
-/* Delete channel.
- * Must be called on the locked socket. */
-static void l2cap_chan_del(struct sock *sk, int err)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sock *parent = bt_sk(sk)->parent;
-
-        l2cap_sock_clear_timer(sk);
-
-        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
-
-        if (conn) {
-                /* Unlink from channel list */
-                l2cap_chan_unlink(&conn->chan_list, sk);
-                l2cap_pi(sk)->conn = NULL;
-                hci_conn_put(conn->hcon);
-        }
-
-        sk->sk_state = BT_CLOSED;
-        sock_set_flag(sk, SOCK_ZAPPED);
-
-        if (err)
-                sk->sk_err = err;
-
-        if (parent) {
-                bt_accept_unlink(sk);
-                parent->sk_data_ready(parent, 0);
-        } else
-                sk->sk_state_change(sk);
-
-        skb_queue_purge(TX_QUEUE(sk));
-
-        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
-                struct srej_list *l, *tmp;
-
-                del_timer(&l2cap_pi(sk)->retrans_timer);
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                del_timer(&l2cap_pi(sk)->ack_timer);
-
-                skb_queue_purge(SREJ_QUEUE(sk));
-                skb_queue_purge(BUSY_QUEUE(sk));
-
-                list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
-                        list_del(&l->list);
-                        kfree(l);
-                }
-        }
-}
-
-/* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        __u8 auth_type;
-
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
-
-        return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
-                                                                auth_type);
-}
-
-static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
-{
-        u8 id;
-
-        /* Get next available identificator.
-         *    1 - 128 are used by kernel.
-         *  129 - 199 are reserved.
-         *  200 - 254 are used by utilities like l2ping, etc.
-         */
-
-        spin_lock_bh(&conn->lock);
-
-        if (++conn->tx_ident > 128)
-                conn->tx_ident = 1;
-
-        id = conn->tx_ident;
-
-        spin_unlock_bh(&conn->lock);
-
-        return id;
-}
-
-static inline void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
-{
-        struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
-
-        BT_DBG("code 0x%2.2x", code);
-
-        if (!skb)
-                return;
-
-        hci_send_acl(conn->hcon, skb, 0);
-}
-
-static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
-{
-        struct sk_buff *skb;
-        struct l2cap_hdr *lh;
-        struct l2cap_conn *conn = pi->conn;
-        struct sock *sk = (struct sock *)pi;
-        int count, hlen = L2CAP_HDR_SIZE + 2;
-
-        if (sk->sk_state != BT_CONNECTED)
-                return;
-
-        if (pi->fcs == L2CAP_FCS_CRC16)
-                hlen += 2;
-
-        BT_DBG("pi %p, control 0x%2.2x", pi, control);
-
-        count = min_t(unsigned int, conn->mtu, hlen);
-        control |= L2CAP_CTRL_FRAME_TYPE;
-
-        if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
-                control |= L2CAP_CTRL_FINAL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-        }
-
-        if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
-                control |= L2CAP_CTRL_POLL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
-        }
-
-        skb = bt_skb_alloc(count, GFP_ATOMIC);
-        if (!skb)
-                return;
-
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(pi->dcid);
-        put_unaligned_le16(control, skb_put(skb, 2));
-
-        if (pi->fcs == L2CAP_FCS_CRC16) {
-                u16 fcs = crc16(0, (u8 *)lh, count - 2);
-                put_unaligned_le16(fcs, skb_put(skb, 2));
-        }
-
-        hci_send_acl(pi->conn->hcon, skb, 0);
-}
-
-static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
-{
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
-                control |= L2CAP_SUPER_RCV_NOT_READY;
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
-        } else
-                control |= L2CAP_SUPER_RCV_READY;
-
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-
-        l2cap_send_sframe(pi, control);
-}
-
-static inline int __l2cap_no_conn_pending(struct sock *sk)
-{
-        return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
-}
-
-static void l2cap_do_start(struct sock *sk)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-
-        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
-                if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
-                        return;
-
-                if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
-                        struct l2cap_conn_req req;
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        req.psm  = l2cap_pi(sk)->psm;
-
-                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
-
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_REQ, sizeof(req), &req);
-                }
-        } else {
-                struct l2cap_info_req req;
-                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
-
-                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
-                conn->info_ident = l2cap_get_ident(conn);
-
-                mod_timer(&conn->info_timer, jiffies +
-                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
-
-                l2cap_send_cmd(conn, conn->info_ident,
-                                        L2CAP_INFO_REQ, sizeof(req), &req);
-        }
-}
-
-static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
-{
-        u32 local_feat_mask = l2cap_feat_mask;
-        if (!disable_ertm)
-                local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
-
-        switch (mode) {
-        case L2CAP_MODE_ERTM:
-                return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
-        case L2CAP_MODE_STREAMING:
-                return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
-        default:
-                return 0x00;
-        }
-}
-
-static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
-{
-        struct l2cap_disconn_req req;
-
-        if (!conn)
-                return;
-
-        skb_queue_purge(TX_QUEUE(sk));
-
-        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
-                del_timer(&l2cap_pi(sk)->retrans_timer);
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                del_timer(&l2cap_pi(sk)->ack_timer);
-        }
-
-        req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-        l2cap_send_cmd(conn, l2cap_get_ident(conn),
-                        L2CAP_DISCONN_REQ, sizeof(req), &req);
-
-        sk->sk_state = BT_DISCONN;
-        sk->sk_err = err;
-}
-
-/* ---- L2CAP connections ---- */
-static void l2cap_conn_start(struct l2cap_conn *conn)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock_del_list del, *tmp1, *tmp2;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        INIT_LIST_HEAD(&del.list);
-
-        read_lock(&l->lock);
-
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                bh_lock_sock(sk);
-
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
-                        bh_unlock_sock(sk);
-                        continue;
-                }
-
-                if (sk->sk_state == BT_CONNECT) {
-                        struct l2cap_conn_req req;
-
-                        if (!l2cap_check_security(sk) ||
-                                        !__l2cap_no_conn_pending(sk)) {
-                                bh_unlock_sock(sk);
-                                continue;
-                        }
-
-                        if (!l2cap_mode_supported(l2cap_pi(sk)->mode,
-                                        conn->feat_mask)
-                                        && l2cap_pi(sk)->conf_state &
-                                        L2CAP_CONF_STATE2_DEVICE) {
-                                tmp1 = kzalloc(sizeof(struct sock_del_list),
-                                                GFP_ATOMIC);
-                                tmp1->sk = sk;
-                                list_add_tail(&tmp1->list, &del.list);
-                                bh_unlock_sock(sk);
-                                continue;
-                        }
-
-                        req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                        req.psm  = l2cap_pi(sk)->psm;
-
-                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
-
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                L2CAP_CONN_REQ, sizeof(req), &req);
-
-                } else if (sk->sk_state == BT_CONNECT2) {
-                        struct l2cap_conn_rsp rsp;
-                        char buf[128];
-                        rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
-
-                        if (l2cap_check_security(sk)) {
-                                if (bt_sk(sk)->defer_setup) {
-                                        struct sock *parent = bt_sk(sk)->parent;
-                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
-                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
-                                        parent->sk_data_ready(parent, 0);
-
-                                } else {
-                                        sk->sk_state = BT_CONFIG;
-                                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-                                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                                }
-                        } else {
-                                rsp.result = cpu_to_le16(L2CAP_CR_PEND);
-                                rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
-                        }
-
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-
-                        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT ||
-                                        rsp.result != L2CAP_CR_SUCCESS) {
-                                bh_unlock_sock(sk);
-                                continue;
-                        }
-
-                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                                l2cap_build_conf_req(sk, buf), buf);
-                        l2cap_pi(sk)->num_conf_req++;
-                }
-
-                bh_unlock_sock(sk);
-        }
-
-        read_unlock(&l->lock);
-
-        list_for_each_entry_safe(tmp1, tmp2, &del.list, list) {
-                bh_lock_sock(tmp1->sk);
-                __l2cap_sock_close(tmp1->sk, ECONNRESET);
-                bh_unlock_sock(tmp1->sk);
-                list_del(&tmp1->list);
-                kfree(tmp1);
-        }
-}
-
-static void l2cap_conn_ready(struct l2cap_conn *conn)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                bh_lock_sock(sk);
-
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
-                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
-                        sk->sk_state_change(sk);
-                } else if (sk->sk_state == BT_CONNECT)
-                        l2cap_do_start(sk);
-
-                bh_unlock_sock(sk);
-        }
-
-        read_unlock(&l->lock);
-}
-
-/* Notify sockets that we cannot guaranty reliability anymore */
-static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                if (l2cap_pi(sk)->force_reliable)
-                        sk->sk_err = err;
-        }
-
-        read_unlock(&l->lock);
-}
-
-static void l2cap_info_timeout(unsigned long arg)
-{
-        struct l2cap_conn *conn = (void *) arg;
-
-        conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
-        conn->info_ident = 0;
-
-        l2cap_conn_start(conn);
-}
-
-static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-
-        if (conn || status)
-                return conn;
-
-        conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
-        if (!conn)
-                return NULL;
-
-        hcon->l2cap_data = conn;
-        conn->hcon = hcon;
-
-        BT_DBG("hcon %p conn %p", hcon, conn);
-
-        conn->mtu = hcon->hdev->acl_mtu;
-        conn->src = &hcon->hdev->bdaddr;
-        conn->dst = &hcon->dst;
-
-        conn->feat_mask = 0;
-
-        spin_lock_init(&conn->lock);
-        rwlock_init(&conn->chan_list.lock);
-
-        setup_timer(&conn->info_timer, l2cap_info_timeout,
-                                                (unsigned long) conn);
-
-        conn->disc_reason = 0x13;
-
-        return conn;
-}
-
-static void l2cap_conn_del(struct hci_conn *hcon, int err)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-        struct sock *sk;
-
-        if (!conn)
-                return;
-
-        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
-
-        kfree_skb(conn->rx_skb);
-
-        /* Kill channels */
-        while ((sk = conn->chan_list.head)) {
-                bh_lock_sock(sk);
-                l2cap_chan_del(sk, err);
-                bh_unlock_sock(sk);
-                l2cap_sock_kill(sk);
-        }
-
-        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-                del_timer_sync(&conn->info_timer);
-
-        hcon->l2cap_data = NULL;
-        kfree(conn);
-}
-
-static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        write_lock_bh(&l->lock);
-        __l2cap_chan_add(conn, sk, parent);
-        write_unlock_bh(&l->lock);
-}
-
-/* ---- Socket interface ---- */
-static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-        sk_for_each(sk, node, &l2cap_sk_list.head)
-                if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
-                        goto found;
-        sk = NULL;
-found:
-        return sk;
-}
-
-/* Find socket with psm and source bdaddr.
- * Returns closest match.
- */
-static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
-{
-        struct sock *sk = NULL, *sk1 = NULL;
-        struct hlist_node *node;
-
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                if (state && sk->sk_state != state)
-                        continue;
-
-                if (l2cap_pi(sk)->psm == psm) {
-                        /* Exact match. */
-                        if (!bacmp(&bt_sk(sk)->src, src))
-                                break;
-
-                        /* Closest match */
-                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
-                                sk1 = sk;
-                }
-        }
-        return node ? sk : sk1;
-}
-
-/* Find socket with given address (psm, src).
- * Returns locked socket */
-static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
-{
-        struct sock *s;
-        read_lock(&l2cap_sk_list.lock);
-        s = __l2cap_get_sock_by_psm(state, psm, src);
-        if (s)
-                bh_lock_sock(s);
-        read_unlock(&l2cap_sk_list.lock);
-        return s;
-}
-
-static void l2cap_sock_destruct(struct sock *sk)
-{
-        BT_DBG("sk %p", sk);
-
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-}
-
-static void l2cap_sock_cleanup_listen(struct sock *parent)
-{
-        struct sock *sk;
-
-        BT_DBG("parent %p", parent);
-
-        /* Close not yet accepted channels */
-        while ((sk = bt_accept_dequeue(parent, NULL)))
-                l2cap_sock_close(sk);
-
-        parent->sk_state = BT_CLOSED;
-        sock_set_flag(parent, SOCK_ZAPPED);
-}
-
-/* Kill socket (only if zapped and orphan)
- * Must be called on unlocked socket.
- */
-static void l2cap_sock_kill(struct sock *sk)
-{
-        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
-                return;
-
-        BT_DBG("sk %p state %d", sk, sk->sk_state);
-
-        /* Kill poor orphan */
-        bt_sock_unlink(&l2cap_sk_list, sk);
-        sock_set_flag(sk, SOCK_DEAD);
-        sock_put(sk);
-}
-
-static void __l2cap_sock_close(struct sock *sk, int reason)
-{
-        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
-
-        switch (sk->sk_state) {
-        case BT_LISTEN:
-                l2cap_sock_cleanup_listen(sk);
-                break;
-
-        case BT_CONNECTED:
-        case BT_CONFIG:
-                if (sk->sk_type == SOCK_SEQPACKET ||
-                                sk->sk_type == SOCK_STREAM) {
-                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-
-                        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-                        l2cap_send_disconn_req(conn, sk, reason);
-                } else
-                        l2cap_chan_del(sk, reason);
-                break;
-
-        case BT_CONNECT2:
-                if (sk->sk_type == SOCK_SEQPACKET ||
-                                sk->sk_type == SOCK_STREAM) {
-                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-                        struct l2cap_conn_rsp rsp;
-                        __u16 result;
-
-                        if (bt_sk(sk)->defer_setup)
-                                result = L2CAP_CR_SEC_BLOCK;
-                        else
-                                result = L2CAP_CR_BAD_PSM;
-
-                        rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
-                        rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-                } else
-                        l2cap_chan_del(sk, reason);
-                break;
-
-        case BT_CONNECT:
-        case BT_DISCONN:
-                l2cap_chan_del(sk, reason);
-                break;
-
-        default:
-                sock_set_flag(sk, SOCK_ZAPPED);
-                break;
-        }
-}
-
-/* Must be called on unlocked socket. */
-static void l2cap_sock_close(struct sock *sk)
-{
-        l2cap_sock_clear_timer(sk);
-        lock_sock(sk);
-        __l2cap_sock_close(sk, ECONNRESET);
-        release_sock(sk);
-        l2cap_sock_kill(sk);
-}
-
-static void l2cap_sock_init(struct sock *sk, struct sock *parent)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-
-        BT_DBG("sk %p", sk);
-
-        if (parent) {
-                sk->sk_type = parent->sk_type;
-                bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
-
-                pi->imtu = l2cap_pi(parent)->imtu;
-                pi->omtu = l2cap_pi(parent)->omtu;
-                pi->conf_state = l2cap_pi(parent)->conf_state;
-                pi->mode = l2cap_pi(parent)->mode;
-                pi->fcs  = l2cap_pi(parent)->fcs;
-                pi->max_tx = l2cap_pi(parent)->max_tx;
-                pi->tx_win = l2cap_pi(parent)->tx_win;
-                pi->sec_level = l2cap_pi(parent)->sec_level;
-                pi->role_switch = l2cap_pi(parent)->role_switch;
-                pi->force_reliable = l2cap_pi(parent)->force_reliable;
-        } else {
-                pi->imtu = L2CAP_DEFAULT_MTU;
-                pi->omtu = 0;
-                if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
-                        pi->mode = L2CAP_MODE_ERTM;
-                        pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
-                } else {
-                        pi->mode = L2CAP_MODE_BASIC;
-                }
-                pi->max_tx = L2CAP_DEFAULT_MAX_TX;
-                pi->fcs  = L2CAP_FCS_CRC16;
-                pi->tx_win = L2CAP_DEFAULT_TX_WINDOW;
-                pi->sec_level = BT_SECURITY_LOW;
-                pi->role_switch = 0;
-                pi->force_reliable = 0;
-        }
-
-        /* Default config options */
-        pi->conf_len = 0;
-        pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
-        skb_queue_head_init(TX_QUEUE(sk));
-        skb_queue_head_init(SREJ_QUEUE(sk));
-        skb_queue_head_init(BUSY_QUEUE(sk));
-        INIT_LIST_HEAD(SREJ_LIST(sk));
-}
-
-static struct proto l2cap_proto = {
-        .name           = "L2CAP",
-        .owner          = THIS_MODULE,
-        .obj_size       = sizeof(struct l2cap_pinfo)
-};
-
-static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
-{
-        struct sock *sk;
-
-        sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
-        if (!sk)
-                return NULL;
-
-        sock_init_data(sock, sk);
-        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
-
-        sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
-
-        sock_reset_flag(sk, SOCK_ZAPPED);
-
-        sk->sk_protocol = proto;
-        sk->sk_state = BT_OPEN;
-
-        setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
-
-        bt_sock_link(&l2cap_sk_list, sk);
-        return sk;
-}
-
-static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
-                             int kern)
-{
-        struct sock *sk;
-
-        BT_DBG("sock %p", sock);
-
-        sock->state = SS_UNCONNECTED;
-
-        if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
-                        sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
-                return -ESOCKTNOSUPPORT;
-
-        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
-                return -EPERM;
-
-        sock->ops = &l2cap_sock_ops;
-
-        sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
-        if (!sk)
-                return -ENOMEM;
-
-        l2cap_sock_init(sk, NULL);
-        return 0;
-}
-
-static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
-{
-        struct sock *sk = sock->sk;
-        struct sockaddr_l2 la;
-        int len, err = 0;
-
-        BT_DBG("sk %p", sk);
-
-        if (!addr || addr->sa_family != AF_BLUETOOTH)
-                return -EINVAL;
-
-        memset(&la, 0, sizeof(la));
-        len = min_t(unsigned int, sizeof(la), alen);
-        memcpy(&la, addr, len);
-
-        if (la.l2_cid)
-                return -EINVAL;
-
-        lock_sock(sk);
-
-        if (sk->sk_state != BT_OPEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
-        if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
-                                !capable(CAP_NET_BIND_SERVICE)) {
-                err = -EACCES;
-                goto done;
-        }
-
-        write_lock_bh(&l2cap_sk_list.lock);
-
-        if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
-                err = -EADDRINUSE;
-        } else {
-                /* Save source address */
-                bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
-                l2cap_pi(sk)->psm   = la.l2_psm;
-                l2cap_pi(sk)->sport = la.l2_psm;
-                sk->sk_state = BT_BOUND;
-
-                if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
-                                        __le16_to_cpu(la.l2_psm) == 0x0003)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        }
-
-        write_unlock_bh(&l2cap_sk_list.lock);
-
-done:
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_do_connect(struct sock *sk)
-{
-        bdaddr_t *src = &bt_sk(sk)->src;
-        bdaddr_t *dst = &bt_sk(sk)->dst;
-        struct l2cap_conn *conn;
-        struct hci_conn *hcon;
-        struct hci_dev *hdev;
-        __u8 auth_type;
-        int err;
-
-        BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
-                                                        l2cap_pi(sk)->psm);
-
-        hdev = hci_get_route(dst, src);
-        if (!hdev)
-                return -EHOSTUNREACH;
-
-        hci_dev_lock_bh(hdev);
-
-        err = -ENOMEM;
-
-        if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
-
-        hcon = hci_connect(hdev, ACL_LINK, dst,
-                                        l2cap_pi(sk)->sec_level, auth_type);
-        if (!hcon)
-                goto done;
-
-        conn = l2cap_conn_add(hcon, 0);
-        if (!conn) {
-                hci_conn_put(hcon);
-                goto done;
-        }
-
-        err = 0;
-
-        /* Update source addr of the socket */
-        bacpy(src, conn->src);
-
-        l2cap_chan_add(conn, sk, NULL);
-
-        sk->sk_state = BT_CONNECT;
-        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-
-        if (hcon->state == BT_CONNECTED) {
-                if (sk->sk_type != SOCK_SEQPACKET &&
-                                sk->sk_type != SOCK_STREAM) {
-                        l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
-                } else
-                        l2cap_do_start(sk);
-        }
-
-done:
-        hci_dev_unlock_bh(hdev);
-        hci_dev_put(hdev);
-        return err;
-}
-
-static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct sockaddr_l2 la;
-        int len, err = 0;
-
-        BT_DBG("sk %p", sk);
-
-        if (!addr || alen < sizeof(addr->sa_family) ||
-            addr->sa_family != AF_BLUETOOTH)
-                return -EINVAL;
-
-        memset(&la, 0, sizeof(la));
-        len = min_t(unsigned int, sizeof(la), alen);
-        memcpy(&la, addr, len);
-
-        if (la.l2_cid)
-                return -EINVAL;
-
-        lock_sock(sk);
-
-        if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
-                        && !la.l2_psm) {
-                err = -EINVAL;
-                goto done;
-        }
-
-        switch (l2cap_pi(sk)->mode) {
-        case L2CAP_MODE_BASIC:
-                break;
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                if (!disable_ertm)
-                        break;
-                /* fall through */
-        default:
-                err = -ENOTSUPP;
-                goto done;
-        }
-
-        switch (sk->sk_state) {
-        case BT_CONNECT:
-        case BT_CONNECT2:
-        case BT_CONFIG:
-                /* Already connecting */
-                goto wait;
-
-        case BT_CONNECTED:
-                /* Already connected */
-                err = -EISCONN;
-                goto done;
-
-        case BT_OPEN:
-        case BT_BOUND:
-                /* Can connect */
-                break;
-
-        default:
-                err = -EBADFD;
-                goto done;
-        }
-
-        /* Set destination address and psm */
-        bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
-        l2cap_pi(sk)->psm = la.l2_psm;
-
-        err = l2cap_do_connect(sk);
-        if (err)
-                goto done;
-
-wait:
-        err = bt_sock_wait_state(sk, BT_CONNECTED,
-                        sock_sndtimeo(sk, flags & O_NONBLOCK));
-done:
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_listen(struct socket *sock, int backlog)
-{
-        struct sock *sk = sock->sk;
-        int err = 0;
-
-        BT_DBG("sk %p backlog %d", sk, backlog);
-
-        lock_sock(sk);
-
-        if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
-                        || sk->sk_state != BT_BOUND) {
-                err = -EBADFD;
-                goto done;
-        }
-
-        switch (l2cap_pi(sk)->mode) {
-        case L2CAP_MODE_BASIC:
-                break;
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                if (!disable_ertm)
-                        break;
-                /* fall through */
-        default:
-                err = -ENOTSUPP;
-                goto done;
-        }
-
-        if (!l2cap_pi(sk)->psm) {
-                bdaddr_t *src = &bt_sk(sk)->src;
-                u16 psm;
-
-                err = -EINVAL;
-
-                write_lock_bh(&l2cap_sk_list.lock);
-
-                for (psm = 0x1001; psm < 0x1100; psm += 2)
-                        if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
-                                l2cap_pi(sk)->psm   = cpu_to_le16(psm);
-                                l2cap_pi(sk)->sport = cpu_to_le16(psm);
-                                err = 0;
-                                break;
-                        }
-
-                write_unlock_bh(&l2cap_sk_list.lock);
-
-                if (err < 0)
-                        goto done;
-        }
-
-        sk->sk_max_ack_backlog = backlog;
-        sk->sk_ack_backlog = 0;
-        sk->sk_state = BT_LISTEN;
-
-done:
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        struct sock *sk = sock->sk, *nsk;
-        long timeo;
-        int err = 0;
-
-        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
-
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
-        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
-
-        BT_DBG("sk %p timeo %ld", sk, timeo);
-
-        /* Wait for an incoming connection. (wake-one). */
-        add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
-                set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
-                        break;
-                }
-
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
-
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
-                        break;
-                }
-
-                if (signal_pending(current)) {
-                        err = sock_intr_errno(timeo);
-                        break;
-                }
-        }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
-
-        if (err)
-                goto done;
-
-        newsock->state = SS_CONNECTED;
-
-        BT_DBG("new socket %p", nsk);
-
-done:
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
-{
-        struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
-        struct sock *sk = sock->sk;
-
-        BT_DBG("sock %p, sk %p", sock, sk);
-
-        addr->sa_family = AF_BLUETOOTH;
-        *len = sizeof(struct sockaddr_l2);
-
-        if (peer) {
-                la->l2_psm = l2cap_pi(sk)->psm;
-                bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
-                la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        } else {
-                la->l2_psm = l2cap_pi(sk)->sport;
-                bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
-                la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
-        }
-
-        return 0;
-}
-
-static int __l2cap_wait_ack(struct sock *sk)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        int err = 0;
-        int timeo = HZ/5;
-
-        add_wait_queue(sk_sleep(sk), &wait);
-        while ((l2cap_pi(sk)->unacked_frames > 0 && l2cap_pi(sk)->conn)) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (!timeo)
-                        timeo = HZ/5;
-
-                if (signal_pending(current)) {
-                        err = sock_intr_errno(timeo);
-                        break;
-                }
-
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
-
-                err = sock_error(sk);
-                if (err)
-                        break;
-        }
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
-        return err;
-}
-
-static void l2cap_monitor_timeout(unsigned long arg)
-{
-        struct sock *sk = (void *) arg;
-
-        BT_DBG("sk %p", sk);
-
-        bh_lock_sock(sk);
-        if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
-                l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk, ECONNABORTED);
-                bh_unlock_sock(sk);
-                return;
-        }
-
-        l2cap_pi(sk)->retry_count++;
-        __mod_monitor_timer();
-
-        l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
-        bh_unlock_sock(sk);
-}
-
-static void l2cap_retrans_timeout(unsigned long arg)
-{
-        struct sock *sk = (void *) arg;
-
-        BT_DBG("sk %p", sk);
-
-        bh_lock_sock(sk);
-        l2cap_pi(sk)->retry_count = 1;
-        __mod_monitor_timer();
-
-        l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
-
-        l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
-        bh_unlock_sock(sk);
-}
-
-static void l2cap_drop_acked_frames(struct sock *sk)
-{
-        struct sk_buff *skb;
-
-        while ((skb = skb_peek(TX_QUEUE(sk))) &&
-                        l2cap_pi(sk)->unacked_frames) {
-                if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
-                        break;
-
-                skb = skb_dequeue(TX_QUEUE(sk));
-                kfree_skb(skb);
-
-                l2cap_pi(sk)->unacked_frames--;
-        }
-
-        if (!l2cap_pi(sk)->unacked_frames)
-                del_timer(&l2cap_pi(sk)->retrans_timer);
-}
-
-static inline void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-
-        BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
-
-        hci_send_acl(pi->conn->hcon, skb, 0);
-}
-
-static void l2cap_streaming_send(struct sock *sk)
-{
-        struct sk_buff *skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u16 control, fcs;
-
-        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
-                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
-                control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
-                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
-
-                if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
-                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
-                }
-
-                l2cap_do_send(sk, skb);
-
-                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-        }
-}
-
-static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *skb, *tx_skb;
-        u16 control, fcs;
-
-        skb = skb_peek(TX_QUEUE(sk));
-        if (!skb)
-                return;
-
-        do {
-                if (bt_cb(skb)->tx_seq == tx_seq)
-                        break;
-
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        return;
-
-        } while ((skb = skb_queue_next(TX_QUEUE(sk), skb)));
-
-        if (pi->remote_max_tx &&
-                        bt_cb(skb)->retries == pi->remote_max_tx) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
-                return;
-        }
-
-        tx_skb = skb_clone(skb, GFP_ATOMIC);
-        bt_cb(skb)->retries++;
-        control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-
-        if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
-                control |= L2CAP_CTRL_FINAL;
-                pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-        }
-
-        control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
-                        | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
-
-        put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
-
-        if (pi->fcs == L2CAP_FCS_CRC16) {
-                fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
-                put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
-        }
-
-        l2cap_do_send(sk, tx_skb);
-}
-
-static int l2cap_ertm_send(struct sock *sk)
-{
-        struct sk_buff *skb, *tx_skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u16 control, fcs;
-        int nsent = 0;
-
-        if (sk->sk_state != BT_CONNECTED)
-                return -ENOTCONN;
-
-        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))) {
-
-                if (pi->remote_max_tx &&
-                                bt_cb(skb)->retries == pi->remote_max_tx) {
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
-                        break;
-                }
-
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
-
-                bt_cb(skb)->retries++;
-
-                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-                control &= L2CAP_CTRL_SAR;
-
-                if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
-                        control |= L2CAP_CTRL_FINAL;
-                        pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
-                }
-                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
-                                | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
-                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
-
-
-                if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
-                        put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
-                }
-
-                l2cap_do_send(sk, tx_skb);
-
-                __mod_retrans_timer();
-
-                bt_cb(skb)->tx_seq = pi->next_tx_seq;
-                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-
-                pi->unacked_frames++;
-                pi->frames_sent++;
-
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
-                else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
-
-                nsent++;
-        }
-
-        return nsent;
-}
-
-static int l2cap_retransmit_frames(struct sock *sk)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        int ret;
-
-        if (!skb_queue_empty(TX_QUEUE(sk)))
-                sk->sk_send_head = TX_QUEUE(sk)->next;
-
-        pi->next_tx_seq = pi->expected_ack_seq;
-        ret = l2cap_ertm_send(sk);
-        return ret;
-}
-
-static void l2cap_send_ack(struct l2cap_pinfo *pi)
-{
-        struct sock *sk = (struct sock *)pi;
-        u16 control = 0;
-
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
-                control |= L2CAP_SUPER_RCV_NOT_READY;
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
-                l2cap_send_sframe(pi, control);
-                return;
-        }
-
-        if (l2cap_ertm_send(sk) > 0)
-                return;
-
-        control |= L2CAP_SUPER_RCV_READY;
-        l2cap_send_sframe(pi, control);
-}
-
-static void l2cap_send_srejtail(struct sock *sk)
-{
-        struct srej_list *tail;
-        u16 control;
-
-        control = L2CAP_SUPER_SELECT_REJECT;
-        control |= L2CAP_CTRL_FINAL;
-
-        tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
-        control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-
-        l2cap_send_sframe(l2cap_pi(sk), control);
-}
-
-static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sk_buff **frag;
-        int err, sent = 0;
-
-        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
-                return -EFAULT;
-
-        sent += count;
-        len  -= count;
-
-        /* Continuation fragments (no L2CAP header) */
-        frag = &skb_shinfo(skb)->frag_list;
-        while (len) {
-                count = min_t(unsigned int, conn->mtu, len);
-
-                *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
-                if (!*frag)
-                        return -EFAULT;
-                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
-                        return -EFAULT;
-
-                sent += count;
-                len  -= count;
-
-                frag = &(*frag)->next;
-        }
-
-        return sent;
-}
-
-static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sk_buff *skb;
-        int err, count, hlen = L2CAP_HDR_SIZE + 2;
-        struct l2cap_hdr *lh;
-
-        BT_DBG("sk %p len %d", sk, (int)len);
-
-        count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(-ENOMEM);
-
-        /* Create L2CAP header */
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
-        put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
-
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
-        if (unlikely(err < 0)) {
-                kfree_skb(skb);
-                return ERR_PTR(err);
-        }
-        return skb;
-}
-
-static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sk_buff *skb;
-        int err, count, hlen = L2CAP_HDR_SIZE;
-        struct l2cap_hdr *lh;
-
-        BT_DBG("sk %p len %d", sk, (int)len);
-
-        count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(-ENOMEM);
-
-        /* Create L2CAP header */
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
-
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
-        if (unlikely(err < 0)) {
-                kfree_skb(skb);
-                return ERR_PTR(err);
-        }
-        return skb;
-}
-
-static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
-{
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        struct sk_buff *skb;
-        int err, count, hlen = L2CAP_HDR_SIZE + 2;
-        struct l2cap_hdr *lh;
-
-        BT_DBG("sk %p len %d", sk, (int)len);
-
-        if (!conn)
-                return ERR_PTR(-ENOTCONN);
-
-        if (sdulen)
-                hlen += 2;
-
-        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
-                hlen += 2;
-
-        count = min_t(unsigned int, (conn->mtu - hlen), len);
-        skb = bt_skb_send_alloc(sk, count + hlen,
-                        msg->msg_flags & MSG_DONTWAIT, &err);
-        if (!skb)
-                return ERR_PTR(-ENOMEM);
-
-        /* Create L2CAP header */
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
-        put_unaligned_le16(control, skb_put(skb, 2));
-        if (sdulen)
-                put_unaligned_le16(sdulen, skb_put(skb, 2));
-
-        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
-        if (unlikely(err < 0)) {
-                kfree_skb(skb);
-                return ERR_PTR(err);
-        }
-
-        if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
-                put_unaligned_le16(0, skb_put(skb, 2));
-
-        bt_cb(skb)->retries = 0;
-        return skb;
-}
-
-static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *skb;
-        struct sk_buff_head sar_queue;
-        u16 control;
-        size_t size = 0;
-
-        skb_queue_head_init(&sar_queue);
-        control = L2CAP_SDU_START;
-        skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
-        if (IS_ERR(skb))
-                return PTR_ERR(skb);
-
-        __skb_queue_tail(&sar_queue, skb);
-        len -= pi->remote_mps;
-        size += pi->remote_mps;
-
-        while (len > 0) {
-                size_t buflen;
-
-                if (len > pi->remote_mps) {
-                        control = L2CAP_SDU_CONTINUE;
-                        buflen = pi->remote_mps;
-                } else {
-                        control = L2CAP_SDU_END;
-                        buflen = len;
-                }
-
-                skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
-                if (IS_ERR(skb)) {
-                        skb_queue_purge(&sar_queue);
-                        return PTR_ERR(skb);
-                }
-
-                __skb_queue_tail(&sar_queue, skb);
-                len -= buflen;
-                size += buflen;
-        }
-        skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
-        if (sk->sk_send_head == NULL)
-                sk->sk_send_head = sar_queue.next;
-
-        return size;
-}
-
-static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
-{
-        struct sock *sk = sock->sk;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *skb;
-        u16 control;
-        int err;
-
-        BT_DBG("sock %p, sk %p", sock, sk);
-
-        err = sock_error(sk);
-        if (err)
-                return err;
-
-        if (msg->msg_flags & MSG_OOB)
-                return -EOPNOTSUPP;
-
-        lock_sock(sk);
-
-        if (sk->sk_state != BT_CONNECTED) {
-                err = -ENOTCONN;
-                goto done;
-        }
-
-        /* Connectionless channel */
-        if (sk->sk_type == SOCK_DGRAM) {
-                skb = l2cap_create_connless_pdu(sk, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                } else {
-                        l2cap_do_send(sk, skb);
-                        err = len;
-                }
-                goto done;
-        }
-
-        switch (pi->mode) {
-        case L2CAP_MODE_BASIC:
-                /* Check outgoing MTU */
-                if (len > pi->omtu) {
-                        err = -EMSGSIZE;
-                        goto done;
-                }
-
-                /* Create a basic PDU */
-                skb = l2cap_create_basic_pdu(sk, msg, len);
-                if (IS_ERR(skb)) {
-                        err = PTR_ERR(skb);
-                        goto done;
-                }
-
-                l2cap_do_send(sk, skb);
-                err = len;
-                break;
-
-        case L2CAP_MODE_ERTM:
-        case L2CAP_MODE_STREAMING:
-                /* Entire SDU fits into one PDU */
-                if (len <= pi->remote_mps) {
-                        control = L2CAP_SDU_UNSEGMENTED;
-                        skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
-                        if (IS_ERR(skb)) {
-                                err = PTR_ERR(skb);
-                                goto done;
-                        }
-                        __skb_queue_tail(TX_QUEUE(sk), skb);
-
-                        if (sk->sk_send_head == NULL)
-                                sk->sk_send_head = skb;
-
-                } else {
-                /* Segment SDU into multiples PDUs */
-                        err = l2cap_sar_segment_sdu(sk, msg, len);
-                        if (err < 0)
-                                goto done;
-                }
-
-                if (pi->mode == L2CAP_MODE_STREAMING) {
-                        l2cap_streaming_send(sk);
-                } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
-                                err = len;
-                                break;
-                        }
-                        err = l2cap_ertm_send(sk);
-                }
-
-                if (err >= 0)
-                        err = len;
-                break;
-
-        default:
-                BT_DBG("bad state %1.1x", pi->mode);
-                err = -EBADFD;
-        }
-
-done:
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
-{
-        struct sock *sk = sock->sk;
-
-        lock_sock(sk);
-
-        if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
-                struct l2cap_conn_rsp rsp;
-                struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-                u8 buf[128];
-
-                sk->sk_state = BT_CONFIG;
-
-                rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
-                rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
-                rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) {
-                        release_sock(sk);
-                        return 0;
-                }
-
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
-
-                release_sock(sk);
-                return 0;
-        }
-
-        release_sock(sk);
-
-        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
-}
-
-static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
-{
-        struct sock *sk = sock->sk;
-        struct l2cap_options opts;
-        int len, err = 0;
-        u32 opt;
-
-        BT_DBG("sk %p", sk);
-
-        lock_sock(sk);
-
-        switch (optname) {
-        case L2CAP_OPTIONS:
-                if (sk->sk_state == BT_CONNECTED) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                opts.imtu     = l2cap_pi(sk)->imtu;
-                opts.omtu     = l2cap_pi(sk)->omtu;
-                opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = l2cap_pi(sk)->mode;
-                opts.fcs      = l2cap_pi(sk)->fcs;
-                opts.max_tx   = l2cap_pi(sk)->max_tx;
-                opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
-
-                len = min_t(unsigned int, sizeof(opts), optlen);
-                if (copy_from_user((char *) &opts, optval, len)) {
-                        err = -EFAULT;
-                        break;
-                }
-
-                if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                l2cap_pi(sk)->mode = opts.mode;
-                switch (l2cap_pi(sk)->mode) {
-                case L2CAP_MODE_BASIC:
-                        l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
-                        break;
-                case L2CAP_MODE_ERTM:
-                case L2CAP_MODE_STREAMING:
-                        if (!disable_ertm)
-                                break;
-                        /* fall through */
-                default:
-                        err = -EINVAL;
-                        break;
-                }
-
-                l2cap_pi(sk)->imtu = opts.imtu;
-                l2cap_pi(sk)->omtu = opts.omtu;
-                l2cap_pi(sk)->fcs  = opts.fcs;
-                l2cap_pi(sk)->max_tx = opts.max_tx;
-                l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
-                break;
-
-        case L2CAP_LM:
-                if (get_user(opt, (u32 __user *) optval)) {
-                        err = -EFAULT;
-                        break;
-                }
-
-                if (opt & L2CAP_LM_AUTH)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
-                if (opt & L2CAP_LM_ENCRYPT)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
-                if (opt & L2CAP_LM_SECURE)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
-
-                l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
-                l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
-                break;
-
-        default:
-                err = -ENOPROTOOPT;
-                break;
-        }
-
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
-{
-        struct sock *sk = sock->sk;
-        struct bt_security sec;
-        int len, err = 0;
-        u32 opt;
-
-        BT_DBG("sk %p", sk);
-
-        if (level == SOL_L2CAP)
-                return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
-
-        if (level != SOL_BLUETOOTH)
-                return -ENOPROTOOPT;
-
-        lock_sock(sk);
-
-        switch (optname) {
-        case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                sec.level = BT_SECURITY_LOW;
-
-                len = min_t(unsigned int, sizeof(sec), optlen);
-                if (copy_from_user((char *) &sec, optval, len)) {
-                        err = -EFAULT;
-                        break;
-                }
-
-                if (sec.level < BT_SECURITY_LOW ||
-                                        sec.level > BT_SECURITY_HIGH) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                l2cap_pi(sk)->sec_level = sec.level;
-                break;
-
-        case BT_DEFER_SETUP:
-                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                if (get_user(opt, (u32 __user *) optval)) {
-                        err = -EFAULT;
-                        break;
-                }
-
-                bt_sk(sk)->defer_setup = opt;
-                break;
-
-        default:
-                err = -ENOPROTOOPT;
-                break;
-        }
-
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
-{
-        struct sock *sk = sock->sk;
-        struct l2cap_options opts;
-        struct l2cap_conninfo cinfo;
-        int len, err = 0;
-        u32 opt;
-
-        BT_DBG("sk %p", sk);
-
-        if (get_user(len, optlen))
-                return -EFAULT;
-
-        lock_sock(sk);
-
-        switch (optname) {
-        case L2CAP_OPTIONS:
-                opts.imtu     = l2cap_pi(sk)->imtu;
-                opts.omtu     = l2cap_pi(sk)->omtu;
-                opts.flush_to = l2cap_pi(sk)->flush_to;
-                opts.mode     = l2cap_pi(sk)->mode;
-                opts.fcs      = l2cap_pi(sk)->fcs;
-                opts.max_tx   = l2cap_pi(sk)->max_tx;
-                opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
-
-                len = min_t(unsigned int, len, sizeof(opts));
-                if (copy_to_user(optval, (char *) &opts, len))
-                        err = -EFAULT;
-
-                break;
-
-        case L2CAP_LM:
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_LOW:
-                        opt = L2CAP_LM_AUTH;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
-                        break;
-                case BT_SECURITY_HIGH:
-                        opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
-                                                        L2CAP_LM_SECURE;
-                        break;
-                default:
-                        opt = 0;
-                        break;
-                }
-
-                if (l2cap_pi(sk)->role_switch)
-                        opt |= L2CAP_LM_MASTER;
-
-                if (l2cap_pi(sk)->force_reliable)
-                        opt |= L2CAP_LM_RELIABLE;
-
-                if (put_user(opt, (u32 __user *) optval))
-                        err = -EFAULT;
-                break;
-
-        case L2CAP_CONNINFO:
-                if (sk->sk_state != BT_CONNECTED &&
-                                        !(sk->sk_state == BT_CONNECT2 &&
-                                                bt_sk(sk)->defer_setup)) {
-                        err = -ENOTCONN;
-                        break;
-                }
-
-                cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
-                memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
-
-                len = min_t(unsigned int, len, sizeof(cinfo));
-                if (copy_to_user(optval, (char *) &cinfo, len))
-                        err = -EFAULT;
-
-                break;
-
-        default:
-                err = -ENOPROTOOPT;
-                break;
-        }
-
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
-{
-        struct sock *sk = sock->sk;
-        struct bt_security sec;
-        int len, err = 0;
-
-        BT_DBG("sk %p", sk);
-
-        if (level == SOL_L2CAP)
-                return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
-
-        if (level != SOL_BLUETOOTH)
-                return -ENOPROTOOPT;
-
-        if (get_user(len, optlen))
-                return -EFAULT;
-
-        lock_sock(sk);
-
-        switch (optname) {
-        case BT_SECURITY:
-                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
-                                && sk->sk_type != SOCK_RAW) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                sec.level = l2cap_pi(sk)->sec_level;
-
-                len = min_t(unsigned int, len, sizeof(sec));
-                if (copy_to_user(optval, (char *) &sec, len))
-                        err = -EFAULT;
-
-                break;
-
-        case BT_DEFER_SETUP:
-                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
-                        err = -EINVAL;
-                        break;
-                }
-
-                if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
-                        err = -EFAULT;
-
-                break;
-
-        default:
-                err = -ENOPROTOOPT;
-                break;
-        }
-
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_shutdown(struct socket *sock, int how)
-{
-        struct sock *sk = sock->sk;
-        int err = 0;
-
-        BT_DBG("sock %p, sk %p", sock, sk);
-
-        if (!sk)
-                return 0;
-
-        lock_sock(sk);
-        if (!sk->sk_shutdown) {
-                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
-                        err = __l2cap_wait_ack(sk);
-
-                sk->sk_shutdown = SHUTDOWN_MASK;
-                l2cap_sock_clear_timer(sk);
-                __l2cap_sock_close(sk, 0);
-
-                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
-                        err = bt_sock_wait_state(sk, BT_CLOSED,
-                                                        sk->sk_lingertime);
-        }
-
-        if (!err && sk->sk_err)
-                err = -sk->sk_err;
-
-        release_sock(sk);
-        return err;
-}
-
-static int l2cap_sock_release(struct socket *sock)
-{
-        struct sock *sk = sock->sk;
-        int err;
-
-        BT_DBG("sock %p, sk %p", sock, sk);
-
-        if (!sk)
-                return 0;
-
-        err = l2cap_sock_shutdown(sock, 2);
-
-        sock_orphan(sk);
-        l2cap_sock_kill(sk);
-        return err;
-}
-
-static void l2cap_chan_ready(struct sock *sk)
-{
-        struct sock *parent = bt_sk(sk)->parent;
-
-        BT_DBG("sk %p, parent %p", sk, parent);
-
-        l2cap_pi(sk)->conf_state = 0;
-        l2cap_sock_clear_timer(sk);
-
-        if (!parent) {
-                /* Outgoing channel.
-                 * Wake up socket sleeping on connect.
-                 */
-                sk->sk_state = BT_CONNECTED;
-                sk->sk_state_change(sk);
-        } else {
-                /* Incoming channel.
-                 * Wake up socket sleeping on accept.
-                 */
-                parent->sk_data_ready(parent, 0);
-        }
-}
-
-/* Copy frame to all raw sockets on that connection */
-static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
-{
-        struct l2cap_chan_list *l = &conn->chan_list;
-        struct sk_buff *nskb;
-        struct sock *sk;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                if (sk->sk_type != SOCK_RAW)
-                        continue;
-
-                /* Don't send frame to the socket it came from */
-                if (skb->sk == sk)
-                        continue;
-                nskb = skb_clone(skb, GFP_ATOMIC);
-                if (!nskb)
-                        continue;
-
-                if (sock_queue_rcv_skb(sk, nskb))
-                        kfree_skb(nskb);
-        }
-        read_unlock(&l->lock);
-}
-
-/* ---- L2CAP signalling commands ---- */
-static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
-                                u8 code, u8 ident, u16 dlen, void *data)
-{
-        struct sk_buff *skb, **frag;
-        struct l2cap_cmd_hdr *cmd;
-        struct l2cap_hdr *lh;
-        int len, count;
-
-        BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
-                        conn, code, ident, dlen);
-
-        len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
-        count = min_t(unsigned int, conn->mtu, len);
-
-        skb = bt_skb_alloc(count, GFP_ATOMIC);
-        if (!skb)
-                return NULL;
-
-        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
-        lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
-        lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
-
-        cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
-        cmd->code  = code;
-        cmd->ident = ident;
-        cmd->len   = cpu_to_le16(dlen);
-
-        if (dlen) {
-                count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
-                memcpy(skb_put(skb, count), data, count);
-                data += count;
-        }
-
-        len -= skb->len;
-
-        /* Continuation fragments (no L2CAP header) */
-        frag = &skb_shinfo(skb)->frag_list;
-        while (len) {
-                count = min_t(unsigned int, conn->mtu, len);
-
-                *frag = bt_skb_alloc(count, GFP_ATOMIC);
-                if (!*frag)
-                        goto fail;
-
-                memcpy(skb_put(*frag, count), data, count);
-
-                len  -= count;
-                data += count;
-
-                frag = &(*frag)->next;
-        }
-
-        return skb;
-
-fail:
-        kfree_skb(skb);
-        return NULL;
-}
-
-static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
-{
-        struct l2cap_conf_opt *opt = *ptr;
-        int len;
-
-        len = L2CAP_CONF_OPT_SIZE + opt->len;
-        *ptr += len;
-
-        *type = opt->type;
-        *olen = opt->len;
-
-        switch (opt->len) {
-        case 1:
-                *val = *((u8 *) opt->val);
-                break;
-
-        case 2:
-                *val = __le16_to_cpu(*((__le16 *) opt->val));
-                break;
-
-        case 4:
-                *val = __le32_to_cpu(*((__le32 *) opt->val));
-                break;
-
-        default:
-                *val = (unsigned long) opt->val;
-                break;
-        }
-
-        BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
-        return len;
-}
-
-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
-{
-        struct l2cap_conf_opt *opt = *ptr;
-
-        BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
-
-        opt->type = type;
-        opt->len  = len;
-
-        switch (len) {
-        case 1:
-                *((u8 *) opt->val)  = val;
-                break;
-
-        case 2:
-                *((__le16 *) opt->val) = cpu_to_le16(val);
-                break;
-
-        case 4:
-                *((__le32 *) opt->val) = cpu_to_le32(val);
-                break;
-
-        default:
-                memcpy(opt->val, (void *) val, len);
-                break;
-        }
-
-        *ptr += L2CAP_CONF_OPT_SIZE + len;
-}
-
-static void l2cap_ack_timeout(unsigned long arg)
-{
-        struct sock *sk = (void *) arg;
-
-        bh_lock_sock(sk);
-        l2cap_send_ack(l2cap_pi(sk));
-        bh_unlock_sock(sk);
-}
-
-static inline void l2cap_ertm_init(struct sock *sk)
-{
-        l2cap_pi(sk)->expected_ack_seq = 0;
-        l2cap_pi(sk)->unacked_frames = 0;
-        l2cap_pi(sk)->buffer_seq = 0;
-        l2cap_pi(sk)->num_acked = 0;
-        l2cap_pi(sk)->frames_sent = 0;
-
-        setup_timer(&l2cap_pi(sk)->retrans_timer,
-                        l2cap_retrans_timeout, (unsigned long) sk);
-        setup_timer(&l2cap_pi(sk)->monitor_timer,
-                        l2cap_monitor_timeout, (unsigned long) sk);
-        setup_timer(&l2cap_pi(sk)->ack_timer,
-                        l2cap_ack_timeout, (unsigned long) sk);
-
-        __skb_queue_head_init(SREJ_QUEUE(sk));
-        __skb_queue_head_init(BUSY_QUEUE(sk));
-
-        INIT_WORK(&l2cap_pi(sk)->busy_work, l2cap_busy_work);
-
-        sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
-}
-
-static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
-{
-        switch (mode) {
-        case L2CAP_MODE_STREAMING:
-        case L2CAP_MODE_ERTM:
-                if (l2cap_mode_supported(mode, remote_feat_mask))
-                        return mode;
-                /* fall through */
-        default:
-                return L2CAP_MODE_BASIC;
-        }
-}
-
-static int l2cap_build_conf_req(struct sock *sk, void *data)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct l2cap_conf_req *req = data;
-        struct l2cap_conf_rfc rfc = { .mode = pi->mode };
-        void *ptr = req->data;
-
-        BT_DBG("sk %p", sk);
-
-        if (pi->num_conf_req || pi->num_conf_rsp)
-                goto done;
-
-        switch (pi->mode) {
-        case L2CAP_MODE_STREAMING:
-        case L2CAP_MODE_ERTM:
-                if (pi->conf_state & L2CAP_CONF_STATE2_DEVICE)
-                        break;
-
-                /* fall through */
-        default:
-                pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
-                break;
-        }
-
-done:
-        switch (pi->mode) {
-        case L2CAP_MODE_BASIC:
-                if (pi->imtu != L2CAP_DEFAULT_MTU)
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
-
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_ERTM) &&
-                                !(pi->conn->feat_mask & L2CAP_FEAT_STREAMING))
-                        break;
-
-                rfc.mode            = L2CAP_MODE_BASIC;
-                rfc.txwin_size      = 0;
-                rfc.max_transmit    = 0;
-                rfc.retrans_timeout = 0;
-                rfc.monitor_timeout = 0;
-                rfc.max_pdu_size    = 0;
-
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                                        (unsigned long) &rfc);
-                break;
-
-        case L2CAP_MODE_ERTM:
-                rfc.mode            = L2CAP_MODE_ERTM;
-                rfc.txwin_size      = pi->tx_win;
-                rfc.max_transmit    = pi->max_tx;
-                rfc.retrans_timeout = 0;
-                rfc.monitor_timeout = 0;
-                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
-                if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
-                        rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
-
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                                        (unsigned long) &rfc);
-
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
-                        break;
-
-                if (pi->fcs == L2CAP_FCS_NONE ||
-                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
-                        pi->fcs = L2CAP_FCS_NONE;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
-                }
-                break;
-
-        case L2CAP_MODE_STREAMING:
-                rfc.mode            = L2CAP_MODE_STREAMING;
-                rfc.txwin_size      = 0;
-                rfc.max_transmit    = 0;
-                rfc.retrans_timeout = 0;
-                rfc.monitor_timeout = 0;
-                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
-                if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
-                        rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
-
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
-                                                        (unsigned long) &rfc);
-
-                if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
-                        break;
-
-                if (pi->fcs == L2CAP_FCS_NONE ||
-                                pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
-                        pi->fcs = L2CAP_FCS_NONE;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
-                }
-                break;
-        }
-
-        /* FIXME: Need actual value of the flush timeout */
-        //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
-        //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
-
-        req->dcid  = cpu_to_le16(pi->dcid);
-        req->flags = cpu_to_le16(0);
-
-        return ptr - data;
-}
-
-static int l2cap_parse_conf_req(struct sock *sk, void *data)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct l2cap_conf_rsp *rsp = data;
-        void *ptr = rsp->data;
-        void *req = pi->conf_req;
-        int len = pi->conf_len;
-        int type, hint, olen;
-        unsigned long val;
-        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
-        u16 mtu = L2CAP_DEFAULT_MTU;
-        u16 result = L2CAP_CONF_SUCCESS;
-
-        BT_DBG("sk %p", sk);
-
-        while (len >= L2CAP_CONF_OPT_SIZE) {
-                len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
-
-                hint  = type & L2CAP_CONF_HINT;
-                type &= L2CAP_CONF_MASK;
-
-                switch (type) {
-                case L2CAP_CONF_MTU:
-                        mtu = val;
-                        break;
-
-                case L2CAP_CONF_FLUSH_TO:
-                        pi->flush_to = val;
-                        break;
-
-                case L2CAP_CONF_QOS:
-                        break;
-
-                case L2CAP_CONF_RFC:
-                        if (olen == sizeof(rfc))
-                                memcpy(&rfc, (void *) val, olen);
-                        break;
-
-                case L2CAP_CONF_FCS:
-                        if (val == L2CAP_FCS_NONE)
-                                pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
-
-                        break;
-
-                default:
-                        if (hint)
-                                break;
-
-                        result = L2CAP_CONF_UNKNOWN;
-                        *((u8 *) ptr++) = type;
-                        break;
-                }
-        }
-
-        if (pi->num_conf_rsp || pi->num_conf_req > 1)
-                goto done;
-
-        switch (pi->mode) {
-        case L2CAP_MODE_STREAMING:
-        case L2CAP_MODE_ERTM:
-                if (!(pi->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
-                        pi->mode = l2cap_select_mode(rfc.mode,
-                                        pi->conn->feat_mask);
-                        break;
-                }
-
-                if (pi->mode != rfc.mode)
-                        return -ECONNREFUSED;
-
-                break;
-        }
-
-done:
-        if (pi->mode != rfc.mode) {
-                result = L2CAP_CONF_UNACCEPT;
-                rfc.mode = pi->mode;
-
-                if (pi->num_conf_rsp == 1)
-                        return -ECONNREFUSED;
-
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
-        }
-
-
-        if (result == L2CAP_CONF_SUCCESS) {
-                /* Configure output options and let the other side know
-                 * which ones we don't like. */
-
-                if (mtu < L2CAP_DEFAULT_MIN_MTU)
-                        result = L2CAP_CONF_UNACCEPT;
-                else {
-                        pi->omtu = mtu;
-                        pi->conf_state |= L2CAP_CONF_MTU_DONE;
-                }
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
-
-                switch (rfc.mode) {
-                case L2CAP_MODE_BASIC:
-                        pi->fcs = L2CAP_FCS_NONE;
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
-                        break;
-
-                case L2CAP_MODE_ERTM:
-                        pi->remote_tx_win = rfc.txwin_size;
-                        pi->remote_max_tx = rfc.max_transmit;
-
-                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
-
-                        pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
-
-                        rfc.retrans_timeout =
-                                le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
-                        rfc.monitor_timeout =
-                                le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
-
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
-
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
-
-                        break;
-
-                case L2CAP_MODE_STREAMING:
-                        if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
-                                rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
-
-                        pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
-
-                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
-
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
-
-                        break;
-
-                default:
-                        result = L2CAP_CONF_UNACCEPT;
-
-                        memset(&rfc, 0, sizeof(rfc));
-                        rfc.mode = pi->mode;
-                }
-
-                if (result == L2CAP_CONF_SUCCESS)
-                        pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
-        }
-        rsp->scid   = cpu_to_le16(pi->dcid);
-        rsp->result = cpu_to_le16(result);
-        rsp->flags  = cpu_to_le16(0x0000);
-
-        return ptr - data;
-}
-
-static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct l2cap_conf_req *req = data;
-        void *ptr = req->data;
-        int type, olen;
-        unsigned long val;
-        struct l2cap_conf_rfc rfc;
-
-        BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
-
-        while (len >= L2CAP_CONF_OPT_SIZE) {
-                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-
-                switch (type) {
-                case L2CAP_CONF_MTU:
-                        if (val < L2CAP_DEFAULT_MIN_MTU) {
-                                *result = L2CAP_CONF_UNACCEPT;
-                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
-                        } else
-                                pi->imtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
-                        break;
-
-                case L2CAP_CONF_FLUSH_TO:
-                        pi->flush_to = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
-                                                        2, pi->flush_to);
-                        break;
-
-                case L2CAP_CONF_RFC:
-                        if (olen == sizeof(rfc))
-                                memcpy(&rfc, (void *)val, olen);
-
-                        if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
-                                                        rfc.mode != pi->mode)
-                                return -ECONNREFUSED;
-
-                        pi->fcs = 0;
-
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
-                        break;
-                }
-        }
-
-        if (pi->mode == L2CAP_MODE_BASIC && pi->mode != rfc.mode)
-                return -ECONNREFUSED;
-
-        pi->mode = rfc.mode;
-
-        if (*result == L2CAP_CONF_SUCCESS) {
-                switch (rfc.mode) {
-                case L2CAP_MODE_ERTM:
-                        pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
-                        pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
-                        pi->mps    = le16_to_cpu(rfc.max_pdu_size);
-                        break;
-                case L2CAP_MODE_STREAMING:
-                        pi->mps    = le16_to_cpu(rfc.max_pdu_size);
-                }
-        }
-
-        req->dcid   = cpu_to_le16(pi->dcid);
-        req->flags  = cpu_to_le16(0x0000);
-
-        return ptr - data;
-}
-
-static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
-{
-        struct l2cap_conf_rsp *rsp = data;
-        void *ptr = rsp->data;
-
-        BT_DBG("sk %p", sk);
-
-        rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-        rsp->result = cpu_to_le16(result);
-        rsp->flags  = cpu_to_le16(flags);
-
-        return ptr - data;
-}
-
-static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        int type, olen;
-        unsigned long val;
-        struct l2cap_conf_rfc rfc;
-
-        BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
-
-        if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
-                return;
-
-        while (len >= L2CAP_CONF_OPT_SIZE) {
-                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
-
-                switch (type) {
-                case L2CAP_CONF_RFC:
-                        if (olen == sizeof(rfc))
-                                memcpy(&rfc, (void *)val, olen);
-                        goto done;
-                }
-        }
-
-done:
-        switch (rfc.mode) {
-        case L2CAP_MODE_ERTM:
-                pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
-                pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
-                pi->mps    = le16_to_cpu(rfc.max_pdu_size);
-                break;
-        case L2CAP_MODE_STREAMING:
-                pi->mps    = le16_to_cpu(rfc.max_pdu_size);
-        }
-}
-
-static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
-
-        if (rej->reason != 0x0000)
-                return 0;
-
-        if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
-                                        cmd->ident == conn->info_ident) {
-                del_timer(&conn->info_timer);
-
-                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
-                conn->info_ident = 0;
-
-                l2cap_conn_start(conn);
-        }
-
-        return 0;
-}
-
-static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_chan_list *list = &conn->chan_list;
-        struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
-        struct l2cap_conn_rsp rsp;
-        struct sock *parent, *uninitialized_var(sk);
-        int result, status = L2CAP_CS_NO_INFO;
-
-        u16 dcid = 0, scid = __le16_to_cpu(req->scid);
-        __le16 psm = req->psm;
-
-        BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
-
-        /* Check if we have socket listening on psm */
-        parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
-        if (!parent) {
-                result = L2CAP_CR_BAD_PSM;
-                goto sendresp;
-        }
-
-        /* Check if the ACL is secure enough (if not SDP) */
-        if (psm != cpu_to_le16(0x0001) &&
-                                !hci_conn_check_link_mode(conn->hcon)) {
-                conn->disc_reason = 0x05;
-                result = L2CAP_CR_SEC_BLOCK;
-                goto response;
-        }
-
-        result = L2CAP_CR_NO_MEM;
-
-        /* Check for backlog size */
-        if (sk_acceptq_is_full(parent)) {
-                BT_DBG("backlog full %d", parent->sk_ack_backlog);
-                goto response;
-        }
-
-        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
-        if (!sk)
-                goto response;
-
-        write_lock_bh(&list->lock);
-
-        /* Check if we already have channel with that dcid */
-        if (__l2cap_get_chan_by_dcid(list, scid)) {
-                write_unlock_bh(&list->lock);
-                sock_set_flag(sk, SOCK_ZAPPED);
-                l2cap_sock_kill(sk);
-                goto response;
-        }
-
-        hci_conn_hold(conn->hcon);
-
-        l2cap_sock_init(sk, parent);
-        bacpy(&bt_sk(sk)->src, conn->src);
-        bacpy(&bt_sk(sk)->dst, conn->dst);
-        l2cap_pi(sk)->psm  = psm;
-        l2cap_pi(sk)->dcid = scid;
-
-        __l2cap_chan_add(conn, sk, parent);
-        dcid = l2cap_pi(sk)->scid;
-
-        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
-
-        l2cap_pi(sk)->ident = cmd->ident;
-
-        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
-                if (l2cap_check_security(sk)) {
-                        if (bt_sk(sk)->defer_setup) {
-                                sk->sk_state = BT_CONNECT2;
-                                result = L2CAP_CR_PEND;
-                                status = L2CAP_CS_AUTHOR_PEND;
-                                parent->sk_data_ready(parent, 0);
-                        } else {
-                                sk->sk_state = BT_CONFIG;
-                                result = L2CAP_CR_SUCCESS;
-                                status = L2CAP_CS_NO_INFO;
-                        }
-                } else {
-                        sk->sk_state = BT_CONNECT2;
-                        result = L2CAP_CR_PEND;
-                        status = L2CAP_CS_AUTHEN_PEND;
-                }
-        } else {
-                sk->sk_state = BT_CONNECT2;
-                result = L2CAP_CR_PEND;
-                status = L2CAP_CS_NO_INFO;
-        }
-
-        write_unlock_bh(&list->lock);
-
-response:
-        bh_unlock_sock(parent);
-
-sendresp:
-        rsp.scid   = cpu_to_le16(scid);
-        rsp.dcid   = cpu_to_le16(dcid);
-        rsp.result = cpu_to_le16(result);
-        rsp.status = cpu_to_le16(status);
-        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-
-        if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
-                struct l2cap_info_req info;
-                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
-
-                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
-                conn->info_ident = l2cap_get_ident(conn);
-
-                mod_timer(&conn->info_timer, jiffies +
-                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
-
-                l2cap_send_cmd(conn, conn->info_ident,
-                                        L2CAP_INFO_REQ, sizeof(info), &info);
-        }
-
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
-                                result == L2CAP_CR_SUCCESS) {
-                u8 buf[128];
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
-        }
-
-        return 0;
-}
-
-static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
-        u16 scid, dcid, result, status;
-        struct sock *sk;
-        u8 req[128];
-
-        scid   = __le16_to_cpu(rsp->scid);
-        dcid   = __le16_to_cpu(rsp->dcid);
-        result = __le16_to_cpu(rsp->result);
-        status = __le16_to_cpu(rsp->status);
-
-        BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
-
-        if (scid) {
-                sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-                if (!sk)
-                        return -EFAULT;
-        } else {
-                sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
-                if (!sk)
-                        return -EFAULT;
-        }
-
-        switch (result) {
-        case L2CAP_CR_SUCCESS:
-                sk->sk_state = BT_CONFIG;
-                l2cap_pi(sk)->ident = 0;
-                l2cap_pi(sk)->dcid = dcid;
-                l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
-
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)
-                        break;
-
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-
-                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, req), req);
-                l2cap_pi(sk)->num_conf_req++;
-                break;
-
-        case L2CAP_CR_PEND:
-                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
-                break;
-
-        default:
-                l2cap_chan_del(sk, ECONNREFUSED);
-                break;
-        }
-
-        bh_unlock_sock(sk);
-        return 0;
-}
-
-static inline void set_default_fcs(struct l2cap_pinfo *pi)
-{
-        /* FCS is enabled only in ERTM or streaming mode, if one or both
-         * sides request it.
-         */
-        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
-                pi->fcs = L2CAP_FCS_NONE;
-        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
-                pi->fcs = L2CAP_FCS_CRC16;
-}
-
-static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
-{
-        struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
-        u16 dcid, flags;
-        u8 rsp[64];
-        struct sock *sk;
-        int len;
-
-        dcid  = __le16_to_cpu(req->dcid);
-        flags = __le16_to_cpu(req->flags);
-
-        BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
-
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
-        if (!sk)
-                return -ENOENT;
-
-        if (sk->sk_state == BT_DISCONN)
-                goto unlock;
-
-        /* Reject if config buffer is too small. */
-        len = cmd_len - sizeof(*req);
-        if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
-                                l2cap_build_conf_rsp(sk, rsp,
-                                        L2CAP_CONF_REJECT, flags), rsp);
-                goto unlock;
-        }
-
-        /* Store config. */
-        memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
-        l2cap_pi(sk)->conf_len += len;
-
-        if (flags & 0x0001) {
-                /* Incomplete config. Send empty response. */
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
-                                l2cap_build_conf_rsp(sk, rsp,
-                                        L2CAP_CONF_SUCCESS, 0x0001), rsp);
-                goto unlock;
-        }
-
-        /* Complete config. */
-        len = l2cap_parse_conf_req(sk, rsp);
-        if (len < 0) {
-                l2cap_send_disconn_req(conn, sk, ECONNRESET);
-                goto unlock;
-        }
-
-        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
-        l2cap_pi(sk)->num_conf_rsp++;
-
-        /* Reset config buffer. */
-        l2cap_pi(sk)->conf_len = 0;
-
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
-                goto unlock;
-
-        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                set_default_fcs(l2cap_pi(sk));
-
-                sk->sk_state = BT_CONNECTED;
-
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_tx_seq = 0;
-                __skb_queue_head_init(TX_QUEUE(sk));
-                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(sk);
-
-                l2cap_chan_ready(sk);
-                goto unlock;
-        }
-
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
-                u8 buf[64];
-                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
-                                        l2cap_build_conf_req(sk, buf), buf);
-                l2cap_pi(sk)->num_conf_req++;
-        }
-
-unlock:
-        bh_unlock_sock(sk);
-        return 0;
-}
-
-static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
-        u16 scid, flags, result;
-        struct sock *sk;
-        int len = cmd->len - sizeof(*rsp);
-
-        scid   = __le16_to_cpu(rsp->scid);
-        flags  = __le16_to_cpu(rsp->flags);
-        result = __le16_to_cpu(rsp->result);
-
-        BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
-                        scid, flags, result);
-
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-        if (!sk)
-                return 0;
-
-        switch (result) {
-        case L2CAP_CONF_SUCCESS:
-                l2cap_conf_rfc_get(sk, rsp->data, len);
-                break;
-
-        case L2CAP_CONF_UNACCEPT:
-                if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
-                        char req[64];
-
-                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
-                                l2cap_send_disconn_req(conn, sk, ECONNRESET);
-                                goto done;
-                        }
-
-                        /* throw out any old stored conf requests */
-                        result = L2CAP_CONF_SUCCESS;
-                        len = l2cap_parse_conf_rsp(sk, rsp->data,
-                                                        len, req, &result);
-                        if (len < 0) {
-                                l2cap_send_disconn_req(conn, sk, ECONNRESET);
-                                goto done;
-                        }
-
-                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
-                                                L2CAP_CONF_REQ, len, req);
-                        l2cap_pi(sk)->num_conf_req++;
-                        if (result != L2CAP_CONF_SUCCESS)
-                                goto done;
-                        break;
-                }
-
-        default:
-                sk->sk_err = ECONNRESET;
-                l2cap_sock_set_timer(sk, HZ * 5);
-                l2cap_send_disconn_req(conn, sk, ECONNRESET);
-                goto done;
-        }
-
-        if (flags & 0x01)
-                goto done;
-
-        l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
-
-        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                set_default_fcs(l2cap_pi(sk));
-
-                sk->sk_state = BT_CONNECTED;
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_tx_seq = 0;
-                __skb_queue_head_init(TX_QUEUE(sk));
-                if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
-                        l2cap_ertm_init(sk);
-
-                l2cap_chan_ready(sk);
-        }
-
-done:
-        bh_unlock_sock(sk);
-        return 0;
-}
-
-static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
-        struct l2cap_disconn_rsp rsp;
-        u16 dcid, scid;
-        struct sock *sk;
-
-        scid = __le16_to_cpu(req->scid);
-        dcid = __le16_to_cpu(req->dcid);
-
-        BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
-
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
-        if (!sk)
-                return 0;
-
-        rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
-        rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
-        l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
-
-        sk->sk_shutdown = SHUTDOWN_MASK;
-
-        l2cap_chan_del(sk, ECONNRESET);
-        bh_unlock_sock(sk);
-
-        l2cap_sock_kill(sk);
-        return 0;
-}
-
-static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
-        u16 dcid, scid;
-        struct sock *sk;
-
-        scid = __le16_to_cpu(rsp->scid);
-        dcid = __le16_to_cpu(rsp->dcid);
-
-        BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
-
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
-        if (!sk)
-                return 0;
-
-        l2cap_chan_del(sk, 0);
-        bh_unlock_sock(sk);
-
-        l2cap_sock_kill(sk);
-        return 0;
-}
-
-static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_info_req *req = (struct l2cap_info_req *) data;
-        u16 type;
-
-        type = __le16_to_cpu(req->type);
-
-        BT_DBG("type 0x%4.4x", type);
-
-        if (type == L2CAP_IT_FEAT_MASK) {
-                u8 buf[8];
-                u32 feat_mask = l2cap_feat_mask;
-                struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
-                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
-                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
-                if (!disable_ertm)
-                        feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
-                                                         | L2CAP_FEAT_FCS;
-                put_unaligned_le32(feat_mask, rsp->data);
-                l2cap_send_cmd(conn, cmd->ident,
-                                        L2CAP_INFO_RSP, sizeof(buf), buf);
-        } else if (type == L2CAP_IT_FIXED_CHAN) {
-                u8 buf[12];
-                struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
-                rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
-                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
-                memcpy(buf + 4, l2cap_fixed_chan, 8);
-                l2cap_send_cmd(conn, cmd->ident,
-                                        L2CAP_INFO_RSP, sizeof(buf), buf);
-        } else {
-                struct l2cap_info_rsp rsp;
-                rsp.type   = cpu_to_le16(type);
-                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
-                l2cap_send_cmd(conn, cmd->ident,
-                                        L2CAP_INFO_RSP, sizeof(rsp), &rsp);
-        }
-
-        return 0;
-}
-
-static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
-{
-        struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
-        u16 type, result;
-
-        type   = __le16_to_cpu(rsp->type);
-        result = __le16_to_cpu(rsp->result);
-
-        BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
-
-        del_timer(&conn->info_timer);
-
-        if (result != L2CAP_IR_SUCCESS) {
-                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
-                conn->info_ident = 0;
-
-                l2cap_conn_start(conn);
-
-                return 0;
-        }
-
-        if (type == L2CAP_IT_FEAT_MASK) {
-                conn->feat_mask = get_unaligned_le32(rsp->data);
-
-                if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
-                        struct l2cap_info_req req;
-                        req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
-
-                        conn->info_ident = l2cap_get_ident(conn);
-
-                        l2cap_send_cmd(conn, conn->info_ident,
-                                        L2CAP_INFO_REQ, sizeof(req), &req);
-                } else {
-                        conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
-                        conn->info_ident = 0;
-
-                        l2cap_conn_start(conn);
-                }
-        } else if (type == L2CAP_IT_FIXED_CHAN) {
-                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
-                conn->info_ident = 0;
-
-                l2cap_conn_start(conn);
-        }
-
-        return 0;
-}
-
-static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
-{
-        u8 *data = skb->data;
-        int len = skb->len;
-        struct l2cap_cmd_hdr cmd;
-        int err = 0;
-
-        l2cap_raw_recv(conn, skb);
-
-        while (len >= L2CAP_CMD_HDR_SIZE) {
-                u16 cmd_len;
-                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
-                data += L2CAP_CMD_HDR_SIZE;
-                len  -= L2CAP_CMD_HDR_SIZE;
-
-                cmd_len = le16_to_cpu(cmd.len);
-
-                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
-
-                if (cmd_len > len || !cmd.ident) {
-                        BT_DBG("corrupted command");
-                        break;
-                }
-
-                switch (cmd.code) {
-                case L2CAP_COMMAND_REJ:
-                        l2cap_command_rej(conn, &cmd, data);
-                        break;
-
-                case L2CAP_CONN_REQ:
-                        err = l2cap_connect_req(conn, &cmd, data);
-                        break;
-
-                case L2CAP_CONN_RSP:
-                        err = l2cap_connect_rsp(conn, &cmd, data);
-                        break;
-
-                case L2CAP_CONF_REQ:
-                        err = l2cap_config_req(conn, &cmd, cmd_len, data);
-                        break;
-
-                case L2CAP_CONF_RSP:
-                        err = l2cap_config_rsp(conn, &cmd, data);
-                        break;
-
-                case L2CAP_DISCONN_REQ:
-                        err = l2cap_disconnect_req(conn, &cmd, data);
-                        break;
-
-                case L2CAP_DISCONN_RSP:
-                        err = l2cap_disconnect_rsp(conn, &cmd, data);
-                        break;
-
-                case L2CAP_ECHO_REQ:
-                        l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
-                        break;
-
-                case L2CAP_ECHO_RSP:
-                        break;
-
-                case L2CAP_INFO_REQ:
-                        err = l2cap_information_req(conn, &cmd, data);
-                        break;
-
-                case L2CAP_INFO_RSP:
-                        err = l2cap_information_rsp(conn, &cmd, data);
-                        break;
-
-                default:
-                        BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
-                        err = -EINVAL;
-                        break;
-                }
-
-                if (err) {
-                        struct l2cap_cmd_rej rej;
-                        BT_DBG("error %d", err);
-
-                        /* FIXME: Map err to a valid reason */
-                        rej.reason = cpu_to_le16(0);
-                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
-                }
-
-                data += cmd_len;
-                len  -= cmd_len;
-        }
-
-        kfree_skb(skb);
-}
-
-static int l2cap_check_fcs(struct l2cap_pinfo *pi,  struct sk_buff *skb)
-{
-        u16 our_fcs, rcv_fcs;
-        int hdr_size = L2CAP_HDR_SIZE + 2;
-
-        if (pi->fcs == L2CAP_FCS_CRC16) {
-                skb_trim(skb, skb->len - 2);
-                rcv_fcs = get_unaligned_le16(skb->data + skb->len);
-                our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
-
-                if (our_fcs != rcv_fcs)
-                        return -EBADMSG;
-        }
-        return 0;
-}
-
-static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u16 control = 0;
-
-        pi->frames_sent = 0;
-
-        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
-                control |= L2CAP_SUPER_RCV_NOT_READY;
-                l2cap_send_sframe(pi, control);
-                pi->conn_state |= L2CAP_CONN_RNR_SENT;
-        }
-
-        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
-                l2cap_retransmit_frames(sk);
-
-        l2cap_ertm_send(sk);
-
-        if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
-                        pi->frames_sent == 0) {
-                control |= L2CAP_SUPER_RCV_READY;
-                l2cap_send_sframe(pi, control);
-        }
-}
-
-static int l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
-{
-        struct sk_buff *next_skb;
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        int tx_seq_offset, next_tx_seq_offset;
-
-        bt_cb(skb)->tx_seq = tx_seq;
-        bt_cb(skb)->sar = sar;
-
-        next_skb = skb_peek(SREJ_QUEUE(sk));
-        if (!next_skb) {
-                __skb_queue_tail(SREJ_QUEUE(sk), skb);
-                return 0;
-        }
-
-        tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
-        if (tx_seq_offset < 0)
-                tx_seq_offset += 64;
-
-        do {
-                if (bt_cb(next_skb)->tx_seq == tx_seq)
-                        return -EINVAL;
-
-                next_tx_seq_offset = (bt_cb(next_skb)->tx_seq -
-                                                pi->buffer_seq) % 64;
-                if (next_tx_seq_offset < 0)
-                        next_tx_seq_offset += 64;
-
-                if (next_tx_seq_offset > tx_seq_offset) {
-                        __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
-                        return 0;
-                }
-
-                if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
-                        break;
-
-        } while ((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
-
-        __skb_queue_tail(SREJ_QUEUE(sk), skb);
-
-        return 0;
-}
-
-static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *_skb;
-        int err;
-
-        switch (control & L2CAP_CTRL_SAR) {
-        case L2CAP_SDU_UNSEGMENTED:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU)
-                        goto drop;
-
-                err = sock_queue_rcv_skb(sk, skb);
-                if (!err)
-                        return err;
-
-                break;
-
-        case L2CAP_SDU_START:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU)
-                        goto drop;
-
-                pi->sdu_len = get_unaligned_le16(skb->data);
-
-                if (pi->sdu_len > pi->imtu)
-                        goto disconnect;
-
-                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
-                if (!pi->sdu)
-                        return -ENOMEM;
-
-                /* pull sdu_len bytes only after alloc, because of Local Busy
-                 * condition we have to be sure that this will be executed
-                 * only once, i.e., when alloc does not fail */
-                skb_pull(skb, 2);
-
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-
-                pi->conn_state |= L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len = skb->len;
-                break;
-
-        case L2CAP_SDU_CONTINUE:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
-                        goto disconnect;
-
-                if (!pi->sdu)
-                        goto disconnect;
-
-                pi->partial_sdu_len += skb->len;
-                if (pi->partial_sdu_len > pi->sdu_len)
-                        goto drop;
-
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-
-                break;
-
-        case L2CAP_SDU_END:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
-                        goto disconnect;
-
-                if (!pi->sdu)
-                        goto disconnect;
-
-                if (!(pi->conn_state & L2CAP_CONN_SAR_RETRY)) {
-                        pi->partial_sdu_len += skb->len;
-
-                        if (pi->partial_sdu_len > pi->imtu)
-                                goto drop;
-
-                        if (pi->partial_sdu_len != pi->sdu_len)
-                                goto drop;
-
-                        memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-                }
-
-                _skb = skb_clone(pi->sdu, GFP_ATOMIC);
-                if (!_skb) {
-                        pi->conn_state |= L2CAP_CONN_SAR_RETRY;
-                        return -ENOMEM;
-                }
-
-                err = sock_queue_rcv_skb(sk, _skb);
-                if (err < 0) {
-                        kfree_skb(_skb);
-                        pi->conn_state |= L2CAP_CONN_SAR_RETRY;
-                        return err;
-                }
-
-                pi->conn_state &= ~L2CAP_CONN_SAR_RETRY;
-                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
-
-                kfree_skb(pi->sdu);
-                break;
-        }
-
-        kfree_skb(skb);
-        return 0;
-
-drop:
-        kfree_skb(pi->sdu);
-        pi->sdu = NULL;
-
-disconnect:
-        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-        kfree_skb(skb);
-        return 0;
-}
-
-static int l2cap_try_push_rx_skb(struct sock *sk)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *skb;
-        u16 control;
-        int err;
-
-        while ((skb = skb_dequeue(BUSY_QUEUE(sk)))) {
-                control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                err = l2cap_ertm_reassembly_sdu(sk, skb, control);
-                if (err < 0) {
-                        skb_queue_head(BUSY_QUEUE(sk), skb);
-                        return -EBUSY;
-                }
-
-                pi->buffer_seq = (pi->buffer_seq + 1) % 64;
-        }
-
-        if (!(pi->conn_state & L2CAP_CONN_RNR_SENT))
-                goto done;
-
-        control = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-        control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
-        l2cap_send_sframe(pi, control);
-        l2cap_pi(sk)->retry_count = 1;
-
-        del_timer(&pi->retrans_timer);
-        __mod_monitor_timer();
-
-        l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
-
-done:
-        pi->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
-        pi->conn_state &= ~L2CAP_CONN_RNR_SENT;
-
-        BT_DBG("sk %p, Exit local busy", sk);
-
-        return 0;
-}
-
-static void l2cap_busy_work(struct work_struct *work)
-{
-        DECLARE_WAITQUEUE(wait, current);
-        struct l2cap_pinfo *pi =
-                container_of(work, struct l2cap_pinfo, busy_work);
-        struct sock *sk = (struct sock *)pi;
-        int n_tries = 0, timeo = HZ/5, err;
-        struct sk_buff *skb;
-
-        lock_sock(sk);
-
-        add_wait_queue(sk_sleep(sk), &wait);
-        while ((skb = skb_peek(BUSY_QUEUE(sk)))) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
-                        err = -EBUSY;
-                        l2cap_send_disconn_req(pi->conn, sk, EBUSY);
-                        break;
-                }
-
-                if (!timeo)
-                        timeo = HZ/5;
-
-                if (signal_pending(current)) {
-                        err = sock_intr_errno(timeo);
-                        break;
-                }
-
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
-
-                err = sock_error(sk);
-                if (err)
-                        break;
-
-                if (l2cap_try_push_rx_skb(sk) == 0)
-                        break;
-        }
-
-        set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
-
-        release_sock(sk);
-}
-
-static int l2cap_push_rx_skb(struct sock *sk, struct sk_buff *skb, u16 control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        int sctrl, err;
-
-        if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
-                bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-                __skb_queue_tail(BUSY_QUEUE(sk), skb);
-                return l2cap_try_push_rx_skb(sk);
-
-
-        }
-
-        err = l2cap_ertm_reassembly_sdu(sk, skb, control);
-        if (err >= 0) {
-                pi->buffer_seq = (pi->buffer_seq + 1) % 64;
-                return err;
-        }
-
-        /* Busy Condition */
-        BT_DBG("sk %p, Enter local busy", sk);
-
-        pi->conn_state |= L2CAP_CONN_LOCAL_BUSY;
-        bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
-        __skb_queue_tail(BUSY_QUEUE(sk), skb);
-
-        sctrl = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-        sctrl |= L2CAP_SUPER_RCV_NOT_READY;
-        l2cap_send_sframe(pi, sctrl);
-
-        pi->conn_state |= L2CAP_CONN_RNR_SENT;
-
-        del_timer(&pi->ack_timer);
-
-        queue_work(_busy_wq, &pi->busy_work);
-
-        return err;
-}
-
-static int l2cap_streaming_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct sk_buff *_skb;
-        int err = -EINVAL;
-
-        /*
-         * TODO: We have to notify the userland if some data is lost with the
-         * Streaming Mode.
-         */
-
-        switch (control & L2CAP_CTRL_SAR) {
-        case L2CAP_SDU_UNSEGMENTED:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
-                        kfree_skb(pi->sdu);
-                        break;
-                }
-
-                err = sock_queue_rcv_skb(sk, skb);
-                if (!err)
-                        return 0;
-
-                break;
-
-        case L2CAP_SDU_START:
-                if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
-                        kfree_skb(pi->sdu);
-                        break;
-                }
-
-                pi->sdu_len = get_unaligned_le16(skb->data);
-                skb_pull(skb, 2);
-
-                if (pi->sdu_len > pi->imtu) {
-                        err = -EMSGSIZE;
-                        break;
-                }
-
-                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
-                if (!pi->sdu) {
-                        err = -ENOMEM;
-                        break;
-                }
-
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-
-                pi->conn_state |= L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len = skb->len;
-                err = 0;
-                break;
-
-        case L2CAP_SDU_CONTINUE:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
-                        break;
-
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-
-                pi->partial_sdu_len += skb->len;
-                if (pi->partial_sdu_len > pi->sdu_len)
-                        kfree_skb(pi->sdu);
-                else
-                        err = 0;
-
-                break;
-
-        case L2CAP_SDU_END:
-                if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
-                        break;
-
-                memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
-
-                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
-                pi->partial_sdu_len += skb->len;
-
-                if (pi->partial_sdu_len > pi->imtu)
-                        goto drop;
-
-                if (pi->partial_sdu_len == pi->sdu_len) {
-                        _skb = skb_clone(pi->sdu, GFP_ATOMIC);
-                        err = sock_queue_rcv_skb(sk, _skb);
-                        if (err < 0)
-                                kfree_skb(_skb);
-                }
-                err = 0;
-
-drop:
-                kfree_skb(pi->sdu);
-                break;
-        }
-
-        kfree_skb(skb);
-        return err;
-}
-
-static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
-{
-        struct sk_buff *skb;
-        u16 control;
-
-        while ((skb = skb_peek(SREJ_QUEUE(sk)))) {
-                if (bt_cb(skb)->tx_seq != tx_seq)
-                        break;
-
-                skb = skb_dequeue(SREJ_QUEUE(sk));
-                control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
-                l2cap_ertm_reassembly_sdu(sk, skb, control);
-                l2cap_pi(sk)->buffer_seq_srej =
-                        (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
-                tx_seq = (tx_seq + 1) % 64;
-        }
-}
-
-static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct srej_list *l, *tmp;
-        u16 control;
-
-        list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
-                if (l->tx_seq == tx_seq) {
-                        list_del(&l->list);
-                        kfree(l);
-                        return;
-                }
-                control = L2CAP_SUPER_SELECT_REJECT;
-                control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-                l2cap_send_sframe(pi, control);
-                list_del(&l->list);
-                list_add_tail(&l->list, SREJ_LIST(sk));
-        }
-}
-
-static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        struct srej_list *new;
-        u16 control;
-
-        while (tx_seq != pi->expected_tx_seq) {
-                control = L2CAP_SUPER_SELECT_REJECT;
-                control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-                l2cap_send_sframe(pi, control);
-
-                new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
-                new->tx_seq = pi->expected_tx_seq;
-                pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
-                list_add_tail(&new->list, SREJ_LIST(sk));
-        }
-        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
-}
-
-static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u8 tx_seq = __get_txseq(rx_control);
-        u8 req_seq = __get_reqseq(rx_control);
-        u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
-        int tx_seq_offset, expected_tx_seq_offset;
-        int num_to_ack = (pi->tx_win/6) + 1;
-        int err = 0;
-
-        BT_DBG("sk %p len %d tx_seq %d rx_control 0x%4.4x", sk, skb->len, tx_seq,
-                                                                rx_control);
-
-        if (L2CAP_CTRL_FINAL & rx_control &&
-                        l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&pi->monitor_timer);
-                if (pi->unacked_frames > 0)
-                        __mod_retrans_timer();
-                pi->conn_state &= ~L2CAP_CONN_WAIT_F;
-        }
-
-        pi->expected_ack_seq = req_seq;
-        l2cap_drop_acked_frames(sk);
-
-        if (tx_seq == pi->expected_tx_seq)
-                goto expected;
-
-        tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
-        if (tx_seq_offset < 0)
-                tx_seq_offset += 64;
-
-        /* invalid tx_seq */
-        if (tx_seq_offset >= pi->tx_win) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-                goto drop;
-        }
-
-        if (pi->conn_state == L2CAP_CONN_LOCAL_BUSY)
-                goto drop;
-
-        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-                struct srej_list *first;
-
-                first = list_first_entry(SREJ_LIST(sk),
-                                struct srej_list, list);
-                if (tx_seq == first->tx_seq) {
-                        l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
-                        l2cap_check_srej_gap(sk, tx_seq);
-
-                        list_del(&first->list);
-                        kfree(first);
-
-                        if (list_empty(SREJ_LIST(sk))) {
-                                pi->buffer_seq = pi->buffer_seq_srej;
-                                pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
-                                l2cap_send_ack(pi);
-                                BT_DBG("sk %p, Exit SREJ_SENT", sk);
-                        }
-                } else {
-                        struct srej_list *l;
-
-                        /* duplicated tx_seq */
-                        if (l2cap_add_to_srej_queue(sk, skb, tx_seq, sar) < 0)
-                                goto drop;
-
-                        list_for_each_entry(l, SREJ_LIST(sk), list) {
-                                if (l->tx_seq == tx_seq) {
-                                        l2cap_resend_srejframe(sk, tx_seq);
-                                        return 0;
-                                }
-                        }
-                        l2cap_send_srejframe(sk, tx_seq);
-                }
-        } else {
-                expected_tx_seq_offset =
-                        (pi->expected_tx_seq - pi->buffer_seq) % 64;
-                if (expected_tx_seq_offset < 0)
-                        expected_tx_seq_offset += 64;
-
-                /* duplicated tx_seq */
-                if (tx_seq_offset < expected_tx_seq_offset)
-                        goto drop;
-
-                pi->conn_state |= L2CAP_CONN_SREJ_SENT;
-
-                BT_DBG("sk %p, Enter SREJ", sk);
-
-                INIT_LIST_HEAD(SREJ_LIST(sk));
-                pi->buffer_seq_srej = pi->buffer_seq;
-
-                __skb_queue_head_init(SREJ_QUEUE(sk));
-                __skb_queue_head_init(BUSY_QUEUE(sk));
-                l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
-
-                pi->conn_state |= L2CAP_CONN_SEND_PBIT;
-
-                l2cap_send_srejframe(sk, tx_seq);
-
-                del_timer(&pi->ack_timer);
-        }
-        return 0;
-
-expected:
-        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
-
-        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-                bt_cb(skb)->tx_seq = tx_seq;
-                bt_cb(skb)->sar = sar;
-                __skb_queue_tail(SREJ_QUEUE(sk), skb);
-                return 0;
-        }
-
-        err = l2cap_push_rx_skb(sk, skb, rx_control);
-        if (err < 0)
-                return 0;
-
-        if (rx_control & L2CAP_CTRL_FINAL) {
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
-                        l2cap_retransmit_frames(sk);
-        }
-
-        __mod_ack_timer();
-
-        pi->num_acked = (pi->num_acked + 1) % num_to_ack;
-        if (pi->num_acked == num_to_ack - 1)
-                l2cap_send_ack(pi);
-
-        return 0;
-
-drop:
-        kfree_skb(skb);
-        return 0;
-}
-
-static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, __get_reqseq(rx_control),
-                                                rx_control);
-
-        pi->expected_ack_seq = __get_reqseq(rx_control);
-        l2cap_drop_acked_frames(sk);
-
-        if (rx_control & L2CAP_CTRL_POLL) {
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
-                if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                        (pi->unacked_frames > 0))
-                                __mod_retrans_timer();
-
-                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                        l2cap_send_srejtail(sk);
-                } else {
-                        l2cap_send_i_or_rr_or_rnr(sk);
-                }
-
-        } else if (rx_control & L2CAP_CTRL_FINAL) {
-                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
-                        l2cap_retransmit_frames(sk);
-
-        } else {
-                if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
-                                (pi->unacked_frames > 0))
-                        __mod_retrans_timer();
-
-                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-                        l2cap_send_ack(pi);
-                } else {
-                        l2cap_ertm_send(sk);
-                }
-        }
-}
-
-static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u8 tx_seq = __get_reqseq(rx_control);
-
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
-
-        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-
-        pi->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(sk);
-
-        if (rx_control & L2CAP_CTRL_FINAL) {
-                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
-                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
-                else
-                        l2cap_retransmit_frames(sk);
-        } else {
-                l2cap_retransmit_frames(sk);
-
-                if (pi->conn_state & L2CAP_CONN_WAIT_F)
-                        pi->conn_state |= L2CAP_CONN_REJ_ACT;
-        }
-}
-static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u8 tx_seq = __get_reqseq(rx_control);
-
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
-
-        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-
-        if (rx_control & L2CAP_CTRL_POLL) {
-                pi->expected_ack_seq = tx_seq;
-                l2cap_drop_acked_frames(sk);
-
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
-                l2cap_retransmit_one_frame(sk, tx_seq);
-
-                l2cap_ertm_send(sk);
-
-                if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                        pi->srej_save_reqseq = tx_seq;
-                        pi->conn_state |= L2CAP_CONN_SREJ_ACT;
-                }
-        } else if (rx_control & L2CAP_CTRL_FINAL) {
-                if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
-                                pi->srej_save_reqseq == tx_seq)
-                        pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
-                else
-                        l2cap_retransmit_one_frame(sk, tx_seq);
-        } else {
-                l2cap_retransmit_one_frame(sk, tx_seq);
-                if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                        pi->srej_save_reqseq = tx_seq;
-                        pi->conn_state |= L2CAP_CONN_SREJ_ACT;
-                }
-        }
-}
-
-static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u8 tx_seq = __get_reqseq(rx_control);
-
-        BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
-
-        pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
-        pi->expected_ack_seq = tx_seq;
-        l2cap_drop_acked_frames(sk);
-
-        if (rx_control & L2CAP_CTRL_POLL)
-                pi->conn_state |= L2CAP_CONN_SEND_FBIT;
-
-        if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
-                del_timer(&pi->retrans_timer);
-                if (rx_control & L2CAP_CTRL_POLL)
-                        l2cap_send_rr_or_rnr(pi, L2CAP_CTRL_FINAL);
-                return;
-        }
-
-        if (rx_control & L2CAP_CTRL_POLL)
-                l2cap_send_srejtail(sk);
-        else
-                l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
-}
-
-static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
-{
-        BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
-
-        if (L2CAP_CTRL_FINAL & rx_control &&
-                        l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
-                del_timer(&l2cap_pi(sk)->monitor_timer);
-                if (l2cap_pi(sk)->unacked_frames > 0)
-                        __mod_retrans_timer();
-                l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
-        }
-
-        switch (rx_control & L2CAP_CTRL_SUPERVISE) {
-        case L2CAP_SUPER_RCV_READY:
-                l2cap_data_channel_rrframe(sk, rx_control);
-                break;
-
-        case L2CAP_SUPER_REJECT:
-                l2cap_data_channel_rejframe(sk, rx_control);
-                break;
-
-        case L2CAP_SUPER_SELECT_REJECT:
-                l2cap_data_channel_srejframe(sk, rx_control);
-                break;
-
-        case L2CAP_SUPER_RCV_NOT_READY:
-                l2cap_data_channel_rnrframe(sk, rx_control);
-                break;
-        }
-
-        kfree_skb(skb);
-        return 0;
-}
-
-static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
-{
-        struct l2cap_pinfo *pi = l2cap_pi(sk);
-        u16 control;
-        u8 req_seq;
-        int len, next_tx_seq_offset, req_seq_offset;
-
-        control = get_unaligned_le16(skb->data);
-        skb_pull(skb, 2);
-        len = skb->len;
-
-        /*
-         * We can just drop the corrupted I-frame here.
-         * Receiver will miss it and start proper recovery
-         * procedures and ask retransmission.
-         */
-        if (l2cap_check_fcs(pi, skb))
-                goto drop;
-
-        if (__is_sar_start(control) && __is_iframe(control))
-                len -= 2;
-
-        if (pi->fcs == L2CAP_FCS_CRC16)
-                len -= 2;
-
-        if (len > pi->mps) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-                goto drop;
-        }
-
-        req_seq = __get_reqseq(control);
-        req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
-        if (req_seq_offset < 0)
-                req_seq_offset += 64;
-
-        next_tx_seq_offset =
-                (pi->next_tx_seq - pi->expected_ack_seq) % 64;
-        if (next_tx_seq_offset < 0)
-                next_tx_seq_offset += 64;
-
-        /* check for invalid req-seq */
-        if (req_seq_offset > next_tx_seq_offset) {
-                l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-                goto drop;
-        }
-
-        if (__is_iframe(control)) {
-                if (len < 0) {
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-                        goto drop;
-                }
-
-                l2cap_data_channel_iframe(sk, control, skb);
-        } else {
-                if (len != 0) {
-                        BT_ERR("%d", len);
-                        l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
-                        goto drop;
-                }
-
-                l2cap_data_channel_sframe(sk, control, skb);
-        }
-
-        return 0;
-
-drop:
-        kfree_skb(skb);
-        return 0;
-}
-
-static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
-{
-        struct sock *sk;
-        struct l2cap_pinfo *pi;
-        u16 control;
-        u8 tx_seq;
-        int len;
-
-        sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
-        if (!sk) {
-                BT_DBG("unknown cid 0x%4.4x", cid);
-                goto drop;
-        }
-
-        pi = l2cap_pi(sk);
-
-        BT_DBG("sk %p, len %d", sk, skb->len);
-
-        if (sk->sk_state != BT_CONNECTED)
-                goto drop;
-
-        switch (pi->mode) {
-        case L2CAP_MODE_BASIC:
-                /* If socket recv buffers overflows we drop data here
-                 * which is *bad* because L2CAP has to be reliable.
-                 * But we don't have any other choice. L2CAP doesn't
-                 * provide flow control mechanism. */
-
-                if (pi->imtu < skb->len)
-                        goto drop;
-
-                if (!sock_queue_rcv_skb(sk, skb))
-                        goto done;
-                break;
-
-        case L2CAP_MODE_ERTM:
-                if (!sock_owned_by_user(sk)) {
-                        l2cap_ertm_data_rcv(sk, skb);
-                } else {
-                        if (sk_add_backlog(sk, skb))
-                                goto drop;
-                }
-
-                goto done;
-
-        case L2CAP_MODE_STREAMING:
-                control = get_unaligned_le16(skb->data);
-                skb_pull(skb, 2);
-                len = skb->len;
-
-                if (l2cap_check_fcs(pi, skb))
-                        goto drop;
-
-                if (__is_sar_start(control))
-                        len -= 2;
-
-                if (pi->fcs == L2CAP_FCS_CRC16)
-                        len -= 2;
-
-                if (len > pi->mps || len < 0 || __is_sframe(control))
-                        goto drop;
-
-                tx_seq = __get_txseq(control);
-
-                if (pi->expected_tx_seq == tx_seq)
-                        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
-                else
-                        pi->expected_tx_seq = (tx_seq + 1) % 64;
-
-                l2cap_streaming_reassembly_sdu(sk, skb, control);
-
-                goto done;
-
-        default:
-                BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
-                break;
-        }
-
-drop:
-        kfree_skb(skb);
-
-done:
-        if (sk)
-                bh_unlock_sock(sk);
-
-        return 0;
-}
-
-static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
-{
-        struct sock *sk;
-
-        sk = l2cap_get_sock_by_psm(0, psm, conn->src);
-        if (!sk)
-                goto drop;
-
-        BT_DBG("sk %p, len %d", sk, skb->len);
-
-        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
-                goto drop;
-
-        if (l2cap_pi(sk)->imtu < skb->len)
-                goto drop;
-
-        if (!sock_queue_rcv_skb(sk, skb))
-                goto done;
-
-drop:
-        kfree_skb(skb);
-
-done:
-        if (sk)
-                bh_unlock_sock(sk);
-        return 0;
-}
-
-static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
-{
-        struct l2cap_hdr *lh = (void *) skb->data;
-        u16 cid, len;
-        __le16 psm;
-
-        skb_pull(skb, L2CAP_HDR_SIZE);
-        cid = __le16_to_cpu(lh->cid);
-        len = __le16_to_cpu(lh->len);
-
-        if (len != skb->len) {
-                kfree_skb(skb);
-                return;
-        }
-
-        BT_DBG("len %d, cid 0x%4.4x", len, cid);
-
-        switch (cid) {
-        case L2CAP_CID_SIGNALING:
-                l2cap_sig_channel(conn, skb);
-                break;
-
-        case L2CAP_CID_CONN_LESS:
-                psm = get_unaligned_le16(skb->data);
-                skb_pull(skb, 2);
-                l2cap_conless_channel(conn, psm, skb);
-                break;
-
-        default:
-                l2cap_data_channel(conn, cid, skb);
-                break;
-        }
-}
-
-/* ---- L2CAP interface with lower layer (HCI) ---- */
-
-static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
-{
-        int exact = 0, lm1 = 0, lm2 = 0;
-        register struct sock *sk;
-        struct hlist_node *node;
-
-        if (type != ACL_LINK)
-                return -EINVAL;
-
-        BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
-
-        /* Find listening sockets and check their link_mode */
-        read_lock(&l2cap_sk_list.lock);
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                if (sk->sk_state != BT_LISTEN)
-                        continue;
-
-                if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
-                        lm1 |= HCI_LM_ACCEPT;
-                        if (l2cap_pi(sk)->role_switch)
-                                lm1 |= HCI_LM_MASTER;
-                        exact++;
-                } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
-                        lm2 |= HCI_LM_ACCEPT;
-                        if (l2cap_pi(sk)->role_switch)
-                                lm2 |= HCI_LM_MASTER;
-                }
-        }
-        read_unlock(&l2cap_sk_list.lock);
-
-        return exact ? lm1 : lm2;
-}
-
-static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
-{
-        struct l2cap_conn *conn;
-
-        BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
-
-        if (hcon->type != ACL_LINK)
-                return -EINVAL;
-
-        if (!status) {
-                conn = l2cap_conn_add(hcon, status);
-                if (conn)
-                        l2cap_conn_ready(conn);
-        } else
-                l2cap_conn_del(hcon, bt_err(status));
-
-        return 0;
-}
-
-static int l2cap_disconn_ind(struct hci_conn *hcon)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-
-        BT_DBG("hcon %p", hcon);
-
-        if (hcon->type != ACL_LINK || !conn)
-                return 0x13;
-
-        return conn->disc_reason;
-}
-
-static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
-{
-        BT_DBG("hcon %p reason %d", hcon, reason);
-
-        if (hcon->type != ACL_LINK)
-                return -EINVAL;
-
-        l2cap_conn_del(hcon, bt_err(reason));
-
-        return 0;
-}
-
-static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
-{
-        if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
-                return;
-
-        if (encrypt == 0x00) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
-                        l2cap_sock_clear_timer(sk);
-                        l2cap_sock_set_timer(sk, HZ * 5);
-                } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        __l2cap_sock_close(sk, ECONNREFUSED);
-        } else {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
-                        l2cap_sock_clear_timer(sk);
-        }
-}
-
-static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
-{
-        struct l2cap_chan_list *l;
-        struct l2cap_conn *conn = hcon->l2cap_data;
-        struct sock *sk;
-
-        if (!conn)
-                return 0;
-
-        l = &conn->chan_list;
-
-        BT_DBG("conn %p", conn);
-
-        read_lock(&l->lock);
-
-        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
-                bh_lock_sock(sk);
-
-                if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
-                        bh_unlock_sock(sk);
-                        continue;
-                }
-
-                if (!status && (sk->sk_state == BT_CONNECTED ||
-                                                sk->sk_state == BT_CONFIG)) {
-                        l2cap_check_encryption(sk, encrypt);
-                        bh_unlock_sock(sk);
-                        continue;
-                }
-
-                if (sk->sk_state == BT_CONNECT) {
-                        if (!status) {
-                                struct l2cap_conn_req req;
-                                req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
-                                req.psm  = l2cap_pi(sk)->psm;
-
-                                l2cap_pi(sk)->ident = l2cap_get_ident(conn);
-                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
-
-                                l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_REQ, sizeof(req), &req);
-                        } else {
-                                l2cap_sock_clear_timer(sk);
-                                l2cap_sock_set_timer(sk, HZ / 10);
-                        }
-                } else if (sk->sk_state == BT_CONNECT2) {
-                        struct l2cap_conn_rsp rsp;
-                        __u16 result;
-
-                        if (!status) {
-                                sk->sk_state = BT_CONFIG;
-                                result = L2CAP_CR_SUCCESS;
-                        } else {
-                                sk->sk_state = BT_DISCONN;
-                                l2cap_sock_set_timer(sk, HZ / 10);
-                                result = L2CAP_CR_SEC_BLOCK;
-                        }
-
-                        rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
-                        rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
-                        rsp.result = cpu_to_le16(result);
-                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
-                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
-                                        L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-                }
-
-                bh_unlock_sock(sk);
-        }
-
-        read_unlock(&l->lock);
-
-        return 0;
-}
-
-static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
-{
-        struct l2cap_conn *conn = hcon->l2cap_data;
-
-        if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
-                goto drop;
-
-        BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
-
-        if (flags & ACL_START) {
-                struct l2cap_hdr *hdr;
-                int len;
-
-                if (conn->rx_len) {
-                        BT_ERR("Unexpected start frame (len %d)", skb->len);
-                        kfree_skb(conn->rx_skb);
-                        conn->rx_skb = NULL;
-                        conn->rx_len = 0;
-                        l2cap_conn_unreliable(conn, ECOMM);
-                }
-
-                if (skb->len < 2) {
-                        BT_ERR("Frame is too short (len %d)", skb->len);
-                        l2cap_conn_unreliable(conn, ECOMM);
-                        goto drop;
-                }
-
-                hdr = (struct l2cap_hdr *) skb->data;
-                len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
-
-                if (len == skb->len) {
-                        /* Complete frame received */
-                        l2cap_recv_frame(conn, skb);
-                        return 0;
-                }
-
-                BT_DBG("Start: total len %d, frag len %d", len, skb->len);
-
-                if (skb->len > len) {
-                        BT_ERR("Frame is too long (len %d, expected len %d)",
-                                skb->len, len);
-                        l2cap_conn_unreliable(conn, ECOMM);
-                        goto drop;
-                }
-
-                /* Allocate skb for the complete frame (with header) */
-                conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
-                if (!conn->rx_skb)
-                        goto drop;
-
-                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
-                                                                skb->len);
-                conn->rx_len = len - skb->len;
-        } else {
-                BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
-
-                if (!conn->rx_len) {
-                        BT_ERR("Unexpected continuation frame (len %d)", skb->len);
-                        l2cap_conn_unreliable(conn, ECOMM);
-                        goto drop;
-                }
-
-                if (skb->len > conn->rx_len) {
-                        BT_ERR("Fragment is too long (len %d, expected %d)",
-                                        skb->len, conn->rx_len);
-                        kfree_skb(conn->rx_skb);
-                        conn->rx_skb = NULL;
-                        conn->rx_len = 0;
-                        l2cap_conn_unreliable(conn, ECOMM);
-                        goto drop;
-                }
-
-                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
-                                                                skb->len);
-                conn->rx_len -= skb->len;
-
-                if (!conn->rx_len) {
-                        /* Complete frame received */
-                        l2cap_recv_frame(conn, conn->rx_skb);
-                        conn->rx_skb = NULL;
-                }
-        }
-
-drop:
-        kfree_skb(skb);
-        return 0;
-}
-
-static int l2cap_debugfs_show(struct seq_file *f, void *p)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-
-        read_lock_bh(&l2cap_sk_list.lock);
-
-        sk_for_each(sk, node, &l2cap_sk_list.head) {
-                struct l2cap_pinfo *pi = l2cap_pi(sk);
-
-                seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
-                                        batostr(&bt_sk(sk)->src),
-                                        batostr(&bt_sk(sk)->dst),
-                                        sk->sk_state, __le16_to_cpu(pi->psm),
-                                        pi->scid, pi->dcid,
-                                        pi->imtu, pi->omtu, pi->sec_level);
-        }
-
-        read_unlock_bh(&l2cap_sk_list.lock);
-
-        return 0;
-}
-
-static int l2cap_debugfs_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, l2cap_debugfs_show, inode->i_private);
-}
-
-static const struct file_operations l2cap_debugfs_fops = {
-        .open           = l2cap_debugfs_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
-
-static struct dentry *l2cap_debugfs;
-
-static const struct proto_ops l2cap_sock_ops = {
-        .family         = PF_BLUETOOTH,
-        .owner          = THIS_MODULE,
-        .release        = l2cap_sock_release,
-        .bind           = l2cap_sock_bind,
-        .connect        = l2cap_sock_connect,
-        .listen         = l2cap_sock_listen,
-        .accept         = l2cap_sock_accept,
-        .getname        = l2cap_sock_getname,
-        .sendmsg        = l2cap_sock_sendmsg,
-        .recvmsg        = l2cap_sock_recvmsg,
-        .poll           = bt_sock_poll,
-        .ioctl          = bt_sock_ioctl,
-        .mmap           = sock_no_mmap,
-        .socketpair     = sock_no_socketpair,
-        .shutdown       = l2cap_sock_shutdown,
-        .setsockopt     = l2cap_sock_setsockopt,
-        .getsockopt     = l2cap_sock_getsockopt
-};
-
-static const struct net_proto_family l2cap_sock_family_ops = {
-        .family = PF_BLUETOOTH,
-        .owner  = THIS_MODULE,
-        .create = l2cap_sock_create,
-};
-
-static struct hci_proto l2cap_hci_proto = {
-        .name           = "L2CAP",
-        .id             = HCI_PROTO_L2CAP,
-        .connect_ind    = l2cap_connect_ind,
-        .connect_cfm    = l2cap_connect_cfm,
-        .disconn_ind    = l2cap_disconn_ind,
-        .disconn_cfm    = l2cap_disconn_cfm,
-        .security_cfm   = l2cap_security_cfm,
-        .recv_acldata   = l2cap_recv_acldata
-};
-
-static int __init l2cap_init(void)
-{
-        int err;
-
-        err = proto_register(&l2cap_proto, 0);
-        if (err < 0)
-                return err;
-
-        _busy_wq = create_singlethread_workqueue("l2cap");
-        if (!_busy_wq)
-                goto error;
-
-        err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
-        if (err < 0) {
-                BT_ERR("L2CAP socket registration failed");
-                goto error;
-        }
-
-        err = hci_register_proto(&l2cap_hci_proto);
-        if (err < 0) {
-                BT_ERR("L2CAP protocol registration failed");
-                bt_sock_unregister(BTPROTO_L2CAP);
-                goto error;
-        }
-
-        if (bt_debugfs) {
-                l2cap_debugfs = debugfs_create_file("l2cap", 0444,
-                                        bt_debugfs, NULL, &l2cap_debugfs_fops);
-                if (!l2cap_debugfs)
-                        BT_ERR("Failed to create L2CAP debug file");
-        }
-
-        BT_INFO("L2CAP ver %s", VERSION);
-        BT_INFO("L2CAP socket layer initialized");
-
-        return 0;
-
-error:
-        proto_unregister(&l2cap_proto);
-        return err;
-}
-
-static void __exit l2cap_exit(void)
-{
-        debugfs_remove(l2cap_debugfs);
-
-        flush_workqueue(_busy_wq);
-        destroy_workqueue(_busy_wq);
-
-        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
-                BT_ERR("L2CAP socket unregistration failed");
-
-        if (hci_unregister_proto(&l2cap_hci_proto) < 0)
-                BT_ERR("L2CAP protocol unregistration failed");
-
-        proto_unregister(&l2cap_proto);
-}
-
-void l2cap_load(void)
-{
-        /* Dummy function to trigger automatic L2CAP module loading by
-         * other modules that use L2CAP sockets but don't use any other
-         * symbols from it. */
-}
-EXPORT_SYMBOL(l2cap_load);
-
-module_init(l2cap_init);
-module_exit(l2cap_exit);
-
-module_param(disable_ertm, bool, 0644);
-MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
-
-MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
-MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
-MODULE_VERSION(VERSION);
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("bt-proto-0");
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
new file mode 100644
index 000000000000..7705e26e699f
--- /dev/null
+++ b/net/bluetooth/l2cap_core.c
@@ -0,0 +1,4251 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
+   Copyright (C) 2010 Google Inc.
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth L2CAP core. */
+
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/capability.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include <linux/crc16.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+
+int disable_ertm;
+
+static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
+static u8 l2cap_fixed_chan[8] = { 0x02, };
+
+static struct workqueue_struct *_busy_wq;
+
+LIST_HEAD(chan_list);
+DEFINE_RWLOCK(chan_list_lock);
+
+static void l2cap_busy_work(struct work_struct *work);
+
+static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
+                                u8 code, u8 ident, u16 dlen, void *data);
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
+
+static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
+
+/* ---- L2CAP channels ---- */
+static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
+{
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->dcid == cid)
+                        return c;
+        }
+        return NULL;
+
+}
+
+static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
+{
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->scid == cid)
+                        return c;
+        }
+        return NULL;
+}
+
+/* Find channel with given SCID.
+ * Returns locked socket */
+static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
+{
+        struct l2cap_chan *c;
+
+        read_lock(&conn->chan_lock);
+        c = __l2cap_get_chan_by_scid(conn, cid);
+        if (c)
+                bh_lock_sock(c->sk);
+        read_unlock(&conn->chan_lock);
+        return c;
+}
+
+static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
+{
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &conn->chan_l, list) {
+                if (c->ident == ident)
+                        return c;
+        }
+        return NULL;
+}
+
+static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
+{
+        struct l2cap_chan *c;
+
+        read_lock(&conn->chan_lock);
+        c = __l2cap_get_chan_by_ident(conn, ident);
+        if (c)
+                bh_lock_sock(c->sk);
+        read_unlock(&conn->chan_lock);
+        return c;
+}
+
+static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
+{
+        struct l2cap_chan *c;
+
+        list_for_each_entry(c, &chan_list, global_l) {
+                if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
+                        goto found;
+        }
+
+        c = NULL;
+found:
+        return c;
+}
+
+int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
+{
+        int err;
+
+        write_lock_bh(&chan_list_lock);
+
+        if (psm && __l2cap_global_chan_by_addr(psm, src)) {
+                err = -EADDRINUSE;
+                goto done;
+        }
+
+        if (psm) {
+                chan->psm = psm;
+                chan->sport = psm;
+                err = 0;
+        } else {
+                u16 p;
+
+                err = -EINVAL;
+                for (p = 0x1001; p < 0x1100; p += 2)
+                        if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
+                                chan->psm   = cpu_to_le16(p);
+                                chan->sport = cpu_to_le16(p);
+                                err = 0;
+                                break;
+                        }
+        }
+
+done:
+        write_unlock_bh(&chan_list_lock);
+        return err;
+}
+
+int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
+{
+        write_lock_bh(&chan_list_lock);
+
+        chan->scid = scid;
+
+        write_unlock_bh(&chan_list_lock);
+
+        return 0;
+}
+
+static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
+{
+        u16 cid = L2CAP_CID_DYN_START;
+
+        for (; cid < L2CAP_CID_DYN_END; cid++) {
+                if (!__l2cap_get_chan_by_scid(conn, cid))
+                        return cid;
+        }
+
+        return 0;
+}
+
+struct l2cap_chan *l2cap_chan_create(struct sock *sk)
+{
+        struct l2cap_chan *chan;
+
+        chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
+        if (!chan)
+                return NULL;
+
+        chan->sk = sk;
+
+        write_lock_bh(&chan_list_lock);
+        list_add(&chan->global_l, &chan_list);
+        write_unlock_bh(&chan_list_lock);
+
+        return chan;
+}
+
+void l2cap_chan_destroy(struct l2cap_chan *chan)
+{
+        write_lock_bh(&chan_list_lock);
+        list_del(&chan->global_l);
+        write_unlock_bh(&chan_list_lock);
+
+        kfree(chan);
+}
+
+static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->sk;
+
+        BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
+                        chan->psm, chan->dcid);
+
+        conn->disc_reason = 0x13;
+
+        chan->conn = conn;
+
+        if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
+                if (conn->hcon->type == LE_LINK) {
+                        /* LE connection */
+                        chan->omtu = L2CAP_LE_DEFAULT_MTU;
+                        chan->scid = L2CAP_CID_LE_DATA;
+                        chan->dcid = L2CAP_CID_LE_DATA;
+                } else {
+                        /* Alloc CID for connection-oriented socket */
+                        chan->scid = l2cap_alloc_cid(conn);
+                        chan->omtu = L2CAP_DEFAULT_MTU;
+                }
+        } else if (sk->sk_type == SOCK_DGRAM) {
+                /* Connectionless socket */
+                chan->scid = L2CAP_CID_CONN_LESS;
+                chan->dcid = L2CAP_CID_CONN_LESS;
+                chan->omtu = L2CAP_DEFAULT_MTU;
+        } else {
+                /* Raw socket can send/recv signalling messages only */
+                chan->scid = L2CAP_CID_SIGNALING;
+                chan->dcid = L2CAP_CID_SIGNALING;
+                chan->omtu = L2CAP_DEFAULT_MTU;
+        }
+
+        sock_hold(sk);
+
+        list_add(&chan->list, &conn->chan_l);
+}
+
+/* Delete channel.
+ * Must be called on the locked socket. */
+void l2cap_chan_del(struct l2cap_chan *chan, int err)
+{
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
+        struct sock *parent = bt_sk(sk)->parent;
+
+        l2cap_sock_clear_timer(sk);
+
+        BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
+
+        if (conn) {
+                /* Delete from channel list */
+                write_lock_bh(&conn->chan_lock);
+                list_del(&chan->list);
+                write_unlock_bh(&conn->chan_lock);
+                __sock_put(sk);
+
+                chan->conn = NULL;
+                hci_conn_put(conn->hcon);
+        }
+
+        sk->sk_state = BT_CLOSED;
+        sock_set_flag(sk, SOCK_ZAPPED);
+
+        if (err)
+                sk->sk_err = err;
+
+        if (parent) {
+                bt_accept_unlink(sk);
+                parent->sk_data_ready(parent, 0);
+        } else
+                sk->sk_state_change(sk);
+
+        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE &&
+                        chan->conf_state & L2CAP_CONF_INPUT_DONE))
+                return;
+
+        skb_queue_purge(&chan->tx_q);
+
+        if (chan->mode == L2CAP_MODE_ERTM) {
+                struct srej_list *l, *tmp;
+
+                del_timer(&chan->retrans_timer);
+                del_timer(&chan->monitor_timer);
+                del_timer(&chan->ack_timer);
+
+                skb_queue_purge(&chan->srej_q);
+                skb_queue_purge(&chan->busy_q);
+
+                list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
+                        list_del(&l->list);
+                        kfree(l);
+                }
+        }
+}
+
+static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->sk;
+
+        if (sk->sk_type == SOCK_RAW) {
+                switch (chan->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (chan->psm == cpu_to_le16(0x0001)) {
+                if (chan->sec_level == BT_SECURITY_LOW)
+                        chan->sec_level = BT_SECURITY_SDP;
+
+                if (chan->sec_level == BT_SECURITY_HIGH)
+                        return HCI_AT_NO_BONDING_MITM;
+                else
+                        return HCI_AT_NO_BONDING;
+        } else {
+                switch (chan->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_GENERAL_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_GENERAL_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        }
+}
+
+/* Service level security */
+static inline int l2cap_check_security(struct l2cap_chan *chan)
+{
+        struct l2cap_conn *conn = chan->conn;
+        __u8 auth_type;
+
+        auth_type = l2cap_get_auth_type(chan);
+
+        return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
+}
+
+u8 l2cap_get_ident(struct l2cap_conn *conn)
+{
+        u8 id;
+
+        /* Get next available identificator.
+         *    1 - 128 are used by kernel.
+         *  129 - 199 are reserved.
+         *  200 - 254 are used by utilities like l2ping, etc.
+         */
+
+        spin_lock_bh(&conn->lock);
+
+        if (++conn->tx_ident > 128)
+                conn->tx_ident = 1;
+
+        id = conn->tx_ident;
+
+        spin_unlock_bh(&conn->lock);
+
+        return id;
+}
+
+void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
+{
+        struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
+        u8 flags;
+
+        BT_DBG("code 0x%2.2x", code);
+
+        if (!skb)
+                return;
+
+        if (lmp_no_flush_capable(conn->hcon->hdev))
+                flags = ACL_START_NO_FLUSH;
+        else
+                flags = ACL_START;
+
+        hci_send_acl(conn->hcon, skb, flags);
+}
+
+static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control)
+{
+        struct sk_buff *skb;
+        struct l2cap_hdr *lh;
+        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
+        struct l2cap_conn *conn = chan->conn;
+        struct sock *sk = (struct sock *)pi;
+        int count, hlen = L2CAP_HDR_SIZE + 2;
+        u8 flags;
+
+        if (sk->sk_state != BT_CONNECTED)
+                return;
+
+        if (chan->fcs == L2CAP_FCS_CRC16)
+                hlen += 2;
+
+        BT_DBG("chan %p, control 0x%2.2x", chan, control);
+
+        count = min_t(unsigned int, conn->mtu, hlen);
+        control |= L2CAP_CTRL_FRAME_TYPE;
+
+        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+                control |= L2CAP_CTRL_FINAL;
+                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+        }
+
+        if (chan->conn_state & L2CAP_CONN_SEND_PBIT) {
+                control |= L2CAP_CTRL_POLL;
+                chan->conn_state &= ~L2CAP_CONN_SEND_PBIT;
+        }
+
+        skb = bt_skb_alloc(count, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(chan->dcid);
+        put_unaligned_le16(control, skb_put(skb, 2));
+
+        if (chan->fcs == L2CAP_FCS_CRC16) {
+                u16 fcs = crc16(0, (u8 *)lh, count - 2);
+                put_unaligned_le16(fcs, skb_put(skb, 2));
+        }
+
+        if (lmp_no_flush_capable(conn->hcon->hdev))
+                flags = ACL_START_NO_FLUSH;
+        else
+                flags = ACL_START;
+
+        hci_send_acl(chan->conn->hcon, skb, flags);
+}
+
+static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control)
+{
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+                control |= L2CAP_SUPER_RCV_NOT_READY;
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+        } else
+                control |= L2CAP_SUPER_RCV_READY;
+
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+        l2cap_send_sframe(chan, control);
+}
+
+static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
+{
+        return !(chan->conf_state & L2CAP_CONF_CONNECT_PEND);
+}
+
+static void l2cap_do_start(struct l2cap_chan *chan)
+{
+        struct l2cap_conn *conn = chan->conn;
+
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
+                if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
+                        return;
+
+                if (l2cap_check_security(chan) &&
+                                __l2cap_no_conn_pending(chan)) {
+                        struct l2cap_conn_req req;
+                        req.scid = cpu_to_le16(chan->scid);
+                        req.psm  = chan->psm;
+
+                        chan->ident = l2cap_get_ident(conn);
+                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
+                                                        sizeof(req), &req);
+                }
+        } else {
+                struct l2cap_info_req req;
+                req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
+                conn->info_ident = l2cap_get_ident(conn);
+
+                mod_timer(&conn->info_timer, jiffies +
+                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
+
+                l2cap_send_cmd(conn, conn->info_ident,
+                                        L2CAP_INFO_REQ, sizeof(req), &req);
+        }
+}
+
+static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
+{
+        u32 local_feat_mask = l2cap_feat_mask;
+        if (!disable_ertm)
+                local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
+
+        switch (mode) {
+        case L2CAP_MODE_ERTM:
+                return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
+        case L2CAP_MODE_STREAMING:
+                return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
+        default:
+                return 0x00;
+        }
+}
+
+void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
+{
+        struct sock *sk;
+        struct l2cap_disconn_req req;
+
+        if (!conn)
+                return;
+
+        sk = chan->sk;
+
+        if (chan->mode == L2CAP_MODE_ERTM) {
+                del_timer(&chan->retrans_timer);
+                del_timer(&chan->monitor_timer);
+                del_timer(&chan->ack_timer);
+        }
+
+        req.dcid = cpu_to_le16(chan->dcid);
+        req.scid = cpu_to_le16(chan->scid);
+        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                        L2CAP_DISCONN_REQ, sizeof(req), &req);
+
+        sk->sk_state = BT_DISCONN;
+        sk->sk_err = err;
+}
+
+/* ---- L2CAP connections ---- */
+static void l2cap_conn_start(struct l2cap_conn *conn)
+{
+        struct l2cap_chan *chan, *tmp;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
+
+                bh_lock_sock(sk);
+
+                if (sk->sk_type != SOCK_SEQPACKET &&
+                                sk->sk_type != SOCK_STREAM) {
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (sk->sk_state == BT_CONNECT) {
+                        struct l2cap_conn_req req;
+
+                        if (!l2cap_check_security(chan) ||
+                                        !__l2cap_no_conn_pending(chan)) {
+                                bh_unlock_sock(sk);
+                                continue;
+                        }
+
+                        if (!l2cap_mode_supported(chan->mode,
+                                        conn->feat_mask)
+                                        && chan->conf_state &
+                                        L2CAP_CONF_STATE2_DEVICE) {
+                                /* __l2cap_sock_close() calls list_del(chan)
+                                 * so release the lock */
+                                read_unlock_bh(&conn->chan_lock);
+                                 __l2cap_sock_close(sk, ECONNRESET);
+                                read_lock_bh(&conn->chan_lock);
+                                bh_unlock_sock(sk);
+                                continue;
+                        }
+
+                        req.scid = cpu_to_le16(chan->scid);
+                        req.psm  = chan->psm;
+
+                        chan->ident = l2cap_get_ident(conn);
+                        chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
+                                                        sizeof(req), &req);
+
+                } else if (sk->sk_state == BT_CONNECT2) {
+                        struct l2cap_conn_rsp rsp;
+                        char buf[128];
+                        rsp.scid = cpu_to_le16(chan->dcid);
+                        rsp.dcid = cpu_to_le16(chan->scid);
+
+                        if (l2cap_check_security(chan)) {
+                                if (bt_sk(sk)->defer_setup) {
+                                        struct sock *parent = bt_sk(sk)->parent;
+                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
+
+                                } else {
+                                        sk->sk_state = BT_CONFIG;
+                                        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+                                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+                                }
+                        } else {
+                                rsp.result = cpu_to_le16(L2CAP_CR_PEND);
+                                rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
+                        }
+
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
+
+                        if (chan->conf_state & L2CAP_CONF_REQ_SENT ||
+                                        rsp.result != L2CAP_CR_SUCCESS) {
+                                bh_unlock_sock(sk);
+                                continue;
+                        }
+
+                        chan->conf_state |= L2CAP_CONF_REQ_SENT;
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                                l2cap_build_conf_req(chan, buf), buf);
+                        chan->num_conf_req++;
+                }
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&conn->chan_lock);
+}
+
+/* Find socket with cid and source bdaddr.
+ * Returns closest match, locked.
+ */
+static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src)
+{
+        struct l2cap_chan *c, *c1 = NULL;
+
+        read_lock(&chan_list_lock);
+
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
+
+                if (state && sk->sk_state != state)
+                        continue;
+
+                if (c->scid == cid) {
+                        /* Exact match. */
+                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                                read_unlock(&chan_list_lock);
+                                return c;
+                        }
+
+                        /* Closest match */
+                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                                c1 = c;
+                }
+        }
+
+        read_unlock(&chan_list_lock);
+
+        return c1;
+}
+
+static void l2cap_le_conn_ready(struct l2cap_conn *conn)
+{
+        struct sock *parent, *sk;
+        struct l2cap_chan *chan, *pchan;
+
+        BT_DBG("");
+
+        /* Check if we have socket listening on cid */
+        pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
+                                                        conn->src);
+        if (!pchan)
+                return;
+
+        parent = pchan->sk;
+
+        bh_lock_sock(parent);
+
+        /* Check for backlog size */
+        if (sk_acceptq_is_full(parent)) {
+                BT_DBG("backlog full %d", parent->sk_ack_backlog);
+                goto clean;
+        }
+
+        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
+        if (!sk)
+                goto clean;
+
+        chan = l2cap_chan_create(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                goto clean;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
+        write_lock_bh(&conn->chan_lock);
+
+        hci_conn_hold(conn->hcon);
+
+        l2cap_sock_init(sk, parent);
+
+        bacpy(&bt_sk(sk)->src, conn->src);
+        bacpy(&bt_sk(sk)->dst, conn->dst);
+
+        bt_accept_enqueue(parent, sk);
+
+        __l2cap_chan_add(conn, chan);
+
+        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+        sk->sk_state = BT_CONNECTED;
+        parent->sk_data_ready(parent, 0);
+
+        write_unlock_bh(&conn->chan_lock);
+
+clean:
+        bh_unlock_sock(parent);
+}
+
+static void l2cap_conn_ready(struct l2cap_conn *conn)
+{
+        struct l2cap_chan *chan;
+
+        BT_DBG("conn %p", conn);
+
+        if (!conn->hcon->out && conn->hcon->type == LE_LINK)
+                l2cap_le_conn_ready(conn);
+
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
+
+                bh_lock_sock(sk);
+
+                if (conn->hcon->type == LE_LINK) {
+                        l2cap_sock_clear_timer(sk);
+                        sk->sk_state = BT_CONNECTED;
+                        sk->sk_state_change(sk);
+                }
+
+                if (sk->sk_type != SOCK_SEQPACKET &&
+                                sk->sk_type != SOCK_STREAM) {
+                        l2cap_sock_clear_timer(sk);
+                        sk->sk_state = BT_CONNECTED;
+                        sk->sk_state_change(sk);
+                } else if (sk->sk_state == BT_CONNECT)
+                        l2cap_do_start(chan);
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&conn->chan_lock);
+}
+
+/* Notify sockets that we cannot guaranty reliability anymore */
+static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
+{
+        struct l2cap_chan *chan;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
+
+                if (chan->force_reliable)
+                        sk->sk_err = err;
+        }
+
+        read_unlock(&conn->chan_lock);
+}
+
+static void l2cap_info_timeout(unsigned long arg)
+{
+        struct l2cap_conn *conn = (void *) arg;
+
+        conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+        conn->info_ident = 0;
+
+        l2cap_conn_start(conn);
+}
+
+static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+
+        if (conn || status)
+                return conn;
+
+        conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
+        if (!conn)
+                return NULL;
+
+        hcon->l2cap_data = conn;
+        conn->hcon = hcon;
+
+        BT_DBG("hcon %p conn %p", hcon, conn);
+
+        if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
+                conn->mtu = hcon->hdev->le_mtu;
+        else
+                conn->mtu = hcon->hdev->acl_mtu;
+
+        conn->src = &hcon->hdev->bdaddr;
+        conn->dst = &hcon->dst;
+
+        conn->feat_mask = 0;
+
+        spin_lock_init(&conn->lock);
+        rwlock_init(&conn->chan_lock);
+
+        INIT_LIST_HEAD(&conn->chan_l);
+
+        if (hcon->type != LE_LINK)
+                setup_timer(&conn->info_timer, l2cap_info_timeout,
+                                                (unsigned long) conn);
+
+        conn->disc_reason = 0x13;
+
+        return conn;
+}
+
+static void l2cap_conn_del(struct hci_conn *hcon, int err)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+        struct l2cap_chan *chan, *l;
+        struct sock *sk;
+
+        if (!conn)
+                return;
+
+        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+
+        kfree_skb(conn->rx_skb);
+
+        /* Kill channels */
+        list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
+                sk = chan->sk;
+                bh_lock_sock(sk);
+                l2cap_chan_del(chan, err);
+                bh_unlock_sock(sk);
+                l2cap_sock_kill(sk);
+        }
+
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
+                del_timer_sync(&conn->info_timer);
+
+        hcon->l2cap_data = NULL;
+        kfree(conn);
+}
+
+static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
+{
+        write_lock_bh(&conn->chan_lock);
+        __l2cap_chan_add(conn, chan);
+        write_unlock_bh(&conn->chan_lock);
+}
+
+/* ---- Socket interface ---- */
+
+/* Find socket with psm and source bdaddr.
+ * Returns closest match.
+ */
+static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
+{
+        struct l2cap_chan *c, *c1 = NULL;
+
+        read_lock(&chan_list_lock);
+
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
+
+                if (state && sk->sk_state != state)
+                        continue;
+
+                if (c->psm == psm) {
+                        /* Exact match. */
+                        if (!bacmp(&bt_sk(sk)->src, src)) {
+                                read_unlock(&chan_list_lock);
+                                return c;
+                        }
+
+                        /* Closest match */
+                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                                c1 = c;
+                }
+        }
+
+        read_unlock(&chan_list_lock);
+
+        return c1;
+}
+
+int l2cap_chan_connect(struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->sk;
+        bdaddr_t *src = &bt_sk(sk)->src;
+        bdaddr_t *dst = &bt_sk(sk)->dst;
+        struct l2cap_conn *conn;
+        struct hci_conn *hcon;
+        struct hci_dev *hdev;
+        __u8 auth_type;
+        int err;
+
+        BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
+                                                        chan->psm);
+
+        hdev = hci_get_route(dst, src);
+        if (!hdev)
+                return -EHOSTUNREACH;
+
+        hci_dev_lock_bh(hdev);
+
+        auth_type = l2cap_get_auth_type(chan);
+
+        if (chan->dcid == L2CAP_CID_LE_DATA)
+                hcon = hci_connect(hdev, LE_LINK, dst,
+                                        chan->sec_level, auth_type);
+        else
+                hcon = hci_connect(hdev, ACL_LINK, dst,
+                                        chan->sec_level, auth_type);
+
+        if (IS_ERR(hcon)) {
+                err = PTR_ERR(hcon);
+                goto done;
+        }
+
+        conn = l2cap_conn_add(hcon, 0);
+        if (!conn) {
+                hci_conn_put(hcon);
+                err = -ENOMEM;
+                goto done;
+        }
+
+        /* Update source addr of the socket */
+        bacpy(src, conn->src);
+
+        l2cap_chan_add(conn, chan);
+
+        sk->sk_state = BT_CONNECT;
+        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+        if (hcon->state == BT_CONNECTED) {
+                if (sk->sk_type != SOCK_SEQPACKET &&
+                                sk->sk_type != SOCK_STREAM) {
+                        l2cap_sock_clear_timer(sk);
+                        if (l2cap_check_security(chan))
+                                sk->sk_state = BT_CONNECTED;
+                } else
+                        l2cap_do_start(chan);
+        }
+
+        err = 0;
+
+done:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+int __l2cap_wait_ack(struct sock *sk)
+{
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        DECLARE_WAITQUEUE(wait, current);
+        int err = 0;
+        int timeo = HZ/5;
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        while ((chan->unacked_frames > 0 && chan->conn)) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (!timeo)
+                        timeo = HZ/5;
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                err = sock_error(sk);
+                if (err)
+                        break;
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return err;
+}
+
+static void l2cap_monitor_timeout(unsigned long arg)
+{
+        struct l2cap_chan *chan = (void *) arg;
+        struct sock *sk = chan->sk;
+
+        BT_DBG("chan %p", chan);
+
+        bh_lock_sock(sk);
+        if (chan->retry_count >= chan->remote_max_tx) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+                bh_unlock_sock(sk);
+                return;
+        }
+
+        chan->retry_count++;
+        __mod_monitor_timer();
+
+        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
+        bh_unlock_sock(sk);
+}
+
+static void l2cap_retrans_timeout(unsigned long arg)
+{
+        struct l2cap_chan *chan = (void *) arg;
+        struct sock *sk = chan->sk;
+
+        BT_DBG("chan %p", chan);
+
+        bh_lock_sock(sk);
+        chan->retry_count = 1;
+        __mod_monitor_timer();
+
+        chan->conn_state |= L2CAP_CONN_WAIT_F;
+
+        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
+        bh_unlock_sock(sk);
+}
+
+static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
+{
+        struct sk_buff *skb;
+
+        while ((skb = skb_peek(&chan->tx_q)) &&
+                        chan->unacked_frames) {
+                if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
+                        break;
+
+                skb = skb_dequeue(&chan->tx_q);
+                kfree_skb(skb);
+
+                chan->unacked_frames--;
+        }
+
+        if (!chan->unacked_frames)
+                del_timer(&chan->retrans_timer);
+}
+
+void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
+{
+        struct hci_conn *hcon = chan->conn->hcon;
+        u16 flags;
+
+        BT_DBG("chan %p, skb %p len %d", chan, skb, skb->len);
+
+        if (!chan->flushable && lmp_no_flush_capable(hcon->hdev))
+                flags = ACL_START_NO_FLUSH;
+        else
+                flags = ACL_START;
+
+        hci_send_acl(hcon, skb, flags);
+}
+
+void l2cap_streaming_send(struct l2cap_chan *chan)
+{
+        struct sk_buff *skb;
+        u16 control, fcs;
+
+        while ((skb = skb_dequeue(&chan->tx_q))) {
+                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
+                control |= chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
+                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
+
+                if (chan->fcs == L2CAP_FCS_CRC16) {
+                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
+                }
+
+                l2cap_do_send(chan, skb);
+
+                chan->next_tx_seq = (chan->next_tx_seq + 1) % 64;
+        }
+}
+
+static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq)
+{
+        struct sk_buff *skb, *tx_skb;
+        u16 control, fcs;
+
+        skb = skb_peek(&chan->tx_q);
+        if (!skb)
+                return;
+
+        do {
+                if (bt_cb(skb)->tx_seq == tx_seq)
+                        break;
+
+                if (skb_queue_is_last(&chan->tx_q, skb))
+                        return;
+
+        } while ((skb = skb_queue_next(&chan->tx_q, skb)));
+
+        if (chan->remote_max_tx &&
+                        bt_cb(skb)->retries == chan->remote_max_tx) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+                return;
+        }
+
+        tx_skb = skb_clone(skb, GFP_ATOMIC);
+        bt_cb(skb)->retries++;
+        control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+        control &= L2CAP_CTRL_SAR;
+
+        if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+                control |= L2CAP_CTRL_FINAL;
+                chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+        }
+
+        control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                        | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
+
+        put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+
+        if (chan->fcs == L2CAP_FCS_CRC16) {
+                fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
+                put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+        }
+
+        l2cap_do_send(chan, tx_skb);
+}
+
+int l2cap_ertm_send(struct l2cap_chan *chan)
+{
+        struct sk_buff *skb, *tx_skb;
+        struct sock *sk = chan->sk;
+        u16 control, fcs;
+        int nsent = 0;
+
+        if (sk->sk_state != BT_CONNECTED)
+                return -ENOTCONN;
+
+        while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
+
+                if (chan->remote_max_tx &&
+                                bt_cb(skb)->retries == chan->remote_max_tx) {
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
+                        break;
+                }
+
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
+                bt_cb(skb)->retries++;
+
+                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+                control &= L2CAP_CTRL_SAR;
+
+                if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
+                        control |= L2CAP_CTRL_FINAL;
+                        chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+                }
+                control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                                | (chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
+                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+
+
+                if (chan->fcs == L2CAP_FCS_CRC16) {
+                        fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
+                }
+
+                l2cap_do_send(chan, tx_skb);
+
+                __mod_retrans_timer();
+
+                bt_cb(skb)->tx_seq = chan->next_tx_seq;
+                chan->next_tx_seq = (chan->next_tx_seq + 1) % 64;
+
+                if (bt_cb(skb)->retries == 1)
+                        chan->unacked_frames++;
+
+                chan->frames_sent++;
+
+                if (skb_queue_is_last(&chan->tx_q, skb))
+                        chan->tx_send_head = NULL;
+                else
+                        chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
+
+                nsent++;
+        }
+
+        return nsent;
+}
+
+static int l2cap_retransmit_frames(struct l2cap_chan *chan)
+{
+        int ret;
+
+        if (!skb_queue_empty(&chan->tx_q))
+                chan->tx_send_head = chan->tx_q.next;
+
+        chan->next_tx_seq = chan->expected_ack_seq;
+        ret = l2cap_ertm_send(chan);
+        return ret;
+}
+
+static void l2cap_send_ack(struct l2cap_chan *chan)
+{
+        u16 control = 0;
+
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+                control |= L2CAP_SUPER_RCV_NOT_READY;
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+                l2cap_send_sframe(chan, control);
+                return;
+        }
+
+        if (l2cap_ertm_send(chan) > 0)
+                return;
+
+        control |= L2CAP_SUPER_RCV_READY;
+        l2cap_send_sframe(chan, control);
+}
+
+static void l2cap_send_srejtail(struct l2cap_chan *chan)
+{
+        struct srej_list *tail;
+        u16 control;
+
+        control = L2CAP_SUPER_SELECT_REJECT;
+        control |= L2CAP_CTRL_FINAL;
+
+        tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
+        control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+        l2cap_send_sframe(chan, control);
+}
+
+static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
+        struct sk_buff **frag;
+        int err, sent = 0;
+
+        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
+                return -EFAULT;
+
+        sent += count;
+        len  -= count;
+
+        /* Continuation fragments (no L2CAP header) */
+        frag = &skb_shinfo(skb)->frag_list;
+        while (len) {
+                count = min_t(unsigned int, conn->mtu, len);
+
+                *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
+                if (!*frag)
+                        return err;
+                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
+                        return -EFAULT;
+
+                sent += count;
+                len  -= count;
+
+                frag = &(*frag)->next;
+        }
+
+        return sent;
+}
+
+struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+{
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE + 2;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(err);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(chan->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        put_unaligned_le16(chan->psm, skb_put(skb, 2));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+        return skb;
+}
+
+struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+{
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(err);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(chan->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+        return skb;
+}
+
+struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
+{
+        struct sock *sk = chan->sk;
+        struct l2cap_conn *conn = chan->conn;
+        struct sk_buff *skb;
+        int err, count, hlen = L2CAP_HDR_SIZE + 2;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, (int)len);
+
+        if (!conn)
+                return ERR_PTR(-ENOTCONN);
+
+        if (sdulen)
+                hlen += 2;
+
+        if (chan->fcs == L2CAP_FCS_CRC16)
+                hlen += 2;
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+        skb = bt_skb_send_alloc(sk, count + hlen,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return ERR_PTR(err);
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = cpu_to_le16(chan->dcid);
+        lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+        put_unaligned_le16(control, skb_put(skb, 2));
+        if (sdulen)
+                put_unaligned_le16(sdulen, skb_put(skb, 2));
+
+        err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
+        if (unlikely(err < 0)) {
+                kfree_skb(skb);
+                return ERR_PTR(err);
+        }
+
+        if (chan->fcs == L2CAP_FCS_CRC16)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        bt_cb(skb)->retries = 0;
+        return skb;
+}
+
+int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
+{
+        struct sk_buff *skb;
+        struct sk_buff_head sar_queue;
+        u16 control;
+        size_t size = 0;
+
+        skb_queue_head_init(&sar_queue);
+        control = L2CAP_SDU_START;
+        skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        __skb_queue_tail(&sar_queue, skb);
+        len -= chan->remote_mps;
+        size += chan->remote_mps;
+
+        while (len > 0) {
+                size_t buflen;
+
+                if (len > chan->remote_mps) {
+                        control = L2CAP_SDU_CONTINUE;
+                        buflen = chan->remote_mps;
+                } else {
+                        control = L2CAP_SDU_END;
+                        buflen = len;
+                }
+
+                skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
+                if (IS_ERR(skb)) {
+                        skb_queue_purge(&sar_queue);
+                        return PTR_ERR(skb);
+                }
+
+                __skb_queue_tail(&sar_queue, skb);
+                len -= buflen;
+                size += buflen;
+        }
+        skb_queue_splice_tail(&sar_queue, &chan->tx_q);
+        if (chan->tx_send_head == NULL)
+                chan->tx_send_head = sar_queue.next;
+
+        return size;
+}
+
+static void l2cap_chan_ready(struct sock *sk)
+{
+        struct sock *parent = bt_sk(sk)->parent;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+        BT_DBG("sk %p, parent %p", sk, parent);
+
+        chan->conf_state = 0;
+        l2cap_sock_clear_timer(sk);
+
+        if (!parent) {
+                /* Outgoing channel.
+                 * Wake up socket sleeping on connect.
+                 */
+                sk->sk_state = BT_CONNECTED;
+                sk->sk_state_change(sk);
+        } else {
+                /* Incoming channel.
+                 * Wake up socket sleeping on accept.
+                 */
+                parent->sk_data_ready(parent, 0);
+        }
+}
+
+/* Copy frame to all raw sockets on that connection */
+static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct sk_buff *nskb;
+        struct l2cap_chan *chan;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&conn->chan_lock);
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
+                if (sk->sk_type != SOCK_RAW)
+                        continue;
+
+                /* Don't send frame to the socket it came from */
+                if (skb->sk == sk)
+                        continue;
+                nskb = skb_clone(skb, GFP_ATOMIC);
+                if (!nskb)
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+        read_unlock(&conn->chan_lock);
+}
+
+/* ---- L2CAP signalling commands ---- */
+static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
+                                u8 code, u8 ident, u16 dlen, void *data)
+{
+        struct sk_buff *skb, **frag;
+        struct l2cap_cmd_hdr *cmd;
+        struct l2cap_hdr *lh;
+        int len, count;
+
+        BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
+                        conn, code, ident, dlen);
+
+        len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
+        count = min_t(unsigned int, conn->mtu, len);
+
+        skb = bt_skb_alloc(count, GFP_ATOMIC);
+        if (!skb)
+                return NULL;
+
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
+
+        if (conn->hcon->type == LE_LINK)
+                lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
+        else
+                lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
+
+        cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
+        cmd->code  = code;
+        cmd->ident = ident;
+        cmd->len   = cpu_to_le16(dlen);
+
+        if (dlen) {
+                count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
+                memcpy(skb_put(skb, count), data, count);
+                data += count;
+        }
+
+        len -= skb->len;
+
+        /* Continuation fragments (no L2CAP header) */
+        frag = &skb_shinfo(skb)->frag_list;
+        while (len) {
+                count = min_t(unsigned int, conn->mtu, len);
+
+                *frag = bt_skb_alloc(count, GFP_ATOMIC);
+                if (!*frag)
+                        goto fail;
+
+                memcpy(skb_put(*frag, count), data, count);
+
+                len  -= count;
+                data += count;
+
+                frag = &(*frag)->next;
+        }
+
+        return skb;
+
+fail:
+        kfree_skb(skb);
+        return NULL;
+}
+
+static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
+{
+        struct l2cap_conf_opt *opt = *ptr;
+        int len;
+
+        len = L2CAP_CONF_OPT_SIZE + opt->len;
+        *ptr += len;
+
+        *type = opt->type;
+        *olen = opt->len;
+
+        switch (opt->len) {
+        case 1:
+                *val = *((u8 *) opt->val);
+                break;
+
+        case 2:
+                *val = get_unaligned_le16(opt->val);
+                break;
+
+        case 4:
+                *val = get_unaligned_le32(opt->val);
+                break;
+
+        default:
+                *val = (unsigned long) opt->val;
+                break;
+        }
+
+        BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
+        return len;
+}
+
+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
+{
+        struct l2cap_conf_opt *opt = *ptr;
+
+        BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
+
+        opt->type = type;
+        opt->len  = len;
+
+        switch (len) {
+        case 1:
+                *((u8 *) opt->val)  = val;
+                break;
+
+        case 2:
+                put_unaligned_le16(val, opt->val);
+                break;
+
+        case 4:
+                put_unaligned_le32(val, opt->val);
+                break;
+
+        default:
+                memcpy(opt->val, (void *) val, len);
+                break;
+        }
+
+        *ptr += L2CAP_CONF_OPT_SIZE + len;
+}
+
+static void l2cap_ack_timeout(unsigned long arg)
+{
+        struct l2cap_chan *chan = (void *) arg;
+
+        bh_lock_sock(chan->sk);
+        l2cap_send_ack(chan);
+        bh_unlock_sock(chan->sk);
+}
+
+static inline void l2cap_ertm_init(struct l2cap_chan *chan)
+{
+        struct sock *sk = chan->sk;
+
+        chan->expected_ack_seq = 0;
+        chan->unacked_frames = 0;
+        chan->buffer_seq = 0;
+        chan->num_acked = 0;
+        chan->frames_sent = 0;
+
+        setup_timer(&chan->retrans_timer, l2cap_retrans_timeout,
+                                                        (unsigned long) chan);
+        setup_timer(&chan->monitor_timer, l2cap_monitor_timeout,
+                                                        (unsigned long) chan);
+        setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan);
+
+        skb_queue_head_init(&chan->srej_q);
+        skb_queue_head_init(&chan->busy_q);
+
+        INIT_LIST_HEAD(&chan->srej_l);
+
+        INIT_WORK(&chan->busy_work, l2cap_busy_work);
+
+        sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
+}
+
+static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
+{
+        switch (mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                if (l2cap_mode_supported(mode, remote_feat_mask))
+                        return mode;
+                /* fall through */
+        default:
+                return L2CAP_MODE_BASIC;
+        }
+}
+
+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
+{
+        struct l2cap_conf_req *req = data;
+        struct l2cap_conf_rfc rfc = { .mode = chan->mode };
+        void *ptr = req->data;
+
+        BT_DBG("chan %p", chan);
+
+        if (chan->num_conf_req || chan->num_conf_rsp)
+                goto done;
+
+        switch (chan->mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                if (chan->conf_state & L2CAP_CONF_STATE2_DEVICE)
+                        break;
+
+                /* fall through */
+        default:
+                chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
+                break;
+        }
+
+done:
+        if (chan->imtu != L2CAP_DEFAULT_MTU)
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
+                                !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
+                        break;
+
+                rfc.mode            = L2CAP_MODE_BASIC;
+                rfc.txwin_size      = 0;
+                rfc.max_transmit    = 0;
+                rfc.retrans_timeout = 0;
+                rfc.monitor_timeout = 0;
+                rfc.max_pdu_size    = 0;
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
+                break;
+
+        case L2CAP_MODE_ERTM:
+                rfc.mode            = L2CAP_MODE_ERTM;
+                rfc.txwin_size      = chan->tx_win;
+                rfc.max_transmit    = chan->max_tx;
+                rfc.retrans_timeout = 0;
+                rfc.monitor_timeout = 0;
+                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+                if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10)
+                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
+
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
+                        break;
+
+                if (chan->fcs == L2CAP_FCS_NONE ||
+                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        chan->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+                }
+                break;
+
+        case L2CAP_MODE_STREAMING:
+                rfc.mode            = L2CAP_MODE_STREAMING;
+                rfc.txwin_size      = 0;
+                rfc.max_transmit    = 0;
+                rfc.retrans_timeout = 0;
+                rfc.monitor_timeout = 0;
+                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+                if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10)
+                        rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+                                                        (unsigned long) &rfc);
+
+                if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
+                        break;
+
+                if (chan->fcs == L2CAP_FCS_NONE ||
+                                chan->conf_state & L2CAP_CONF_NO_FCS_RECV) {
+                        chan->fcs = L2CAP_FCS_NONE;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
+                }
+                break;
+        }
+
+        req->dcid  = cpu_to_le16(chan->dcid);
+        req->flags = cpu_to_le16(0);
+
+        return ptr - data;
+}
+
+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
+{
+        struct l2cap_conf_rsp *rsp = data;
+        void *ptr = rsp->data;
+        void *req = chan->conf_req;
+        int len = chan->conf_len;
+        int type, hint, olen;
+        unsigned long val;
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
+        u16 mtu = L2CAP_DEFAULT_MTU;
+        u16 result = L2CAP_CONF_SUCCESS;
+
+        BT_DBG("chan %p", chan);
+
+        while (len >= L2CAP_CONF_OPT_SIZE) {
+                len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
+
+                hint  = type & L2CAP_CONF_HINT;
+                type &= L2CAP_CONF_MASK;
+
+                switch (type) {
+                case L2CAP_CONF_MTU:
+                        mtu = val;
+                        break;
+
+                case L2CAP_CONF_FLUSH_TO:
+                        chan->flush_to = val;
+                        break;
+
+                case L2CAP_CONF_QOS:
+                        break;
+
+                case L2CAP_CONF_RFC:
+                        if (olen == sizeof(rfc))
+                                memcpy(&rfc, (void *) val, olen);
+                        break;
+
+                case L2CAP_CONF_FCS:
+                        if (val == L2CAP_FCS_NONE)
+                                chan->conf_state |= L2CAP_CONF_NO_FCS_RECV;
+
+                        break;
+
+                default:
+                        if (hint)
+                                break;
+
+                        result = L2CAP_CONF_UNKNOWN;
+                        *((u8 *) ptr++) = type;
+                        break;
+                }
+        }
+
+        if (chan->num_conf_rsp || chan->num_conf_req > 1)
+                goto done;
+
+        switch (chan->mode) {
+        case L2CAP_MODE_STREAMING:
+        case L2CAP_MODE_ERTM:
+                if (!(chan->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
+                        chan->mode = l2cap_select_mode(rfc.mode,
+                                        chan->conn->feat_mask);
+                        break;
+                }
+
+                if (chan->mode != rfc.mode)
+                        return -ECONNREFUSED;
+
+                break;
+        }
+
+done:
+        if (chan->mode != rfc.mode) {
+                result = L2CAP_CONF_UNACCEPT;
+                rfc.mode = chan->mode;
+
+                if (chan->num_conf_rsp == 1)
+                        return -ECONNREFUSED;
+
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+        }
+
+
+        if (result == L2CAP_CONF_SUCCESS) {
+                /* Configure output options and let the other side know
+                 * which ones we don't like. */
+
+                if (mtu < L2CAP_DEFAULT_MIN_MTU)
+                        result = L2CAP_CONF_UNACCEPT;
+                else {
+                        chan->omtu = mtu;
+                        chan->conf_state |= L2CAP_CONF_MTU_DONE;
+                }
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
+
+                switch (rfc.mode) {
+                case L2CAP_MODE_BASIC:
+                        chan->fcs = L2CAP_FCS_NONE;
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+                        break;
+
+                case L2CAP_MODE_ERTM:
+                        chan->remote_tx_win = rfc.txwin_size;
+                        chan->remote_max_tx = rfc.max_transmit;
+
+                        if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
+
+                        chan->remote_mps = le16_to_cpu(rfc.max_pdu_size);
+
+                        rfc.retrans_timeout =
+                                le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
+                        rfc.monitor_timeout =
+                                le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
+
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
+                        break;
+
+                case L2CAP_MODE_STREAMING:
+                        if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10)
+                                rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10);
+
+                        chan->remote_mps = le16_to_cpu(rfc.max_pdu_size);
+
+                        chan->conf_state |= L2CAP_CONF_MODE_DONE;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
+                        break;
+
+                default:
+                        result = L2CAP_CONF_UNACCEPT;
+
+                        memset(&rfc, 0, sizeof(rfc));
+                        rfc.mode = chan->mode;
+                }
+
+                if (result == L2CAP_CONF_SUCCESS)
+                        chan->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+        }
+        rsp->scid   = cpu_to_le16(chan->dcid);
+        rsp->result = cpu_to_le16(result);
+        rsp->flags  = cpu_to_le16(0x0000);
+
+        return ptr - data;
+}
+
+static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
+{
+        struct l2cap_conf_req *req = data;
+        void *ptr = req->data;
+        int type, olen;
+        unsigned long val;
+        struct l2cap_conf_rfc rfc;
+
+        BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
+
+        while (len >= L2CAP_CONF_OPT_SIZE) {
+                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
+
+                switch (type) {
+                case L2CAP_CONF_MTU:
+                        if (val < L2CAP_DEFAULT_MIN_MTU) {
+                                *result = L2CAP_CONF_UNACCEPT;
+                                chan->imtu = L2CAP_DEFAULT_MIN_MTU;
+                        } else
+                                chan->imtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
+                        break;
+
+                case L2CAP_CONF_FLUSH_TO:
+                        chan->flush_to = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
+                                                        2, chan->flush_to);
+                        break;
+
+                case L2CAP_CONF_RFC:
+                        if (olen == sizeof(rfc))
+                                memcpy(&rfc, (void *)val, olen);
+
+                        if ((chan->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
+                                                        rfc.mode != chan->mode)
+                                return -ECONNREFUSED;
+
+                        chan->fcs = 0;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+                        break;
+                }
+        }
+
+        if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
+                return -ECONNREFUSED;
+
+        chan->mode = rfc.mode;
+
+        if (*result == L2CAP_CONF_SUCCESS) {
+                switch (rfc.mode) {
+                case L2CAP_MODE_ERTM:
+                        chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                        chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+                        chan->mps    = le16_to_cpu(rfc.max_pdu_size);
+                        break;
+                case L2CAP_MODE_STREAMING:
+                        chan->mps    = le16_to_cpu(rfc.max_pdu_size);
+                }
+        }
+
+        req->dcid   = cpu_to_le16(chan->dcid);
+        req->flags  = cpu_to_le16(0x0000);
+
+        return ptr - data;
+}
+
+static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
+{
+        struct l2cap_conf_rsp *rsp = data;
+        void *ptr = rsp->data;
+
+        BT_DBG("chan %p", chan);
+
+        rsp->scid   = cpu_to_le16(chan->dcid);
+        rsp->result = cpu_to_le16(result);
+        rsp->flags  = cpu_to_le16(flags);
+
+        return ptr - data;
+}
+
+void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
+{
+        struct l2cap_conn_rsp rsp;
+        struct l2cap_conn *conn = chan->conn;
+        u8 buf[128];
+
+        rsp.scid   = cpu_to_le16(chan->dcid);
+        rsp.dcid   = cpu_to_le16(chan->scid);
+        rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+        l2cap_send_cmd(conn, chan->ident,
+                                L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+
+        if (chan->conf_state & L2CAP_CONF_REQ_SENT)
+                return;
+
+        chan->conf_state |= L2CAP_CONF_REQ_SENT;
+        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                        l2cap_build_conf_req(chan, buf), buf);
+        chan->num_conf_req++;
+}
+
+static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
+{
+        int type, olen;
+        unsigned long val;
+        struct l2cap_conf_rfc rfc;
+
+        BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
+
+        if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
+                return;
+
+        while (len >= L2CAP_CONF_OPT_SIZE) {
+                len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
+
+                switch (type) {
+                case L2CAP_CONF_RFC:
+                        if (olen == sizeof(rfc))
+                                memcpy(&rfc, (void *)val, olen);
+                        goto done;
+                }
+        }
+
+done:
+        switch (rfc.mode) {
+        case L2CAP_MODE_ERTM:
+                chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+                chan->mps    = le16_to_cpu(rfc.max_pdu_size);
+                break;
+        case L2CAP_MODE_STREAMING:
+                chan->mps    = le16_to_cpu(rfc.max_pdu_size);
+        }
+}
+
+static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
+
+        if (rej->reason != 0x0000)
+                return 0;
+
+        if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
+                                        cmd->ident == conn->info_ident) {
+                del_timer(&conn->info_timer);
+
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+                conn->info_ident = 0;
+
+                l2cap_conn_start(conn);
+        }
+
+        return 0;
+}
+
+static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
+        struct l2cap_conn_rsp rsp;
+        struct l2cap_chan *chan = NULL, *pchan;
+        struct sock *parent, *sk = NULL;
+        int result, status = L2CAP_CS_NO_INFO;
+
+        u16 dcid = 0, scid = __le16_to_cpu(req->scid);
+        __le16 psm = req->psm;
+
+        BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
+
+        /* Check if we have socket listening on psm */
+        pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
+        if (!pchan) {
+                result = L2CAP_CR_BAD_PSM;
+                goto sendresp;
+        }
+
+        parent = pchan->sk;
+
+        bh_lock_sock(parent);
+
+        /* Check if the ACL is secure enough (if not SDP) */
+        if (psm != cpu_to_le16(0x0001) &&
+                                !hci_conn_check_link_mode(conn->hcon)) {
+                conn->disc_reason = 0x05;
+                result = L2CAP_CR_SEC_BLOCK;
+                goto response;
+        }
+
+        result = L2CAP_CR_NO_MEM;
+
+        /* Check for backlog size */
+        if (sk_acceptq_is_full(parent)) {
+                BT_DBG("backlog full %d", parent->sk_ack_backlog);
+                goto response;
+        }
+
+        sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
+        if (!sk)
+                goto response;
+
+        chan = l2cap_chan_create(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                goto response;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
+        write_lock_bh(&conn->chan_lock);
+
+        /* Check if we already have channel with that dcid */
+        if (__l2cap_get_chan_by_dcid(conn, scid)) {
+                write_unlock_bh(&conn->chan_lock);
+                sock_set_flag(sk, SOCK_ZAPPED);
+                l2cap_sock_kill(sk);
+                goto response;
+        }
+
+        hci_conn_hold(conn->hcon);
+
+        l2cap_sock_init(sk, parent);
+        bacpy(&bt_sk(sk)->src, conn->src);
+        bacpy(&bt_sk(sk)->dst, conn->dst);
+        chan->psm  = psm;
+        chan->dcid = scid;
+
+        bt_accept_enqueue(parent, sk);
+
+        __l2cap_chan_add(conn, chan);
+
+        dcid = chan->scid;
+
+        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+        chan->ident = cmd->ident;
+
+        if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
+                if (l2cap_check_security(chan)) {
+                        if (bt_sk(sk)->defer_setup) {
+                                sk->sk_state = BT_CONNECT2;
+                                result = L2CAP_CR_PEND;
+                                status = L2CAP_CS_AUTHOR_PEND;
+                                parent->sk_data_ready(parent, 0);
+                        } else {
+                                sk->sk_state = BT_CONFIG;
+                                result = L2CAP_CR_SUCCESS;
+                                status = L2CAP_CS_NO_INFO;
+                        }
+                } else {
+                        sk->sk_state = BT_CONNECT2;
+                        result = L2CAP_CR_PEND;
+                        status = L2CAP_CS_AUTHEN_PEND;
+                }
+        } else {
+                sk->sk_state = BT_CONNECT2;
+                result = L2CAP_CR_PEND;
+                status = L2CAP_CS_NO_INFO;
+        }
+
+        write_unlock_bh(&conn->chan_lock);
+
+response:
+        bh_unlock_sock(parent);
+
+sendresp:
+        rsp.scid   = cpu_to_le16(scid);
+        rsp.dcid   = cpu_to_le16(dcid);
+        rsp.result = cpu_to_le16(result);
+        rsp.status = cpu_to_le16(status);
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+
+        if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
+                struct l2cap_info_req info;
+                info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
+                conn->info_ident = l2cap_get_ident(conn);
+
+                mod_timer(&conn->info_timer, jiffies +
+                                        msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
+
+                l2cap_send_cmd(conn, conn->info_ident,
+                                        L2CAP_INFO_REQ, sizeof(info), &info);
+        }
+
+        if (chan && !(chan->conf_state & L2CAP_CONF_REQ_SENT) &&
+                                result == L2CAP_CR_SUCCESS) {
+                u8 buf[128];
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
+                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                        l2cap_build_conf_req(chan, buf), buf);
+                chan->num_conf_req++;
+        }
+
+        return 0;
+}
+
+static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
+        u16 scid, dcid, result, status;
+        struct l2cap_chan *chan;
+        struct sock *sk;
+        u8 req[128];
+
+        scid   = __le16_to_cpu(rsp->scid);
+        dcid   = __le16_to_cpu(rsp->dcid);
+        result = __le16_to_cpu(rsp->result);
+        status = __le16_to_cpu(rsp->status);
+
+        BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
+
+        if (scid) {
+                chan = l2cap_get_chan_by_scid(conn, scid);
+                if (!chan)
+                        return -EFAULT;
+        } else {
+                chan = l2cap_get_chan_by_ident(conn, cmd->ident);
+                if (!chan)
+                        return -EFAULT;
+        }
+
+        sk = chan->sk;
+
+        switch (result) {
+        case L2CAP_CR_SUCCESS:
+                sk->sk_state = BT_CONFIG;
+                chan->ident = 0;
+                chan->dcid = dcid;
+                chan->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
+
+                if (chan->conf_state & L2CAP_CONF_REQ_SENT)
+                        break;
+
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
+
+                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                        l2cap_build_conf_req(chan, req), req);
+                chan->num_conf_req++;
+                break;
+
+        case L2CAP_CR_PEND:
+                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+                break;
+
+        default:
+                /* don't delete l2cap channel if sk is owned by user */
+                if (sock_owned_by_user(sk)) {
+                        sk->sk_state = BT_DISCONN;
+                        l2cap_sock_clear_timer(sk);
+                        l2cap_sock_set_timer(sk, HZ / 5);
+                        break;
+                }
+
+                l2cap_chan_del(chan, ECONNREFUSED);
+                break;
+        }
+
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline void set_default_fcs(struct l2cap_chan *chan)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(chan->sk);
+
+        /* FCS is enabled only in ERTM or streaming mode, if one or both
+         * sides request it.
+         */
+        if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
+                chan->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->chan->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                chan->fcs = L2CAP_FCS_CRC16;
+}
+
+static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
+{
+        struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
+        u16 dcid, flags;
+        u8 rsp[64];
+        struct l2cap_chan *chan;
+        struct sock *sk;
+        int len;
+
+        dcid  = __le16_to_cpu(req->dcid);
+        flags = __le16_to_cpu(req->flags);
+
+        BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
+
+        chan = l2cap_get_chan_by_scid(conn, dcid);
+        if (!chan)
+                return -ENOENT;
+
+        sk = chan->sk;
+
+        if (sk->sk_state != BT_CONFIG && sk->sk_state != BT_CONNECT2) {
+                struct l2cap_cmd_rej rej;
+
+                rej.reason = cpu_to_le16(0x0002);
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
+                                sizeof(rej), &rej);
+                goto unlock;
+        }
+
+        /* Reject if config buffer is too small. */
+        len = cmd_len - sizeof(*req);
+        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+                                l2cap_build_conf_rsp(chan, rsp,
+                                        L2CAP_CONF_REJECT, flags), rsp);
+                goto unlock;
+        }
+
+        /* Store config. */
+        memcpy(chan->conf_req + chan->conf_len, req->data, len);
+        chan->conf_len += len;
+
+        if (flags & 0x0001) {
+                /* Incomplete config. Send empty response. */
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+                                l2cap_build_conf_rsp(chan, rsp,
+                                        L2CAP_CONF_SUCCESS, 0x0001), rsp);
+                goto unlock;
+        }
+
+        /* Complete config. */
+        len = l2cap_parse_conf_req(chan, rsp);
+        if (len < 0) {
+                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                goto unlock;
+        }
+
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
+        chan->num_conf_rsp++;
+
+        /* Reset config buffer. */
+        chan->conf_len = 0;
+
+        if (!(chan->conf_state & L2CAP_CONF_OUTPUT_DONE))
+                goto unlock;
+
+        if (chan->conf_state & L2CAP_CONF_INPUT_DONE) {
+                set_default_fcs(chan);
+
+                sk->sk_state = BT_CONNECTED;
+
+                chan->next_tx_seq = 0;
+                chan->expected_tx_seq = 0;
+                skb_queue_head_init(&chan->tx_q);
+                if (chan->mode == L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(chan);
+
+                l2cap_chan_ready(sk);
+                goto unlock;
+        }
+
+        if (!(chan->conf_state & L2CAP_CONF_REQ_SENT)) {
+                u8 buf[64];
+                chan->conf_state |= L2CAP_CONF_REQ_SENT;
+                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                        l2cap_build_conf_req(chan, buf), buf);
+                chan->num_conf_req++;
+        }
+
+unlock:
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
+        u16 scid, flags, result;
+        struct l2cap_chan *chan;
+        struct sock *sk;
+        int len = cmd->len - sizeof(*rsp);
+
+        scid   = __le16_to_cpu(rsp->scid);
+        flags  = __le16_to_cpu(rsp->flags);
+        result = __le16_to_cpu(rsp->result);
+
+        BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
+                        scid, flags, result);
+
+        chan = l2cap_get_chan_by_scid(conn, scid);
+        if (!chan)
+                return 0;
+
+        sk = chan->sk;
+
+        switch (result) {
+        case L2CAP_CONF_SUCCESS:
+                l2cap_conf_rfc_get(chan, rsp->data, len);
+                break;
+
+        case L2CAP_CONF_UNACCEPT:
+                if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
+                        char req[64];
+
+                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
+                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                                goto done;
+                        }
+
+                        /* throw out any old stored conf requests */
+                        result = L2CAP_CONF_SUCCESS;
+                        len = l2cap_parse_conf_rsp(chan, rsp->data, len,
+                                                                req, &result);
+                        if (len < 0) {
+                                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                                goto done;
+                        }
+
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                                L2CAP_CONF_REQ, len, req);
+                        chan->num_conf_req++;
+                        if (result != L2CAP_CONF_SUCCESS)
+                                goto done;
+                        break;
+                }
+
+        default:
+                sk->sk_err = ECONNRESET;
+                l2cap_sock_set_timer(sk, HZ * 5);
+                l2cap_send_disconn_req(conn, chan, ECONNRESET);
+                goto done;
+        }
+
+        if (flags & 0x01)
+                goto done;
+
+        chan->conf_state |= L2CAP_CONF_INPUT_DONE;
+
+        if (chan->conf_state & L2CAP_CONF_OUTPUT_DONE) {
+                set_default_fcs(chan);
+
+                sk->sk_state = BT_CONNECTED;
+                chan->next_tx_seq = 0;
+                chan->expected_tx_seq = 0;
+                skb_queue_head_init(&chan->tx_q);
+                if (chan->mode ==  L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(chan);
+
+                l2cap_chan_ready(sk);
+        }
+
+done:
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
+        struct l2cap_disconn_rsp rsp;
+        u16 dcid, scid;
+        struct l2cap_chan *chan;
+        struct sock *sk;
+
+        scid = __le16_to_cpu(req->scid);
+        dcid = __le16_to_cpu(req->dcid);
+
+        BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
+
+        chan = l2cap_get_chan_by_scid(conn, dcid);
+        if (!chan)
+                return 0;
+
+        sk = chan->sk;
+
+        rsp.dcid = cpu_to_le16(chan->scid);
+        rsp.scid = cpu_to_le16(chan->dcid);
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
+
+        sk->sk_shutdown = SHUTDOWN_MASK;
+
+        /* don't delete l2cap channel if sk is owned by user */
+        if (sock_owned_by_user(sk)) {
+                sk->sk_state = BT_DISCONN;
+                l2cap_sock_clear_timer(sk);
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                return 0;
+        }
+
+        l2cap_chan_del(chan, ECONNRESET);
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        return 0;
+}
+
+static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
+        u16 dcid, scid;
+        struct l2cap_chan *chan;
+        struct sock *sk;
+
+        scid = __le16_to_cpu(rsp->scid);
+        dcid = __le16_to_cpu(rsp->dcid);
+
+        BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
+
+        chan = l2cap_get_chan_by_scid(conn, scid);
+        if (!chan)
+                return 0;
+
+        sk = chan->sk;
+
+        /* don't delete l2cap channel if sk is owned by user */
+        if (sock_owned_by_user(sk)) {
+                sk->sk_state = BT_DISCONN;
+                l2cap_sock_clear_timer(sk);
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                return 0;
+        }
+
+        l2cap_chan_del(chan, 0);
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        return 0;
+}
+
+static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_info_req *req = (struct l2cap_info_req *) data;
+        u16 type;
+
+        type = __le16_to_cpu(req->type);
+
+        BT_DBG("type 0x%4.4x", type);
+
+        if (type == L2CAP_IT_FEAT_MASK) {
+                u8 buf[8];
+                u32 feat_mask = l2cap_feat_mask;
+                struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
+                rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
+                if (!disable_ertm)
+                        feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
+                                                         | L2CAP_FEAT_FCS;
+                put_unaligned_le32(feat_mask, rsp->data);
+                l2cap_send_cmd(conn, cmd->ident,
+                                        L2CAP_INFO_RSP, sizeof(buf), buf);
+        } else if (type == L2CAP_IT_FIXED_CHAN) {
+                u8 buf[12];
+                struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
+                rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+                rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
+                memcpy(buf + 4, l2cap_fixed_chan, 8);
+                l2cap_send_cmd(conn, cmd->ident,
+                                        L2CAP_INFO_RSP, sizeof(buf), buf);
+        } else {
+                struct l2cap_info_rsp rsp;
+                rsp.type   = cpu_to_le16(type);
+                rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
+                l2cap_send_cmd(conn, cmd->ident,
+                                        L2CAP_INFO_RSP, sizeof(rsp), &rsp);
+        }
+
+        return 0;
+}
+
+static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
+        u16 type, result;
+
+        type   = __le16_to_cpu(rsp->type);
+        result = __le16_to_cpu(rsp->result);
+
+        BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
+
+        /* L2CAP Info req/rsp are unbound to channels, add extra checks */
+        if (cmd->ident != conn->info_ident ||
+                        conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
+                return 0;
+
+        del_timer(&conn->info_timer);
+
+        if (result != L2CAP_IR_SUCCESS) {
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+                conn->info_ident = 0;
+
+                l2cap_conn_start(conn);
+
+                return 0;
+        }
+
+        if (type == L2CAP_IT_FEAT_MASK) {
+                conn->feat_mask = get_unaligned_le32(rsp->data);
+
+                if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
+                        struct l2cap_info_req req;
+                        req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
+
+                        conn->info_ident = l2cap_get_ident(conn);
+
+                        l2cap_send_cmd(conn, conn->info_ident,
+                                        L2CAP_INFO_REQ, sizeof(req), &req);
+                } else {
+                        conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+                        conn->info_ident = 0;
+
+                        l2cap_conn_start(conn);
+                }
+        } else if (type == L2CAP_IT_FIXED_CHAN) {
+                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
+                conn->info_ident = 0;
+
+                l2cap_conn_start(conn);
+        }
+
+        return 0;
+}
+
+static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
+                                                        u16 to_multiplier)
+{
+        u16 max_latency;
+
+        if (min > max || min < 6 || max > 3200)
+                return -EINVAL;
+
+        if (to_multiplier < 10 || to_multiplier > 3200)
+                return -EINVAL;
+
+        if (max >= to_multiplier * 8)
+                return -EINVAL;
+
+        max_latency = (to_multiplier * 8 / max) - 1;
+        if (latency > 499 || latency > max_latency)
+                return -EINVAL;
+
+        return 0;
+}
+
+static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct hci_conn *hcon = conn->hcon;
+        struct l2cap_conn_param_update_req *req;
+        struct l2cap_conn_param_update_rsp rsp;
+        u16 min, max, latency, to_multiplier, cmd_len;
+        int err;
+
+        if (!(hcon->link_mode & HCI_LM_MASTER))
+                return -EINVAL;
+
+        cmd_len = __le16_to_cpu(cmd->len);
+        if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
+                return -EPROTO;
+
+        req = (struct l2cap_conn_param_update_req *) data;
+        min             = __le16_to_cpu(req->min);
+        max             = __le16_to_cpu(req->max);
+        latency         = __le16_to_cpu(req->latency);
+        to_multiplier   = __le16_to_cpu(req->to_multiplier);
+
+        BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
+                                                min, max, latency, to_multiplier);
+
+        memset(&rsp, 0, sizeof(rsp));
+
+        err = l2cap_check_conn_param(min, max, latency, to_multiplier);
+        if (err)
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+        else
+                rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
+
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
+                                                        sizeof(rsp), &rsp);
+
+        if (!err)
+                hci_le_conn_update(hcon, min, max, latency, to_multiplier);
+
+        return 0;
+}
+
+static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
+                        struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
+{
+        int err = 0;
+
+        switch (cmd->code) {
+        case L2CAP_COMMAND_REJ:
+                l2cap_command_rej(conn, cmd, data);
+                break;
+
+        case L2CAP_CONN_REQ:
+                err = l2cap_connect_req(conn, cmd, data);
+                break;
+
+        case L2CAP_CONN_RSP:
+                err = l2cap_connect_rsp(conn, cmd, data);
+                break;
+
+        case L2CAP_CONF_REQ:
+                err = l2cap_config_req(conn, cmd, cmd_len, data);
+                break;
+
+        case L2CAP_CONF_RSP:
+                err = l2cap_config_rsp(conn, cmd, data);
+                break;
+
+        case L2CAP_DISCONN_REQ:
+                err = l2cap_disconnect_req(conn, cmd, data);
+                break;
+
+        case L2CAP_DISCONN_RSP:
+                err = l2cap_disconnect_rsp(conn, cmd, data);
+                break;
+
+        case L2CAP_ECHO_REQ:
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
+                break;
+
+        case L2CAP_ECHO_RSP:
+                break;
+
+        case L2CAP_INFO_REQ:
+                err = l2cap_information_req(conn, cmd, data);
+                break;
+
+        case L2CAP_INFO_RSP:
+                err = l2cap_information_rsp(conn, cmd, data);
+                break;
+
+        default:
+                BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
+                err = -EINVAL;
+                break;
+        }
+
+        return err;
+}
+
+static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
+                                        struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        switch (cmd->code) {
+        case L2CAP_COMMAND_REJ:
+                return 0;
+
+        case L2CAP_CONN_PARAM_UPDATE_REQ:
+                return l2cap_conn_param_update_req(conn, cmd, data);
+
+        case L2CAP_CONN_PARAM_UPDATE_RSP:
+                return 0;
+
+        default:
+                BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
+                return -EINVAL;
+        }
+}
+
+static inline void l2cap_sig_channel(struct l2cap_conn *conn,
+                                                        struct sk_buff *skb)
+{
+        u8 *data = skb->data;
+        int len = skb->len;
+        struct l2cap_cmd_hdr cmd;
+        int err;
+
+        l2cap_raw_recv(conn, skb);
+
+        while (len >= L2CAP_CMD_HDR_SIZE) {
+                u16 cmd_len;
+                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
+                data += L2CAP_CMD_HDR_SIZE;
+                len  -= L2CAP_CMD_HDR_SIZE;
+
+                cmd_len = le16_to_cpu(cmd.len);
+
+                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
+
+                if (cmd_len > len || !cmd.ident) {
+                        BT_DBG("corrupted command");
+                        break;
+                }
+
+                if (conn->hcon->type == LE_LINK)
+                        err = l2cap_le_sig_cmd(conn, &cmd, data);
+                else
+                        err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
+
+                if (err) {
+                        struct l2cap_cmd_rej rej;
+
+                        BT_ERR("Wrong link type (%d)", err);
+
+                        /* FIXME: Map err to a valid reason */
+                        rej.reason = cpu_to_le16(0);
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
+                }
+
+                data += cmd_len;
+                len  -= cmd_len;
+        }
+
+        kfree_skb(skb);
+}
+
+static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
+{
+        u16 our_fcs, rcv_fcs;
+        int hdr_size = L2CAP_HDR_SIZE + 2;
+
+        if (chan->fcs == L2CAP_FCS_CRC16) {
+                skb_trim(skb, skb->len - 2);
+                rcv_fcs = get_unaligned_le16(skb->data + skb->len);
+                our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
+
+                if (our_fcs != rcv_fcs)
+                        return -EBADMSG;
+        }
+        return 0;
+}
+
+static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
+{
+        u16 control = 0;
+
+        chan->frames_sent = 0;
+
+        control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+                control |= L2CAP_SUPER_RCV_NOT_READY;
+                l2cap_send_sframe(chan, control);
+                chan->conn_state |= L2CAP_CONN_RNR_SENT;
+        }
+
+        if (chan->conn_state & L2CAP_CONN_REMOTE_BUSY)
+                l2cap_retransmit_frames(chan);
+
+        l2cap_ertm_send(chan);
+
+        if (!(chan->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
+                        chan->frames_sent == 0) {
+                control |= L2CAP_SUPER_RCV_READY;
+                l2cap_send_sframe(chan, control);
+        }
+}
+
+static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u8 tx_seq, u8 sar)
+{
+        struct sk_buff *next_skb;
+        int tx_seq_offset, next_tx_seq_offset;
+
+        bt_cb(skb)->tx_seq = tx_seq;
+        bt_cb(skb)->sar = sar;
+
+        next_skb = skb_peek(&chan->srej_q);
+        if (!next_skb) {
+                __skb_queue_tail(&chan->srej_q, skb);
+                return 0;
+        }
+
+        tx_seq_offset = (tx_seq - chan->buffer_seq) % 64;
+        if (tx_seq_offset < 0)
+                tx_seq_offset += 64;
+
+        do {
+                if (bt_cb(next_skb)->tx_seq == tx_seq)
+                        return -EINVAL;
+
+                next_tx_seq_offset = (bt_cb(next_skb)->tx_seq -
+                                                chan->buffer_seq) % 64;
+                if (next_tx_seq_offset < 0)
+                        next_tx_seq_offset += 64;
+
+                if (next_tx_seq_offset > tx_seq_offset) {
+                        __skb_queue_before(&chan->srej_q, next_skb, skb);
+                        return 0;
+                }
+
+                if (skb_queue_is_last(&chan->srej_q, next_skb))
+                        break;
+
+        } while ((next_skb = skb_queue_next(&chan->srej_q, next_skb)));
+
+        __skb_queue_tail(&chan->srej_q, skb);
+
+        return 0;
+}
+
+static int l2cap_ertm_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+{
+        struct sk_buff *_skb;
+        int err;
+
+        switch (control & L2CAP_CTRL_SAR) {
+        case L2CAP_SDU_UNSEGMENTED:
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
+                        goto drop;
+
+                err = sock_queue_rcv_skb(chan->sk, skb);
+                if (!err)
+                        return err;
+
+                break;
+
+        case L2CAP_SDU_START:
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU)
+                        goto drop;
+
+                chan->sdu_len = get_unaligned_le16(skb->data);
+
+                if (chan->sdu_len > chan->imtu)
+                        goto disconnect;
+
+                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
+                if (!chan->sdu)
+                        return -ENOMEM;
+
+                /* pull sdu_len bytes only after alloc, because of Local Busy
+                 * condition we have to be sure that this will be executed
+                 * only once, i.e., when alloc does not fail */
+                skb_pull(skb, 2);
+
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+
+                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len = skb->len;
+                break;
+
+        case L2CAP_SDU_CONTINUE:
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                        goto disconnect;
+
+                if (!chan->sdu)
+                        goto disconnect;
+
+                chan->partial_sdu_len += skb->len;
+                if (chan->partial_sdu_len > chan->sdu_len)
+                        goto drop;
+
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+
+                break;
+
+        case L2CAP_SDU_END:
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                        goto disconnect;
+
+                if (!chan->sdu)
+                        goto disconnect;
+
+                if (!(chan->conn_state & L2CAP_CONN_SAR_RETRY)) {
+                        chan->partial_sdu_len += skb->len;
+
+                        if (chan->partial_sdu_len > chan->imtu)
+                                goto drop;
+
+                        if (chan->partial_sdu_len != chan->sdu_len)
+                                goto drop;
+
+                        memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+                }
+
+                _skb = skb_clone(chan->sdu, GFP_ATOMIC);
+                if (!_skb) {
+                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
+                        return -ENOMEM;
+                }
+
+                err = sock_queue_rcv_skb(chan->sk, _skb);
+                if (err < 0) {
+                        kfree_skb(_skb);
+                        chan->conn_state |= L2CAP_CONN_SAR_RETRY;
+                        return err;
+                }
+
+                chan->conn_state &= ~L2CAP_CONN_SAR_RETRY;
+                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
+
+                kfree_skb(chan->sdu);
+                break;
+        }
+
+        kfree_skb(skb);
+        return 0;
+
+drop:
+        kfree_skb(chan->sdu);
+        chan->sdu = NULL;
+
+disconnect:
+        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+        kfree_skb(skb);
+        return 0;
+}
+
+static int l2cap_try_push_rx_skb(struct l2cap_chan *chan)
+{
+        struct sk_buff *skb;
+        u16 control;
+        int err;
+
+        while ((skb = skb_dequeue(&chan->busy_q))) {
+                control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
+                err = l2cap_ertm_reassembly_sdu(chan, skb, control);
+                if (err < 0) {
+                        skb_queue_head(&chan->busy_q, skb);
+                        return -EBUSY;
+                }
+
+                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
+        }
+
+        if (!(chan->conn_state & L2CAP_CONN_RNR_SENT))
+                goto done;
+
+        control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
+        l2cap_send_sframe(chan, control);
+        chan->retry_count = 1;
+
+        del_timer(&chan->retrans_timer);
+        __mod_monitor_timer();
+
+        chan->conn_state |= L2CAP_CONN_WAIT_F;
+
+done:
+        chan->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
+        chan->conn_state &= ~L2CAP_CONN_RNR_SENT;
+
+        BT_DBG("chan %p, Exit local busy", chan);
+
+        return 0;
+}
+
+static void l2cap_busy_work(struct work_struct *work)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct l2cap_chan *chan =
+                container_of(work, struct l2cap_chan, busy_work);
+        struct sock *sk = chan->sk;
+        int n_tries = 0, timeo = HZ/5, err;
+        struct sk_buff *skb;
+
+        lock_sock(sk);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        while ((skb = skb_peek(&chan->busy_q))) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
+                        err = -EBUSY;
+                        l2cap_send_disconn_req(chan->conn, chan, EBUSY);
+                        break;
+                }
+
+                if (!timeo)
+                        timeo = HZ/5;
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                err = sock_error(sk);
+                if (err)
+                        break;
+
+                if (l2cap_try_push_rx_skb(chan) == 0)
+                        break;
+        }
+
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+
+        release_sock(sk);
+}
+
+static int l2cap_push_rx_skb(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+{
+        int sctrl, err;
+
+        if (chan->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+                bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
+                __skb_queue_tail(&chan->busy_q, skb);
+                return l2cap_try_push_rx_skb(chan);
+
+
+        }
+
+        err = l2cap_ertm_reassembly_sdu(chan, skb, control);
+        if (err >= 0) {
+                chan->buffer_seq = (chan->buffer_seq + 1) % 64;
+                return err;
+        }
+
+        /* Busy Condition */
+        BT_DBG("chan %p, Enter local busy", chan);
+
+        chan->conn_state |= L2CAP_CONN_LOCAL_BUSY;
+        bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
+        __skb_queue_tail(&chan->busy_q, skb);
+
+        sctrl = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+        sctrl |= L2CAP_SUPER_RCV_NOT_READY;
+        l2cap_send_sframe(chan, sctrl);
+
+        chan->conn_state |= L2CAP_CONN_RNR_SENT;
+
+        del_timer(&chan->ack_timer);
+
+        queue_work(_busy_wq, &chan->busy_work);
+
+        return err;
+}
+
+static int l2cap_streaming_reassembly_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control)
+{
+        struct sk_buff *_skb;
+        int err = -EINVAL;
+
+        /*
+         * TODO: We have to notify the userland if some data is lost with the
+         * Streaming Mode.
+         */
+
+        switch (control & L2CAP_CTRL_SAR) {
+        case L2CAP_SDU_UNSEGMENTED:
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(chan->sdu);
+                        break;
+                }
+
+                err = sock_queue_rcv_skb(chan->sk, skb);
+                if (!err)
+                        return 0;
+
+                break;
+
+        case L2CAP_SDU_START:
+                if (chan->conn_state & L2CAP_CONN_SAR_SDU) {
+                        kfree_skb(chan->sdu);
+                        break;
+                }
+
+                chan->sdu_len = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+
+                if (chan->sdu_len > chan->imtu) {
+                        err = -EMSGSIZE;
+                        break;
+                }
+
+                chan->sdu = bt_skb_alloc(chan->sdu_len, GFP_ATOMIC);
+                if (!chan->sdu) {
+                        err = -ENOMEM;
+                        break;
+                }
+
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+
+                chan->conn_state |= L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len = skb->len;
+                err = 0;
+                break;
+
+        case L2CAP_SDU_CONTINUE:
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                        break;
+
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+
+                chan->partial_sdu_len += skb->len;
+                if (chan->partial_sdu_len > chan->sdu_len)
+                        kfree_skb(chan->sdu);
+                else
+                        err = 0;
+
+                break;
+
+        case L2CAP_SDU_END:
+                if (!(chan->conn_state & L2CAP_CONN_SAR_SDU))
+                        break;
+
+                memcpy(skb_put(chan->sdu, skb->len), skb->data, skb->len);
+
+                chan->conn_state &= ~L2CAP_CONN_SAR_SDU;
+                chan->partial_sdu_len += skb->len;
+
+                if (chan->partial_sdu_len > chan->imtu)
+                        goto drop;
+
+                if (chan->partial_sdu_len == chan->sdu_len) {
+                        _skb = skb_clone(chan->sdu, GFP_ATOMIC);
+                        err = sock_queue_rcv_skb(chan->sk, _skb);
+                        if (err < 0)
+                                kfree_skb(_skb);
+                }
+                err = 0;
+
+drop:
+                kfree_skb(chan->sdu);
+                break;
+        }
+
+        kfree_skb(skb);
+        return err;
+}
+
+static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
+{
+        struct sk_buff *skb;
+        u16 control;
+
+        while ((skb = skb_peek(&chan->srej_q))) {
+                if (bt_cb(skb)->tx_seq != tx_seq)
+                        break;
+
+                skb = skb_dequeue(&chan->srej_q);
+                control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
+                l2cap_ertm_reassembly_sdu(chan, skb, control);
+                chan->buffer_seq_srej =
+                        (chan->buffer_seq_srej + 1) % 64;
+                tx_seq = (tx_seq + 1) % 64;
+        }
+}
+
+static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq)
+{
+        struct srej_list *l, *tmp;
+        u16 control;
+
+        list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
+                if (l->tx_seq == tx_seq) {
+                        list_del(&l->list);
+                        kfree(l);
+                        return;
+                }
+                control = L2CAP_SUPER_SELECT_REJECT;
+                control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                l2cap_send_sframe(chan, control);
+                list_del(&l->list);
+                list_add_tail(&l->list, &chan->srej_l);
+        }
+}
+
+static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
+{
+        struct srej_list *new;
+        u16 control;
+
+        while (tx_seq != chan->expected_tx_seq) {
+                control = L2CAP_SUPER_SELECT_REJECT;
+                control |= chan->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+                l2cap_send_sframe(chan, control);
+
+                new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
+                new->tx_seq = chan->expected_tx_seq;
+                chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
+                list_add_tail(&new->list, &chan->srej_l);
+        }
+        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
+}
+
+static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb)
+{
+        u8 tx_seq = __get_txseq(rx_control);
+        u8 req_seq = __get_reqseq(rx_control);
+        u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
+        int tx_seq_offset, expected_tx_seq_offset;
+        int num_to_ack = (chan->tx_win/6) + 1;
+        int err = 0;
+
+        BT_DBG("chan %p len %d tx_seq %d rx_control 0x%4.4x", chan, skb->len,
+                                                        tx_seq, rx_control);
+
+        if (L2CAP_CTRL_FINAL & rx_control &&
+                        chan->conn_state & L2CAP_CONN_WAIT_F) {
+                del_timer(&chan->monitor_timer);
+                if (chan->unacked_frames > 0)
+                        __mod_retrans_timer();
+                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
+        }
+
+        chan->expected_ack_seq = req_seq;
+        l2cap_drop_acked_frames(chan);
+
+        if (tx_seq == chan->expected_tx_seq)
+                goto expected;
+
+        tx_seq_offset = (tx_seq - chan->buffer_seq) % 64;
+        if (tx_seq_offset < 0)
+                tx_seq_offset += 64;
+
+        /* invalid tx_seq */
+        if (tx_seq_offset >= chan->tx_win) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                goto drop;
+        }
+
+        if (chan->conn_state == L2CAP_CONN_LOCAL_BUSY)
+                goto drop;
+
+        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+                struct srej_list *first;
+
+                first = list_first_entry(&chan->srej_l,
+                                struct srej_list, list);
+                if (tx_seq == first->tx_seq) {
+                        l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
+                        l2cap_check_srej_gap(chan, tx_seq);
+
+                        list_del(&first->list);
+                        kfree(first);
+
+                        if (list_empty(&chan->srej_l)) {
+                                chan->buffer_seq = chan->buffer_seq_srej;
+                                chan->conn_state &= ~L2CAP_CONN_SREJ_SENT;
+                                l2cap_send_ack(chan);
+                                BT_DBG("chan %p, Exit SREJ_SENT", chan);
+                        }
+                } else {
+                        struct srej_list *l;
+
+                        /* duplicated tx_seq */
+                        if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
+                                goto drop;
+
+                        list_for_each_entry(l, &chan->srej_l, list) {
+                                if (l->tx_seq == tx_seq) {
+                                        l2cap_resend_srejframe(chan, tx_seq);
+                                        return 0;
+                                }
+                        }
+                        l2cap_send_srejframe(chan, tx_seq);
+                }
+        } else {
+                expected_tx_seq_offset =
+                        (chan->expected_tx_seq - chan->buffer_seq) % 64;
+                if (expected_tx_seq_offset < 0)
+                        expected_tx_seq_offset += 64;
+
+                /* duplicated tx_seq */
+                if (tx_seq_offset < expected_tx_seq_offset)
+                        goto drop;
+
+                chan->conn_state |= L2CAP_CONN_SREJ_SENT;
+
+                BT_DBG("chan %p, Enter SREJ", chan);
+
+                INIT_LIST_HEAD(&chan->srej_l);
+                chan->buffer_seq_srej = chan->buffer_seq;
+
+                __skb_queue_head_init(&chan->srej_q);
+                __skb_queue_head_init(&chan->busy_q);
+                l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
+
+                chan->conn_state |= L2CAP_CONN_SEND_PBIT;
+
+                l2cap_send_srejframe(chan, tx_seq);
+
+                del_timer(&chan->ack_timer);
+        }
+        return 0;
+
+expected:
+        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
+
+        if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+                bt_cb(skb)->tx_seq = tx_seq;
+                bt_cb(skb)->sar = sar;
+                __skb_queue_tail(&chan->srej_q, skb);
+                return 0;
+        }
+
+        err = l2cap_push_rx_skb(chan, skb, rx_control);
+        if (err < 0)
+                return 0;
+
+        if (rx_control & L2CAP_CTRL_FINAL) {
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                else
+                        l2cap_retransmit_frames(chan);
+        }
+
+        __mod_ack_timer();
+
+        chan->num_acked = (chan->num_acked + 1) % num_to_ack;
+        if (chan->num_acked == num_to_ack - 1)
+                l2cap_send_ack(chan);
+
+        return 0;
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u16 rx_control)
+{
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, __get_reqseq(rx_control),
+                                                rx_control);
+
+        chan->expected_ack_seq = __get_reqseq(rx_control);
+        l2cap_drop_acked_frames(chan);
+
+        if (rx_control & L2CAP_CTRL_POLL) {
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
+                        if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (chan->unacked_frames > 0))
+                                __mod_retrans_timer();
+
+                        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                        l2cap_send_srejtail(chan);
+                } else {
+                        l2cap_send_i_or_rr_or_rnr(chan);
+                }
+
+        } else if (rx_control & L2CAP_CTRL_FINAL) {
+                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                else
+                        l2cap_retransmit_frames(chan);
+
+        } else {
+                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                (chan->unacked_frames > 0))
+                        __mod_retrans_timer();
+
+                chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+                if (chan->conn_state & L2CAP_CONN_SREJ_SENT)
+                        l2cap_send_ack(chan);
+                else
+                        l2cap_ertm_send(chan);
+        }
+}
+
+static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u16 rx_control)
+{
+        u8 tx_seq = __get_reqseq(rx_control);
+
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
+
+        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+        chan->expected_ack_seq = tx_seq;
+        l2cap_drop_acked_frames(chan);
+
+        if (rx_control & L2CAP_CTRL_FINAL) {
+                if (chan->conn_state & L2CAP_CONN_REJ_ACT)
+                        chan->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                else
+                        l2cap_retransmit_frames(chan);
+        } else {
+                l2cap_retransmit_frames(chan);
+
+                if (chan->conn_state & L2CAP_CONN_WAIT_F)
+                        chan->conn_state |= L2CAP_CONN_REJ_ACT;
+        }
+}
+static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_control)
+{
+        u8 tx_seq = __get_reqseq(rx_control);
+
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
+
+        chan->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+
+        if (rx_control & L2CAP_CTRL_POLL) {
+                chan->expected_ack_seq = tx_seq;
+                l2cap_drop_acked_frames(chan);
+
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+                l2cap_retransmit_one_frame(chan, tx_seq);
+
+                l2cap_ertm_send(chan);
+
+                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                        chan->srej_save_reqseq = tx_seq;
+                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
+                }
+        } else if (rx_control & L2CAP_CTRL_FINAL) {
+                if ((chan->conn_state & L2CAP_CONN_SREJ_ACT) &&
+                                chan->srej_save_reqseq == tx_seq)
+                        chan->conn_state &= ~L2CAP_CONN_SREJ_ACT;
+                else
+                        l2cap_retransmit_one_frame(chan, tx_seq);
+        } else {
+                l2cap_retransmit_one_frame(chan, tx_seq);
+                if (chan->conn_state & L2CAP_CONN_WAIT_F) {
+                        chan->srej_save_reqseq = tx_seq;
+                        chan->conn_state |= L2CAP_CONN_SREJ_ACT;
+                }
+        }
+}
+
+static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u16 rx_control)
+{
+        u8 tx_seq = __get_reqseq(rx_control);
+
+        BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control);
+
+        chan->conn_state |= L2CAP_CONN_REMOTE_BUSY;
+        chan->expected_ack_seq = tx_seq;
+        l2cap_drop_acked_frames(chan);
+
+        if (rx_control & L2CAP_CTRL_POLL)
+                chan->conn_state |= L2CAP_CONN_SEND_FBIT;
+
+        if (!(chan->conn_state & L2CAP_CONN_SREJ_SENT)) {
+                del_timer(&chan->retrans_timer);
+                if (rx_control & L2CAP_CTRL_POLL)
+                        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
+                return;
+        }
+
+        if (rx_control & L2CAP_CTRL_POLL)
+                l2cap_send_srejtail(chan);
+        else
+                l2cap_send_sframe(chan, L2CAP_SUPER_RCV_READY);
+}
+
+static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb)
+{
+        BT_DBG("chan %p rx_control 0x%4.4x len %d", chan, rx_control, skb->len);
+
+        if (L2CAP_CTRL_FINAL & rx_control &&
+                        chan->conn_state & L2CAP_CONN_WAIT_F) {
+                del_timer(&chan->monitor_timer);
+                if (chan->unacked_frames > 0)
+                        __mod_retrans_timer();
+                chan->conn_state &= ~L2CAP_CONN_WAIT_F;
+        }
+
+        switch (rx_control & L2CAP_CTRL_SUPERVISE) {
+        case L2CAP_SUPER_RCV_READY:
+                l2cap_data_channel_rrframe(chan, rx_control);
+                break;
+
+        case L2CAP_SUPER_REJECT:
+                l2cap_data_channel_rejframe(chan, rx_control);
+                break;
+
+        case L2CAP_SUPER_SELECT_REJECT:
+                l2cap_data_channel_srejframe(chan, rx_control);
+                break;
+
+        case L2CAP_SUPER_RCV_NOT_READY:
+                l2cap_data_channel_rnrframe(chan, rx_control);
+                break;
+        }
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
+{
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        u16 control;
+        u8 req_seq;
+        int len, next_tx_seq_offset, req_seq_offset;
+
+        control = get_unaligned_le16(skb->data);
+        skb_pull(skb, 2);
+        len = skb->len;
+
+        /*
+         * We can just drop the corrupted I-frame here.
+         * Receiver will miss it and start proper recovery
+         * procedures and ask retransmission.
+         */
+        if (l2cap_check_fcs(chan, skb))
+                goto drop;
+
+        if (__is_sar_start(control) && __is_iframe(control))
+                len -= 2;
+
+        if (chan->fcs == L2CAP_FCS_CRC16)
+                len -= 2;
+
+        if (len > chan->mps) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                goto drop;
+        }
+
+        req_seq = __get_reqseq(control);
+        req_seq_offset = (req_seq - chan->expected_ack_seq) % 64;
+        if (req_seq_offset < 0)
+                req_seq_offset += 64;
+
+        next_tx_seq_offset =
+                (chan->next_tx_seq - chan->expected_ack_seq) % 64;
+        if (next_tx_seq_offset < 0)
+                next_tx_seq_offset += 64;
+
+        /* check for invalid req-seq */
+        if (req_seq_offset > next_tx_seq_offset) {
+                l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                goto drop;
+        }
+
+        if (__is_iframe(control)) {
+                if (len < 0) {
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        goto drop;
+                }
+
+                l2cap_data_channel_iframe(chan, control, skb);
+        } else {
+                if (len != 0) {
+                        BT_ERR("%d", len);
+                        l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
+                        goto drop;
+                }
+
+                l2cap_data_channel_sframe(chan, control, skb);
+        }
+
+        return 0;
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
+{
+        struct l2cap_chan *chan;
+        struct sock *sk = NULL;
+        struct l2cap_pinfo *pi;
+        u16 control;
+        u8 tx_seq;
+        int len;
+
+        chan = l2cap_get_chan_by_scid(conn, cid);
+        if (!chan) {
+                BT_DBG("unknown cid 0x%4.4x", cid);
+                goto drop;
+        }
+
+        sk = chan->sk;
+        pi = l2cap_pi(sk);
+
+        BT_DBG("chan %p, len %d", chan, skb->len);
+
+        if (sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                /* If socket recv buffers overflows we drop data here
+                 * which is *bad* because L2CAP has to be reliable.
+                 * But we don't have any other choice. L2CAP doesn't
+                 * provide flow control mechanism. */
+
+                if (chan->imtu < skb->len)
+                        goto drop;
+
+                if (!sock_queue_rcv_skb(sk, skb))
+                        goto done;
+                break;
+
+        case L2CAP_MODE_ERTM:
+                if (!sock_owned_by_user(sk)) {
+                        l2cap_ertm_data_rcv(sk, skb);
+                } else {
+                        if (sk_add_backlog(sk, skb))
+                                goto drop;
+                }
+
+                goto done;
+
+        case L2CAP_MODE_STREAMING:
+                control = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+                len = skb->len;
+
+                if (l2cap_check_fcs(chan, skb))
+                        goto drop;
+
+                if (__is_sar_start(control))
+                        len -= 2;
+
+                if (chan->fcs == L2CAP_FCS_CRC16)
+                        len -= 2;
+
+                if (len > chan->mps || len < 0 || __is_sframe(control))
+                        goto drop;
+
+                tx_seq = __get_txseq(control);
+
+                if (chan->expected_tx_seq == tx_seq)
+                        chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
+                else
+                        chan->expected_tx_seq = (tx_seq + 1) % 64;
+
+                l2cap_streaming_reassembly_sdu(chan, skb, control);
+
+                goto done;
+
+        default:
+                BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
+                break;
+        }
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk)
+                bh_unlock_sock(sk);
+
+        return 0;
+}
+
+static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
+{
+        struct sock *sk = NULL;
+        struct l2cap_chan *chan;
+
+        chan = l2cap_global_chan_by_psm(0, psm, conn->src);
+        if (!chan)
+                goto drop;
+
+        sk = chan->sk;
+
+        bh_lock_sock(sk);
+
+        BT_DBG("sk %p, len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (l2cap_pi(sk)->chan->imtu < skb->len)
+                goto drop;
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                goto done;
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk)
+                bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
+{
+        struct sock *sk = NULL;
+        struct l2cap_chan *chan;
+
+        chan = l2cap_global_chan_by_scid(0, cid, conn->src);
+        if (!chan)
+                goto drop;
+
+        sk = chan->sk;
+
+        bh_lock_sock(sk);
+
+        BT_DBG("sk %p, len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (l2cap_pi(sk)->chan->imtu < skb->len)
+                goto drop;
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                goto done;
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk)
+                bh_unlock_sock(sk);
+        return 0;
+}
+
+static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct l2cap_hdr *lh = (void *) skb->data;
+        u16 cid, len;
+        __le16 psm;
+
+        skb_pull(skb, L2CAP_HDR_SIZE);
+        cid = __le16_to_cpu(lh->cid);
+        len = __le16_to_cpu(lh->len);
+
+        if (len != skb->len) {
+                kfree_skb(skb);
+                return;
+        }
+
+        BT_DBG("len %d, cid 0x%4.4x", len, cid);
+
+        switch (cid) {
+        case L2CAP_CID_LE_SIGNALING:
+        case L2CAP_CID_SIGNALING:
+                l2cap_sig_channel(conn, skb);
+                break;
+
+        case L2CAP_CID_CONN_LESS:
+                psm = get_unaligned_le16(skb->data);
+                skb_pull(skb, 2);
+                l2cap_conless_channel(conn, psm, skb);
+                break;
+
+        case L2CAP_CID_LE_DATA:
+                l2cap_att_channel(conn, cid, skb);
+                break;
+
+        default:
+                l2cap_data_channel(conn, cid, skb);
+                break;
+        }
+}
+
+/* ---- L2CAP interface with lower layer (HCI) ---- */
+
+static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+{
+        int exact = 0, lm1 = 0, lm2 = 0;
+        struct l2cap_chan *c;
+
+        if (type != ACL_LINK)
+                return -EINVAL;
+
+        BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
+
+        /* Find listening sockets and check their link_mode */
+        read_lock(&chan_list_lock);
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
+
+                if (sk->sk_state != BT_LISTEN)
+                        continue;
+
+                if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
+                        lm1 |= HCI_LM_ACCEPT;
+                        if (c->role_switch)
+                                lm1 |= HCI_LM_MASTER;
+                        exact++;
+                } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
+                        lm2 |= HCI_LM_ACCEPT;
+                        if (c->role_switch)
+                                lm2 |= HCI_LM_MASTER;
+                }
+        }
+        read_unlock(&chan_list_lock);
+
+        return exact ? lm1 : lm2;
+}
+
+static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
+{
+        struct l2cap_conn *conn;
+
+        BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
+
+        if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
+                return -EINVAL;
+
+        if (!status) {
+                conn = l2cap_conn_add(hcon, status);
+                if (conn)
+                        l2cap_conn_ready(conn);
+        } else
+                l2cap_conn_del(hcon, bt_err(status));
+
+        return 0;
+}
+
+static int l2cap_disconn_ind(struct hci_conn *hcon)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+
+        BT_DBG("hcon %p", hcon);
+
+        if (hcon->type != ACL_LINK || !conn)
+                return 0x13;
+
+        return conn->disc_reason;
+}
+
+static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
+{
+        BT_DBG("hcon %p reason %d", hcon, reason);
+
+        if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
+                return -EINVAL;
+
+        l2cap_conn_del(hcon, bt_err(reason));
+
+        return 0;
+}
+
+static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
+{
+        struct sock *sk = chan->sk;
+
+        if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
+                return;
+
+        if (encrypt == 0x00) {
+                if (chan->sec_level == BT_SECURITY_MEDIUM) {
+                        l2cap_sock_clear_timer(sk);
+                        l2cap_sock_set_timer(sk, HZ * 5);
+                } else if (chan->sec_level == BT_SECURITY_HIGH)
+                        __l2cap_sock_close(sk, ECONNREFUSED);
+        } else {
+                if (chan->sec_level == BT_SECURITY_MEDIUM)
+                        l2cap_sock_clear_timer(sk);
+        }
+}
+
+static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+        struct l2cap_chan *chan;
+
+        if (!conn)
+                return 0;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&conn->chan_lock);
+
+        list_for_each_entry(chan, &conn->chan_l, list) {
+                struct sock *sk = chan->sk;
+
+                bh_lock_sock(sk);
+
+                if (chan->conf_state & L2CAP_CONF_CONNECT_PEND) {
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (!status && (sk->sk_state == BT_CONNECTED ||
+                                                sk->sk_state == BT_CONFIG)) {
+                        l2cap_check_encryption(chan, encrypt);
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (sk->sk_state == BT_CONNECT) {
+                        if (!status) {
+                                struct l2cap_conn_req req;
+                                req.scid = cpu_to_le16(chan->scid);
+                                req.psm  = chan->psm;
+
+                                chan->ident = l2cap_get_ident(conn);
+                                chan->conf_state |= L2CAP_CONF_CONNECT_PEND;
+
+                                l2cap_send_cmd(conn, chan->ident,
+                                        L2CAP_CONN_REQ, sizeof(req), &req);
+                        } else {
+                                l2cap_sock_clear_timer(sk);
+                                l2cap_sock_set_timer(sk, HZ / 10);
+                        }
+                } else if (sk->sk_state == BT_CONNECT2) {
+                        struct l2cap_conn_rsp rsp;
+                        __u16 res, stat;
+
+                        if (!status) {
+                                if (bt_sk(sk)->defer_setup) {
+                                        struct sock *parent = bt_sk(sk)->parent;
+                                        res = L2CAP_CR_PEND;
+                                        stat = L2CAP_CS_AUTHOR_PEND;
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
+                                } else {
+                                        sk->sk_state = BT_CONFIG;
+                                        res = L2CAP_CR_SUCCESS;
+                                        stat = L2CAP_CS_NO_INFO;
+                                }
+                        } else {
+                                sk->sk_state = BT_DISCONN;
+                                l2cap_sock_set_timer(sk, HZ / 10);
+                                res = L2CAP_CR_SEC_BLOCK;
+                                stat = L2CAP_CS_NO_INFO;
+                        }
+
+                        rsp.scid   = cpu_to_le16(chan->dcid);
+                        rsp.dcid   = cpu_to_le16(chan->scid);
+                        rsp.result = cpu_to_le16(res);
+                        rsp.status = cpu_to_le16(stat);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
+                }
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&conn->chan_lock);
+
+        return 0;
+}
+
+static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+
+        if (!conn)
+                conn = l2cap_conn_add(hcon, 0);
+
+        if (!conn)
+                goto drop;
+
+        BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
+
+        if (!(flags & ACL_CONT)) {
+                struct l2cap_hdr *hdr;
+                struct l2cap_chan *chan;
+                u16 cid;
+                int len;
+
+                if (conn->rx_len) {
+                        BT_ERR("Unexpected start frame (len %d)", skb->len);
+                        kfree_skb(conn->rx_skb);
+                        conn->rx_skb = NULL;
+                        conn->rx_len = 0;
+                        l2cap_conn_unreliable(conn, ECOMM);
+                }
+
+                /* Start fragment always begin with Basic L2CAP header */
+                if (skb->len < L2CAP_HDR_SIZE) {
+                        BT_ERR("Frame is too short (len %d)", skb->len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                hdr = (struct l2cap_hdr *) skb->data;
+                len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
+                cid = __le16_to_cpu(hdr->cid);
+
+                if (len == skb->len) {
+                        /* Complete frame received */
+                        l2cap_recv_frame(conn, skb);
+                        return 0;
+                }
+
+                BT_DBG("Start: total len %d, frag len %d", len, skb->len);
+
+                if (skb->len > len) {
+                        BT_ERR("Frame is too long (len %d, expected len %d)",
+                                skb->len, len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                chan = l2cap_get_chan_by_scid(conn, cid);
+
+                if (chan && chan->sk) {
+                        struct sock *sk = chan->sk;
+
+                        if (chan->imtu < len - L2CAP_HDR_SIZE) {
+                                BT_ERR("Frame exceeding recv MTU (len %d, "
+                                                        "MTU %d)", len,
+                                                        chan->imtu);
+                                bh_unlock_sock(sk);
+                                l2cap_conn_unreliable(conn, ECOMM);
+                                goto drop;
+                        }
+                        bh_unlock_sock(sk);
+                }
+
+                /* Allocate skb for the complete frame (with header) */
+                conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
+                if (!conn->rx_skb)
+                        goto drop;
+
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                                                                skb->len);
+                conn->rx_len = len - skb->len;
+        } else {
+                BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
+
+                if (!conn->rx_len) {
+                        BT_ERR("Unexpected continuation frame (len %d)", skb->len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                if (skb->len > conn->rx_len) {
+                        BT_ERR("Fragment is too long (len %d, expected %d)",
+                                        skb->len, conn->rx_len);
+                        kfree_skb(conn->rx_skb);
+                        conn->rx_skb = NULL;
+                        conn->rx_len = 0;
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
+                                                                skb->len);
+                conn->rx_len -= skb->len;
+
+                if (!conn->rx_len) {
+                        /* Complete frame received */
+                        l2cap_recv_frame(conn, conn->rx_skb);
+                        conn->rx_skb = NULL;
+                }
+        }
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static int l2cap_debugfs_show(struct seq_file *f, void *p)
+{
+        struct l2cap_chan *c;
+
+        read_lock_bh(&chan_list_lock);
+
+        list_for_each_entry(c, &chan_list, global_l) {
+                struct sock *sk = c->sk;
+
+                seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
+                                        batostr(&bt_sk(sk)->src),
+                                        batostr(&bt_sk(sk)->dst),
+                                        sk->sk_state, __le16_to_cpu(c->psm),
+                                        c->scid, c->dcid, c->imtu, c->omtu,
+                                        c->sec_level, c->mode);
+        }
+
+        read_unlock_bh(&chan_list_lock);
+
+        return 0;
+}
+
+static int l2cap_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, l2cap_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations l2cap_debugfs_fops = {
+        .open           = l2cap_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *l2cap_debugfs;
+
+static struct hci_proto l2cap_hci_proto = {
+        .name           = "L2CAP",
+        .id             = HCI_PROTO_L2CAP,
+        .connect_ind    = l2cap_connect_ind,
+        .connect_cfm    = l2cap_connect_cfm,
+        .disconn_ind    = l2cap_disconn_ind,
+        .disconn_cfm    = l2cap_disconn_cfm,
+        .security_cfm   = l2cap_security_cfm,
+        .recv_acldata   = l2cap_recv_acldata
+};
+
+int __init l2cap_init(void)
+{
+        int err;
+
+        err = l2cap_init_sockets();
+        if (err < 0)
+                return err;
+
+        _busy_wq = create_singlethread_workqueue("l2cap");
+        if (!_busy_wq) {
+                err = -ENOMEM;
+                goto error;
+        }
+
+        err = hci_register_proto(&l2cap_hci_proto);
+        if (err < 0) {
+                BT_ERR("L2CAP protocol registration failed");
+                bt_sock_unregister(BTPROTO_L2CAP);
+                goto error;
+        }
+
+        if (bt_debugfs) {
+                l2cap_debugfs = debugfs_create_file("l2cap", 0444,
+                                        bt_debugfs, NULL, &l2cap_debugfs_fops);
+                if (!l2cap_debugfs)
+                        BT_ERR("Failed to create L2CAP debug file");
+        }
+
+        return 0;
+
+error:
+        destroy_workqueue(_busy_wq);
+        l2cap_cleanup_sockets();
+        return err;
+}
+
+void l2cap_exit(void)
+{
+        debugfs_remove(l2cap_debugfs);
+
+        flush_workqueue(_busy_wq);
+        destroy_workqueue(_busy_wq);
+
+        if (hci_unregister_proto(&l2cap_hci_proto) < 0)
+                BT_ERR("L2CAP protocol unregistration failed");
+
+        l2cap_cleanup_sockets();
+}
+
+module_param(disable_ertm, bool, 0644);
+MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
new file mode 100644
index 000000000000..8248303f44e8
--- /dev/null
+++ b/net/bluetooth/l2cap_sock.c
@@ -0,0 +1,1120 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
+   Copyright (C) 2010 Google Inc.
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth L2CAP sockets. */
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+
+static const struct proto_ops l2cap_sock_ops;
+
+/* ---- L2CAP timers ---- */
+static void l2cap_sock_timeout(unsigned long arg)
+{
+        struct sock *sk = (struct sock *) arg;
+        int reason;
+
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+
+        bh_lock_sock(sk);
+
+        if (sock_owned_by_user(sk)) {
+                /* sk is owned by user. Try again later */
+                l2cap_sock_set_timer(sk, HZ / 5);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                return;
+        }
+
+        if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
+                reason = ECONNREFUSED;
+        else if (sk->sk_state == BT_CONNECT &&
+                        l2cap_pi(sk)->chan->sec_level != BT_SECURITY_SDP)
+                reason = ECONNREFUSED;
+        else
+                reason = ETIMEDOUT;
+
+        __l2cap_sock_close(sk, reason);
+
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        sock_put(sk);
+}
+
+void l2cap_sock_set_timer(struct sock *sk, long timeout)
+{
+        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
+}
+
+void l2cap_sock_clear_timer(struct sock *sk)
+{
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+        sk_stop_timer(sk, &sk->sk_timer);
+}
+
+static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct sockaddr_l2 la;
+        int len, err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (!addr || addr->sa_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        memset(&la, 0, sizeof(la));
+        len = min_t(unsigned int, sizeof(la), alen);
+        memcpy(&la, addr, len);
+
+        if (la.l2_cid && la.l2_psm)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_OPEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        if (la.l2_psm) {
+                __u16 psm = __le16_to_cpu(la.l2_psm);
+
+                /* PSM must be odd and lsb of upper byte must be 0 */
+                if ((psm & 0x0101) != 0x0001) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                /* Restrict usage of well-known PSMs */
+                if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
+                        err = -EACCES;
+                        goto done;
+                }
+        }
+
+        if (la.l2_cid)
+                err = l2cap_add_scid(chan, la.l2_cid);
+        else
+                err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
+
+        if (err < 0)
+                goto done;
+
+        if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
+                                __le16_to_cpu(la.l2_psm) == 0x0003)
+                chan->sec_level = BT_SECURITY_SDP;
+
+        bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
+        sk->sk_state = BT_BOUND;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct sockaddr_l2 la;
+        int len, err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (!addr || alen < sizeof(addr->sa_family) ||
+            addr->sa_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        memset(&la, 0, sizeof(la));
+        len = min_t(unsigned int, sizeof(la), alen);
+        memcpy(&la, addr, len);
+
+        if (la.l2_cid && la.l2_psm)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
+                        && !(la.l2_psm || la.l2_cid)) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                if (!disable_ertm)
+                        break;
+                /* fall through */
+        default:
+                err = -ENOTSUPP;
+                goto done;
+        }
+
+        switch (sk->sk_state) {
+        case BT_CONNECT:
+        case BT_CONNECT2:
+        case BT_CONFIG:
+                /* Already connecting */
+                goto wait;
+
+        case BT_CONNECTED:
+                /* Already connected */
+                err = -EISCONN;
+                goto done;
+
+        case BT_OPEN:
+        case BT_BOUND:
+                /* Can connect */
+                break;
+
+        default:
+                err = -EBADFD;
+                goto done;
+        }
+
+        /* PSM must be odd and lsb of upper byte must be 0 */
+        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
+                                sk->sk_type != SOCK_RAW && !la.l2_cid) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        /* Set destination address and psm */
+        bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
+        chan->psm = la.l2_psm;
+        chan->dcid = la.l2_cid;
+
+        err = l2cap_chan_connect(l2cap_pi(sk)->chan);
+        if (err)
+                goto done;
+
+wait:
+        err = bt_sock_wait_state(sk, BT_CONNECTED,
+                        sock_sndtimeo(sk, flags & O_NONBLOCK));
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_listen(struct socket *sock, int backlog)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        int err = 0;
+
+        BT_DBG("sk %p backlog %d", sk, backlog);
+
+        lock_sock(sk);
+
+        if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
+                        || sk->sk_state != BT_BOUND) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                break;
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                if (!disable_ertm)
+                        break;
+                /* fall through */
+        default:
+                err = -ENOTSUPP;
+                goto done;
+        }
+
+        sk->sk_max_ack_backlog = backlog;
+        sk->sk_ack_backlog = 0;
+        sk->sk_state = BT_LISTEN;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct sock *sk = sock->sk, *nsk;
+        long timeo;
+        int err = 0;
+
+        lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+
+        if (sk->sk_state != BT_LISTEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+
+        BT_DBG("sk %p timeo %ld", sk, timeo);
+
+        /* Wait for an incoming connection. (wake-one). */
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
+        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+
+        if (err)
+                goto done;
+
+        newsock->state = SS_CONNECTED;
+
+        BT_DBG("new socket %p", nsk);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
+{
+        struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        addr->sa_family = AF_BLUETOOTH;
+        *len = sizeof(struct sockaddr_l2);
+
+        if (peer) {
+                la->l2_psm = chan->psm;
+                bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
+                la->l2_cid = cpu_to_le16(chan->dcid);
+        } else {
+                la->l2_psm = chan->sport;
+                bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
+                la->l2_cid = cpu_to_le16(chan->scid);
+        }
+
+        return 0;
+}
+
+static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct l2cap_options opts;
+        struct l2cap_conninfo cinfo;
+        int len, err = 0;
+        u32 opt;
+
+        BT_DBG("sk %p", sk);
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case L2CAP_OPTIONS:
+                memset(&opts, 0, sizeof(opts));
+                opts.imtu     = chan->imtu;
+                opts.omtu     = chan->omtu;
+                opts.flush_to = chan->flush_to;
+                opts.mode     = chan->mode;
+                opts.fcs      = chan->fcs;
+                opts.max_tx   = chan->max_tx;
+                opts.txwin_size = (__u16)chan->tx_win;
+
+                len = min_t(unsigned int, len, sizeof(opts));
+                if (copy_to_user(optval, (char *) &opts, len))
+                        err = -EFAULT;
+
+                break;
+
+        case L2CAP_LM:
+                switch (chan->sec_level) {
+                case BT_SECURITY_LOW:
+                        opt = L2CAP_LM_AUTH;
+                        break;
+                case BT_SECURITY_MEDIUM:
+                        opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
+                        break;
+                case BT_SECURITY_HIGH:
+                        opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
+                                                        L2CAP_LM_SECURE;
+                        break;
+                default:
+                        opt = 0;
+                        break;
+                }
+
+                if (chan->role_switch)
+                        opt |= L2CAP_LM_MASTER;
+
+                if (chan->force_reliable)
+                        opt |= L2CAP_LM_RELIABLE;
+
+                if (put_user(opt, (u32 __user *) optval))
+                        err = -EFAULT;
+                break;
+
+        case L2CAP_CONNINFO:
+                if (sk->sk_state != BT_CONNECTED &&
+                                        !(sk->sk_state == BT_CONNECT2 &&
+                                                bt_sk(sk)->defer_setup)) {
+                        err = -ENOTCONN;
+                        break;
+                }
+
+                memset(&cinfo, 0, sizeof(cinfo));
+                cinfo.hci_handle = chan->conn->hcon->handle;
+                memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
+
+                len = min_t(unsigned int, len, sizeof(cinfo));
+                if (copy_to_user(optval, (char *) &cinfo, len))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct bt_security sec;
+        int len, err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (level == SOL_L2CAP)
+                return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
+
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case BT_SECURITY:
+                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                                && sk->sk_type != SOCK_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sec.level = chan->sec_level;
+
+                len = min_t(unsigned int, len, sizeof(sec));
+                if (copy_to_user(optval, (char *) &sec, len))
+                        err = -EFAULT;
+
+                break;
+
+        case BT_DEFER_SETUP:
+                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        case BT_FLUSHABLE:
+                if (put_user(chan->flushable, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct l2cap_options opts;
+        int len, err = 0;
+        u32 opt;
+
+        BT_DBG("sk %p", sk);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case L2CAP_OPTIONS:
+                if (sk->sk_state == BT_CONNECTED) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                opts.imtu     = chan->imtu;
+                opts.omtu     = chan->omtu;
+                opts.flush_to = chan->flush_to;
+                opts.mode     = chan->mode;
+                opts.fcs      = chan->fcs;
+                opts.max_tx   = chan->max_tx;
+                opts.txwin_size = (__u16)chan->tx_win;
+
+                len = min_t(unsigned int, sizeof(opts), optlen);
+                if (copy_from_user((char *) &opts, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                chan->mode = opts.mode;
+                switch (chan->mode) {
+                case L2CAP_MODE_BASIC:
+                        chan->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
+                        break;
+                case L2CAP_MODE_ERTM:
+                case L2CAP_MODE_STREAMING:
+                        if (!disable_ertm)
+                                break;
+                        /* fall through */
+                default:
+                        err = -EINVAL;
+                        break;
+                }
+
+                chan->imtu = opts.imtu;
+                chan->omtu = opts.omtu;
+                chan->fcs  = opts.fcs;
+                chan->max_tx = opts.max_tx;
+                chan->tx_win = (__u8)opts.txwin_size;
+                break;
+
+        case L2CAP_LM:
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt & L2CAP_LM_AUTH)
+                        chan->sec_level = BT_SECURITY_LOW;
+                if (opt & L2CAP_LM_ENCRYPT)
+                        chan->sec_level = BT_SECURITY_MEDIUM;
+                if (opt & L2CAP_LM_SECURE)
+                        chan->sec_level = BT_SECURITY_HIGH;
+
+                chan->role_switch    = (opt & L2CAP_LM_MASTER);
+                chan->force_reliable = (opt & L2CAP_LM_RELIABLE);
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct bt_security sec;
+        int len, err = 0;
+        u32 opt;
+
+        BT_DBG("sk %p", sk);
+
+        if (level == SOL_L2CAP)
+                return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
+
+        if (level != SOL_BLUETOOTH)
+                return -ENOPROTOOPT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case BT_SECURITY:
+                if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                                && sk->sk_type != SOCK_RAW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                sec.level = BT_SECURITY_LOW;
+
+                len = min_t(unsigned int, sizeof(sec), optlen);
+                if (copy_from_user((char *) &sec, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (sec.level < BT_SECURITY_LOW ||
+                                        sec.level > BT_SECURITY_HIGH) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                chan->sec_level = sec.level;
+                break;
+
+        case BT_DEFER_SETUP:
+                if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                bt_sk(sk)->defer_setup = opt;
+                break;
+
+        case BT_FLUSHABLE:
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt > BT_FLUSHABLE_ON) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (opt == BT_FLUSHABLE_OFF) {
+                        struct l2cap_conn *conn = chan->conn;
+                        /* proceed further only when we have l2cap_conn and
+                           No Flush support in the LM */
+                        if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
+                                err = -EINVAL;
+                                break;
+                        }
+                }
+
+                chan->flushable = opt;
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct sk_buff *skb;
+        u16 control;
+        int err;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        err = sock_error(sk);
+        if (err)
+                return err;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_CONNECTED) {
+                err = -ENOTCONN;
+                goto done;
+        }
+
+        /* Connectionless channel */
+        if (sk->sk_type == SOCK_DGRAM) {
+                skb = l2cap_create_connless_pdu(chan, msg, len);
+                if (IS_ERR(skb)) {
+                        err = PTR_ERR(skb);
+                } else {
+                        l2cap_do_send(chan, skb);
+                        err = len;
+                }
+                goto done;
+        }
+
+        switch (chan->mode) {
+        case L2CAP_MODE_BASIC:
+                /* Check outgoing MTU */
+                if (len > chan->omtu) {
+                        err = -EMSGSIZE;
+                        goto done;
+                }
+
+                /* Create a basic PDU */
+                skb = l2cap_create_basic_pdu(chan, msg, len);
+                if (IS_ERR(skb)) {
+                        err = PTR_ERR(skb);
+                        goto done;
+                }
+
+                l2cap_do_send(chan, skb);
+                err = len;
+                break;
+
+        case L2CAP_MODE_ERTM:
+        case L2CAP_MODE_STREAMING:
+                /* Entire SDU fits into one PDU */
+                if (len <= chan->remote_mps) {
+                        control = L2CAP_SDU_UNSEGMENTED;
+                        skb = l2cap_create_iframe_pdu(chan, msg, len, control,
+                                                                        0);
+                        if (IS_ERR(skb)) {
+                                err = PTR_ERR(skb);
+                                goto done;
+                        }
+                        __skb_queue_tail(&chan->tx_q, skb);
+
+                        if (chan->tx_send_head == NULL)
+                                chan->tx_send_head = skb;
+
+                } else {
+                /* Segment SDU into multiples PDUs */
+                        err = l2cap_sar_segment_sdu(chan, msg, len);
+                        if (err < 0)
+                                goto done;
+                }
+
+                if (chan->mode == L2CAP_MODE_STREAMING) {
+                        l2cap_streaming_send(chan);
+                        err = len;
+                        break;
+                }
+
+                if ((chan->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                (chan->conn_state & L2CAP_CONN_WAIT_F)) {
+                        err = len;
+                        break;
+                }
+                err = l2cap_ertm_send(chan);
+
+                if (err >= 0)
+                        err = len;
+                break;
+
+        default:
+                BT_DBG("bad state %1.1x", chan->mode);
+                err = -EBADFD;
+        }
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
+{
+        struct sock *sk = sock->sk;
+
+        lock_sock(sk);
+
+        if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
+                sk->sk_state = BT_CONFIG;
+
+                __l2cap_connect_rsp_defer(l2cap_pi(sk)->chan);
+                release_sock(sk);
+                return 0;
+        }
+
+        release_sock(sk);
+
+        if (sock->type == SOCK_STREAM)
+                return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+
+        return bt_sock_recvmsg(iocb, sock, msg, len, flags);
+}
+
+/* Kill socket (only if zapped and orphan)
+ * Must be called on unlocked socket.
+ */
+void l2cap_sock_kill(struct sock *sk)
+{
+        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+                return;
+
+        BT_DBG("sk %p state %d", sk, sk->sk_state);
+
+        /* Kill poor orphan */
+
+        l2cap_chan_destroy(l2cap_pi(sk)->chan);
+        sock_set_flag(sk, SOCK_DEAD);
+        sock_put(sk);
+}
+
+/* Must be called on unlocked socket. */
+static void l2cap_sock_close(struct sock *sk)
+{
+        l2cap_sock_clear_timer(sk);
+        lock_sock(sk);
+        __l2cap_sock_close(sk, ECONNRESET);
+        release_sock(sk);
+        l2cap_sock_kill(sk);
+}
+
+static void l2cap_sock_cleanup_listen(struct sock *parent)
+{
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL)))
+                l2cap_sock_close(sk);
+
+        parent->sk_state = BT_CLOSED;
+        sock_set_flag(parent, SOCK_ZAPPED);
+}
+
+void __l2cap_sock_close(struct sock *sk, int reason)
+{
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        struct l2cap_conn *conn = chan->conn;
+
+        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
+
+        switch (sk->sk_state) {
+        case BT_LISTEN:
+                l2cap_sock_cleanup_listen(sk);
+                break;
+
+        case BT_CONNECTED:
+        case BT_CONFIG:
+                if ((sk->sk_type == SOCK_SEQPACKET ||
+                                        sk->sk_type == SOCK_STREAM) &&
+                                        conn->hcon->type == ACL_LINK) {
+                        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+                        l2cap_send_disconn_req(conn, chan, reason);
+                } else
+                        l2cap_chan_del(chan, reason);
+                break;
+
+        case BT_CONNECT2:
+                if ((sk->sk_type == SOCK_SEQPACKET ||
+                                        sk->sk_type == SOCK_STREAM) &&
+                                        conn->hcon->type == ACL_LINK) {
+                        struct l2cap_conn_rsp rsp;
+                        __u16 result;
+
+                        if (bt_sk(sk)->defer_setup)
+                                result = L2CAP_CR_SEC_BLOCK;
+                        else
+                                result = L2CAP_CR_BAD_PSM;
+
+                        rsp.scid   = cpu_to_le16(chan->dcid);
+                        rsp.dcid   = cpu_to_le16(chan->scid);
+                        rsp.result = cpu_to_le16(result);
+                        rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+                        l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
+                                                        sizeof(rsp), &rsp);
+                }
+
+                l2cap_chan_del(chan, reason);
+                break;
+
+        case BT_CONNECT:
+        case BT_DISCONN:
+                l2cap_chan_del(chan, reason);
+                break;
+
+        default:
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+        }
+}
+
+static int l2cap_sock_shutdown(struct socket *sock, int how)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        lock_sock(sk);
+        if (!sk->sk_shutdown) {
+                if (chan->mode == L2CAP_MODE_ERTM)
+                        err = __l2cap_wait_ack(sk);
+
+                sk->sk_shutdown = SHUTDOWN_MASK;
+                l2cap_sock_clear_timer(sk);
+                __l2cap_sock_close(sk, 0);
+
+                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+                        err = bt_sock_wait_state(sk, BT_CLOSED,
+                                                        sk->sk_lingertime);
+        }
+
+        if (!err && sk->sk_err)
+                err = -sk->sk_err;
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        int err;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        err = l2cap_sock_shutdown(sock, 2);
+
+        sock_orphan(sk);
+        l2cap_sock_kill(sk);
+        return err;
+}
+
+static void l2cap_sock_destruct(struct sock *sk)
+{
+        BT_DBG("sk %p", sk);
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+}
+
+void l2cap_sock_init(struct sock *sk, struct sock *parent)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_chan *chan = pi->chan;
+
+        BT_DBG("sk %p", sk);
+
+        if (parent) {
+                struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
+
+                sk->sk_type = parent->sk_type;
+                bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
+
+                chan->imtu = pchan->imtu;
+                chan->omtu = pchan->omtu;
+                chan->conf_state = pchan->conf_state;
+                chan->mode = pchan->mode;
+                chan->fcs  = pchan->fcs;
+                chan->max_tx = pchan->max_tx;
+                chan->tx_win = pchan->tx_win;
+                chan->sec_level = pchan->sec_level;
+                chan->role_switch = pchan->role_switch;
+                chan->force_reliable = pchan->force_reliable;
+                chan->flushable = pchan->flushable;
+        } else {
+                chan->imtu = L2CAP_DEFAULT_MTU;
+                chan->omtu = 0;
+                if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
+                        chan->mode = L2CAP_MODE_ERTM;
+                        chan->conf_state |= L2CAP_CONF_STATE2_DEVICE;
+                } else {
+                        chan->mode = L2CAP_MODE_BASIC;
+                }
+                chan->max_tx = L2CAP_DEFAULT_MAX_TX;
+                chan->fcs  = L2CAP_FCS_CRC16;
+                chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
+                chan->sec_level = BT_SECURITY_LOW;
+                chan->role_switch = 0;
+                chan->force_reliable = 0;
+                chan->flushable = BT_FLUSHABLE_OFF;
+        }
+
+        /* Default config options */
+        chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+}
+
+static struct proto l2cap_proto = {
+        .name           = "L2CAP",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct l2cap_pinfo)
+};
+
+struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
+{
+        struct sock *sk;
+
+        sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
+        if (!sk)
+                return NULL;
+
+        sock_init_data(sock, sk);
+        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
+
+        sk->sk_destruct = l2cap_sock_destruct;
+        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = proto;
+        sk->sk_state = BT_OPEN;
+
+        setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
+
+        return sk;
+}
+
+static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
+                             int kern)
+{
+        struct sock *sk;
+        struct l2cap_chan *chan;
+
+        BT_DBG("sock %p", sock);
+
+        sock->state = SS_UNCONNECTED;
+
+        if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
+                        sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
+                return -EPERM;
+
+        sock->ops = &l2cap_sock_ops;
+
+        sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
+        if (!sk)
+                return -ENOMEM;
+
+        chan = l2cap_chan_create(sk);
+        if (!chan) {
+                l2cap_sock_kill(sk);
+                return -ENOMEM;
+        }
+
+        l2cap_pi(sk)->chan = chan;
+
+        l2cap_sock_init(sk, NULL);
+        return 0;
+}
+
+static const struct proto_ops l2cap_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = l2cap_sock_release,
+        .bind           = l2cap_sock_bind,
+        .connect        = l2cap_sock_connect,
+        .listen         = l2cap_sock_listen,
+        .accept         = l2cap_sock_accept,
+        .getname        = l2cap_sock_getname,
+        .sendmsg        = l2cap_sock_sendmsg,
+        .recvmsg        = l2cap_sock_recvmsg,
+        .poll           = bt_sock_poll,
+        .ioctl          = bt_sock_ioctl,
+        .mmap           = sock_no_mmap,
+        .socketpair     = sock_no_socketpair,
+        .shutdown       = l2cap_sock_shutdown,
+        .setsockopt     = l2cap_sock_setsockopt,
+        .getsockopt     = l2cap_sock_getsockopt
+};
+
+static const struct net_proto_family l2cap_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = l2cap_sock_create,
+};
+
+int __init l2cap_init_sockets(void)
+{
+        int err;
+
+        err = proto_register(&l2cap_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        BT_INFO("L2CAP socket layer initialized");
+
+        return 0;
+
+error:
+        BT_ERR("L2CAP socket registration failed");
+        proto_unregister(&l2cap_proto);
+        return err;
+}
+
+void l2cap_cleanup_sockets(void)
+{
+        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
+                BT_ERR("L2CAP socket unregistration failed");
+
+        proto_unregister(&l2cap_proto);
+}
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index ad2af5814e40..b826d1bf10df 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -51,8 +51,8 @@ char *batostr(bdaddr_t *ba)
 
         i ^= 1;
         sprintf(str[i], "%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X",
-                ba->b[0], ba->b[1], ba->b[2],
-                ba->b[3], ba->b[4], ba->b[5]);
+                ba->b[5], ba->b[4], ba->b[3],
+                ba->b[2], ba->b[1], ba->b[0]);
 
         return str[i];
 }
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
new file mode 100644
index 000000000000..dae382ce7020
--- /dev/null
+++ b/net/bluetooth/mgmt.c
@@ -0,0 +1,2163 @@
+/*
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2010  Nokia Corporation
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI Management interface */
+
+#include <linux/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/mgmt.h>
+
+#define MGMT_VERSION    0
+#define MGMT_REVISION   1
+
+struct pending_cmd {
+        struct list_head list;
+        __u16 opcode;
+        int index;
+        void *param;
+        struct sock *sk;
+        void *user_data;
+};
+
+LIST_HEAD(cmd_list);
+
+static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
+{
+        struct sk_buff *skb;
+        struct mgmt_hdr *hdr;
+        struct mgmt_ev_cmd_status *ev;
+
+        BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
+
+        skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        hdr = (void *) skb_put(skb, sizeof(*hdr));
+
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
+        hdr->index = cpu_to_le16(index);
+        hdr->len = cpu_to_le16(sizeof(*ev));
+
+        ev = (void *) skb_put(skb, sizeof(*ev));
+        ev->status = status;
+        put_unaligned_le16(cmd, &ev->opcode);
+
+        if (sock_queue_rcv_skb(sk, skb) < 0)
+                kfree_skb(skb);
+
+        return 0;
+}
+
+static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
+                                                                size_t rp_len)
+{
+        struct sk_buff *skb;
+        struct mgmt_hdr *hdr;
+        struct mgmt_ev_cmd_complete *ev;
+
+        BT_DBG("sock %p", sk);
+
+        skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        hdr = (void *) skb_put(skb, sizeof(*hdr));
+
+        hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
+        hdr->index = cpu_to_le16(index);
+        hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
+
+        ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
+        put_unaligned_le16(cmd, &ev->opcode);
+
+        if (rp)
+                memcpy(ev->data, rp, rp_len);
+
+        if (sock_queue_rcv_skb(sk, skb) < 0)
+                kfree_skb(skb);
+
+        return 0;
+}
+
+static int read_version(struct sock *sk)
+{
+        struct mgmt_rp_read_version rp;
+
+        BT_DBG("sock %p", sk);
+
+        rp.version = MGMT_VERSION;
+        put_unaligned_le16(MGMT_REVISION, &rp.revision);
+
+        return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
+                                                                sizeof(rp));
+}
+
+static int read_index_list(struct sock *sk)
+{
+        struct mgmt_rp_read_index_list *rp;
+        struct list_head *p;
+        size_t rp_len;
+        u16 count;
+        int i, err;
+
+        BT_DBG("sock %p", sk);
+
+        read_lock(&hci_dev_list_lock);
+
+        count = 0;
+        list_for_each(p, &hci_dev_list) {
+                count++;
+        }
+
+        rp_len = sizeof(*rp) + (2 * count);
+        rp = kmalloc(rp_len, GFP_ATOMIC);
+        if (!rp) {
+                read_unlock(&hci_dev_list_lock);
+                return -ENOMEM;
+        }
+
+        put_unaligned_le16(count, &rp->num_controllers);
+
+        i = 0;
+        list_for_each(p, &hci_dev_list) {
+                struct hci_dev *d = list_entry(p, struct hci_dev, list);
+
+                hci_del_off_timer(d);
+
+                set_bit(HCI_MGMT, &d->flags);
+
+                if (test_bit(HCI_SETUP, &d->flags))
+                        continue;
+
+                put_unaligned_le16(d->id, &rp->index[i++]);
+                BT_DBG("Added hci%u", d->id);
+        }
+
+        read_unlock(&hci_dev_list_lock);
+
+        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
+                                                                        rp_len);
+
+        kfree(rp);
+
+        return err;
+}
+
+static int read_controller_info(struct sock *sk, u16 index)
+{
+        struct mgmt_rp_read_info rp;
+        struct hci_dev *hdev;
+
+        BT_DBG("sock %p hci%u", sk, index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_READ_INFO, ENODEV);
+
+        hci_del_off_timer(hdev);
+
+        hci_dev_lock(hdev);
+
+        set_bit(HCI_MGMT, &hdev->flags);
+
+        memset(&rp, 0, sizeof(rp));
+
+        rp.type = hdev->dev_type;
+
+        rp.powered = test_bit(HCI_UP, &hdev->flags);
+        rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
+        rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
+        rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
+
+        if (test_bit(HCI_AUTH, &hdev->flags))
+                rp.sec_mode = 3;
+        else if (hdev->ssp_mode > 0)
+                rp.sec_mode = 4;
+        else
+                rp.sec_mode = 2;
+
+        bacpy(&rp.bdaddr, &hdev->bdaddr);
+        memcpy(rp.features, hdev->features, 8);
+        memcpy(rp.dev_class, hdev->dev_class, 3);
+        put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
+        rp.hci_ver = hdev->hci_ver;
+        put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
+
+        memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
+}
+
+static void mgmt_pending_free(struct pending_cmd *cmd)
+{
+        sock_put(cmd->sk);
+        kfree(cmd->param);
+        kfree(cmd);
+}
+
+static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
+                                                u16 index, void *data, u16 len)
+{
+        struct pending_cmd *cmd;
+
+        cmd = kmalloc(sizeof(*cmd), GFP_ATOMIC);
+        if (!cmd)
+                return NULL;
+
+        cmd->opcode = opcode;
+        cmd->index = index;
+
+        cmd->param = kmalloc(len, GFP_ATOMIC);
+        if (!cmd->param) {
+                kfree(cmd);
+                return NULL;
+        }
+
+        if (data)
+                memcpy(cmd->param, data, len);
+
+        cmd->sk = sk;
+        sock_hold(sk);
+
+        list_add(&cmd->list, &cmd_list);
+
+        return cmd;
+}
+
+static void mgmt_pending_foreach(u16 opcode, int index,
+                                void (*cb)(struct pending_cmd *cmd, void *data),
+                                void *data)
+{
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &cmd_list) {
+                struct pending_cmd *cmd;
+
+                cmd = list_entry(p, struct pending_cmd, list);
+
+                if (cmd->opcode != opcode)
+                        continue;
+
+                if (index >= 0 && cmd->index != index)
+                        continue;
+
+                cb(cmd, data);
+        }
+}
+
+static struct pending_cmd *mgmt_pending_find(u16 opcode, int index)
+{
+        struct list_head *p;
+
+        list_for_each(p, &cmd_list) {
+                struct pending_cmd *cmd;
+
+                cmd = list_entry(p, struct pending_cmd, list);
+
+                if (cmd->opcode != opcode)
+                        continue;
+
+                if (index >= 0 && cmd->index != index)
+                        continue;
+
+                return cmd;
+        }
+
+        return NULL;
+}
+
+static void mgmt_pending_remove(struct pending_cmd *cmd)
+{
+        list_del(&cmd->list);
+        mgmt_pending_free(cmd);
+}
+
+static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct mgmt_mode *cp;
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err, up;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_POWERED, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_POWERED, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        up = test_bit(HCI_UP, &hdev->flags);
+        if ((cp->val && up) || (!cp->val && !up)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EALREADY);
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_POWERED, index)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_POWERED, EBUSY);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        if (cp->val)
+                queue_work(hdev->workqueue, &hdev->power_on);
+        else
+                queue_work(hdev->workqueue, &hdev->power_off);
+
+        err = 0;
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct mgmt_mode *cp;
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        u8 scan;
+        int err;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, ENETDOWN);
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
+                        mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EBUSY);
+                goto failed;
+        }
+
+        if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
+                                        test_bit(HCI_PSCAN, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE, EALREADY);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        scan = SCAN_PAGE;
+
+        if (cp->val)
+                scan |= SCAN_INQUIRY;
+
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct mgmt_mode *cp;
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        u8 scan;
+        int err;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, ENETDOWN);
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, index) ||
+                        mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, index)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EBUSY);
+                goto failed;
+        }
+
+        if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE, EALREADY);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        if (cp->val)
+                scan = SCAN_PAGE;
+        else
+                scan = 0;
+
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int mgmt_event(u16 event, u16 index, void *data, u16 data_len,
+                                                        struct sock *skip_sk)
+{
+        struct sk_buff *skb;
+        struct mgmt_hdr *hdr;
+
+        skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
+
+        hdr = (void *) skb_put(skb, sizeof(*hdr));
+        hdr->opcode = cpu_to_le16(event);
+        hdr->index = cpu_to_le16(index);
+        hdr->len = cpu_to_le16(data_len);
+
+        if (data)
+                memcpy(skb_put(skb, data_len), data, data_len);
+
+        hci_send_to_sock(NULL, skb, skip_sk);
+        kfree_skb(skb);
+
+        return 0;
+}
+
+static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
+{
+        struct mgmt_mode rp;
+
+        rp.val = val;
+
+        return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
+}
+
+static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct mgmt_mode *cp, ev;
+        struct hci_dev *hdev;
+        int err;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (cp->val)
+                set_bit(HCI_PAIRABLE, &hdev->flags);
+        else
+                clear_bit(HCI_PAIRABLE, &hdev->flags);
+
+        err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
+        if (err < 0)
+                goto failed;
+
+        ev.val = cp->val;
+
+        err = mgmt_event(MGMT_EV_PAIRABLE, index, &ev, sizeof(ev), sk);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+#define EIR_FLAGS               0x01 /* flags */
+#define EIR_UUID16_SOME         0x02 /* 16-bit UUID, more available */
+#define EIR_UUID16_ALL          0x03 /* 16-bit UUID, all listed */
+#define EIR_UUID32_SOME         0x04 /* 32-bit UUID, more available */
+#define EIR_UUID32_ALL          0x05 /* 32-bit UUID, all listed */
+#define EIR_UUID128_SOME        0x06 /* 128-bit UUID, more available */
+#define EIR_UUID128_ALL         0x07 /* 128-bit UUID, all listed */
+#define EIR_NAME_SHORT          0x08 /* shortened local name */
+#define EIR_NAME_COMPLETE       0x09 /* complete local name */
+#define EIR_TX_POWER            0x0A /* transmit power level */
+#define EIR_DEVICE_ID           0x10 /* device ID */
+
+#define PNP_INFO_SVCLASS_ID             0x1200
+
+static u8 bluetooth_base_uuid[] = {
+                        0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
+                        0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static u16 get_uuid16(u8 *uuid128)
+{
+        u32 val;
+        int i;
+
+        for (i = 0; i < 12; i++) {
+                if (bluetooth_base_uuid[i] != uuid128[i])
+                        return 0;
+        }
+
+        memcpy(&val, &uuid128[12], 4);
+
+        val = le32_to_cpu(val);
+        if (val > 0xffff)
+                return 0;
+
+        return (u16) val;
+}
+
+static void create_eir(struct hci_dev *hdev, u8 *data)
+{
+        u8 *ptr = data;
+        u16 eir_len = 0;
+        u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
+        int i, truncated = 0;
+        struct list_head *p;
+        size_t name_len;
+
+        name_len = strlen(hdev->dev_name);
+
+        if (name_len > 0) {
+                /* EIR Data type */
+                if (name_len > 48) {
+                        name_len = 48;
+                        ptr[1] = EIR_NAME_SHORT;
+                } else
+                        ptr[1] = EIR_NAME_COMPLETE;
+
+                /* EIR Data length */
+                ptr[0] = name_len + 1;
+
+                memcpy(ptr + 2, hdev->dev_name, name_len);
+
+                eir_len += (name_len + 2);
+                ptr += (name_len + 2);
+        }
+
+        memset(uuid16_list, 0, sizeof(uuid16_list));
+
+        /* Group all UUID16 types */
+        list_for_each(p, &hdev->uuids) {
+                struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
+                u16 uuid16;
+
+                uuid16 = get_uuid16(uuid->uuid);
+                if (uuid16 == 0)
+                        return;
+
+                if (uuid16 < 0x1100)
+                        continue;
+
+                if (uuid16 == PNP_INFO_SVCLASS_ID)
+                        continue;
+
+                /* Stop if not enough space to put next UUID */
+                if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
+                        truncated = 1;
+                        break;
+                }
+
+                /* Check for duplicates */
+                for (i = 0; uuid16_list[i] != 0; i++)
+                        if (uuid16_list[i] == uuid16)
+                                break;
+
+                if (uuid16_list[i] == 0) {
+                        uuid16_list[i] = uuid16;
+                        eir_len += sizeof(u16);
+                }
+        }
+
+        if (uuid16_list[0] != 0) {
+                u8 *length = ptr;
+
+                /* EIR Data type */
+                ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
+
+                ptr += 2;
+                eir_len += 2;
+
+                for (i = 0; uuid16_list[i] != 0; i++) {
+                        *ptr++ = (uuid16_list[i] & 0x00ff);
+                        *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
+                }
+
+                /* EIR Data length */
+                *length = (i * sizeof(u16)) + 1;
+        }
+}
+
+static int update_eir(struct hci_dev *hdev)
+{
+        struct hci_cp_write_eir cp;
+
+        if (!(hdev->features[6] & LMP_EXT_INQ))
+                return 0;
+
+        if (hdev->ssp_mode == 0)
+                return 0;
+
+        if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+                return 0;
+
+        memset(&cp, 0, sizeof(cp));
+
+        create_eir(hdev, cp.data);
+
+        if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
+                return 0;
+
+        memcpy(hdev->eir, cp.data, sizeof(cp.data));
+
+        return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+}
+
+static u8 get_service_classes(struct hci_dev *hdev)
+{
+        struct list_head *p;
+        u8 val = 0;
+
+        list_for_each(p, &hdev->uuids) {
+                struct bt_uuid *uuid = list_entry(p, struct bt_uuid, list);
+
+                val |= uuid->svc_hint;
+        }
+
+        return val;
+}
+
+static int update_class(struct hci_dev *hdev)
+{
+        u8 cod[3];
+
+        BT_DBG("%s", hdev->name);
+
+        if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+                return 0;
+
+        cod[0] = hdev->minor_class;
+        cod[1] = hdev->major_class;
+        cod[2] = get_service_classes(hdev);
+
+        if (memcmp(cod, hdev->dev_class, 3) == 0)
+                return 0;
+
+        return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+}
+
+static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct mgmt_cp_add_uuid *cp;
+        struct hci_dev *hdev;
+        struct bt_uuid *uuid;
+        int err;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_ADD_UUID, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_ADD_UUID, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
+        if (!uuid) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        memcpy(uuid->uuid, cp->uuid, 16);
+        uuid->svc_hint = cp->svc_hint;
+
+        list_add(&uuid->list, &hdev->uuids);
+
+        err = update_class(hdev);
+        if (err < 0)
+                goto failed;
+
+        err = update_eir(hdev);
+        if (err < 0)
+                goto failed;
+
+        err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct list_head *p, *n;
+        struct mgmt_cp_remove_uuid *cp;
+        struct hci_dev *hdev;
+        u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
+        int err, found;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
+                err = hci_uuids_clear(hdev);
+                goto unlock;
+        }
+
+        found = 0;
+
+        list_for_each_safe(p, n, &hdev->uuids) {
+                struct bt_uuid *match = list_entry(p, struct bt_uuid, list);
+
+                if (memcmp(match->uuid, cp->uuid, 16) != 0)
+                        continue;
+
+                list_del(&match->list);
+                found++;
+        }
+
+        if (found == 0) {
+                err = cmd_status(sk, index, MGMT_OP_REMOVE_UUID, ENOENT);
+                goto unlock;
+        }
+
+        err = update_class(hdev);
+        if (err < 0)
+                goto unlock;
+
+        err = update_eir(hdev);
+        if (err < 0)
+                goto unlock;
+
+        err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
+
+unlock:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_dev_class *cp;
+        int err;
+
+        cp = (void *) data;
+
+        BT_DBG("request for hci%u", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        hdev->major_class = cp->major;
+        hdev->minor_class = cp->minor;
+
+        err = update_class(hdev);
+
+        if (err == 0)
+                err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_service_cache *cp;
+        int err;
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        BT_DBG("hci%u enable %d", index, cp->enable);
+
+        if (cp->enable) {
+                set_bit(HCI_SERVICE_CACHE, &hdev->flags);
+                err = 0;
+        } else {
+                clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
+                err = update_class(hdev);
+                if (err == 0)
+                        err = update_eir(hdev);
+        }
+
+        if (err == 0)
+                err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
+                                                                        0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int load_keys(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_load_keys *cp;
+        u16 key_count, expected_len;
+        int i;
+
+        cp = (void *) data;
+
+        if (len < sizeof(*cp))
+                return -EINVAL;
+
+        key_count = get_unaligned_le16(&cp->key_count);
+
+        expected_len = sizeof(*cp) + key_count * sizeof(struct mgmt_key_info);
+        if (expected_len != len) {
+                BT_ERR("load_keys: expected %u bytes, got %u bytes",
+                                                        len, expected_len);
+                return -EINVAL;
+        }
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_LOAD_KEYS, ENODEV);
+
+        BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
+                                                                key_count);
+
+        hci_dev_lock(hdev);
+
+        hci_link_keys_clear(hdev);
+
+        set_bit(HCI_LINK_KEYS, &hdev->flags);
+
+        if (cp->debug_keys)
+                set_bit(HCI_DEBUG_KEYS, &hdev->flags);
+        else
+                clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
+
+        for (i = 0; i < key_count; i++) {
+                struct mgmt_key_info *key = &cp->keys[i];
+
+                hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
+                                                                key->pin_len);
+        }
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return 0;
+}
+
+static int remove_key(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_remove_key *cp;
+        struct hci_conn *conn;
+        int err;
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_REMOVE_KEY, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        err = hci_remove_link_key(hdev, &cp->bdaddr);
+        if (err < 0) {
+                err = cmd_status(sk, index, MGMT_OP_REMOVE_KEY, -err);
+                goto unlock;
+        }
+
+        err = 0;
+
+        if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect)
+                goto unlock;
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (conn) {
+                struct hci_cp_disconnect dc;
+
+                put_unaligned_le16(conn->handle, &dc.handle);
+                dc.reason = 0x13; /* Remote User Terminated Connection */
+                err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, 0, NULL);
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_disconnect *cp;
+        struct hci_cp_disconnect dc;
+        struct pending_cmd *cmd;
+        struct hci_conn *conn;
+        int err;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_DISCONNECT, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_DISCONNECT, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENETDOWN);
+                goto failed;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_DISCONNECT, index)) {
+                err = cmd_status(sk, index, MGMT_OP_DISCONNECT, EBUSY);
+                goto failed;
+        }
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+        if (!conn)
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+
+        if (!conn) {
+                err = cmd_status(sk, index, MGMT_OP_DISCONNECT, ENOTCONN);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        put_unaligned_le16(conn->handle, &dc.handle);
+        dc.reason = 0x13; /* Remote User Terminated Connection */
+
+        err = hci_send_cmd(hdev, HCI_OP_DISCONNECT, sizeof(dc), &dc);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int get_connections(struct sock *sk, u16 index)
+{
+        struct mgmt_rp_get_connections *rp;
+        struct hci_dev *hdev;
+        struct list_head *p;
+        size_t rp_len;
+        u16 count;
+        int i, err;
+
+        BT_DBG("");
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        count = 0;
+        list_for_each(p, &hdev->conn_hash.list) {
+                count++;
+        }
+
+        rp_len = sizeof(*rp) + (count * sizeof(bdaddr_t));
+        rp = kmalloc(rp_len, GFP_ATOMIC);
+        if (!rp) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        put_unaligned_le16(count, &rp->conn_count);
+
+        read_lock(&hci_dev_list_lock);
+
+        i = 0;
+        list_for_each(p, &hdev->conn_hash.list) {
+                struct hci_conn *c = list_entry(p, struct hci_conn, list);
+
+                bacpy(&rp->conn[i++], &c->dst);
+        }
+
+        read_unlock(&hci_dev_list_lock);
+
+        err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
+
+unlock:
+        kfree(rp);
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_pin_code_reply *cp;
+        struct hci_cp_pin_code_reply reply;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY, ENETDOWN);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        bacpy(&reply.bdaddr, &cp->bdaddr);
+        reply.pin_len = cp->pin_len;
+        memcpy(reply.pin_code, cp->pin_code, 16);
+
+        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_pin_code_neg_reply *cp;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                                                ENETDOWN);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, index,
+                                                                data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
+                                                                &cp->bdaddr);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_io_capability *cp;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        hdev->io_capability = cp->io_capability;
+
+        BT_DBG("%s IO capability set to 0x%02x", hdev->name,
+                                                        hdev->io_capability);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
+}
+
+static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct list_head *p;
+
+        list_for_each(p, &cmd_list) {
+                struct pending_cmd *cmd;
+
+                cmd = list_entry(p, struct pending_cmd, list);
+
+                if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
+                        continue;
+
+                if (cmd->index != hdev->id)
+                        continue;
+
+                if (cmd->user_data != conn)
+                        continue;
+
+                return cmd;
+        }
+
+        return NULL;
+}
+
+static void pairing_complete(struct pending_cmd *cmd, u8 status)
+{
+        struct mgmt_rp_pair_device rp;
+        struct hci_conn *conn = cmd->user_data;
+
+        bacpy(&rp.bdaddr, &conn->dst);
+        rp.status = status;
+
+        cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
+
+        /* So we don't get further callbacks for this connection */
+        conn->connect_cfm_cb = NULL;
+        conn->security_cfm_cb = NULL;
+        conn->disconn_cfm_cb = NULL;
+
+        hci_conn_put(conn);
+
+        mgmt_pending_remove(cmd);
+}
+
+static void pairing_complete_cb(struct hci_conn *conn, u8 status)
+{
+        struct pending_cmd *cmd;
+
+        BT_DBG("status %u", status);
+
+        cmd = find_pairing(conn);
+        if (!cmd) {
+                BT_DBG("Unable to find a pending command");
+                return;
+        }
+
+        pairing_complete(cmd, status);
+}
+
+static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_pair_device *cp;
+        struct pending_cmd *cmd;
+        u8 sec_level, auth_type;
+        struct hci_conn *conn;
+        int err;
+
+        BT_DBG("");
+
+        cp = (void *) data;
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (cp->io_cap == 0x03) {
+                sec_level = BT_SECURITY_MEDIUM;
+                auth_type = HCI_AT_DEDICATED_BONDING;
+        } else {
+                sec_level = BT_SECURITY_HIGH;
+                auth_type = HCI_AT_DEDICATED_BONDING_MITM;
+        }
+
+        conn = hci_connect(hdev, ACL_LINK, &cp->bdaddr, sec_level, auth_type);
+        if (IS_ERR(conn)) {
+                err = PTR_ERR(conn);
+                goto unlock;
+        }
+
+        if (conn->connect_cfm_cb) {
+                hci_conn_put(conn);
+                err = cmd_status(sk, index, MGMT_OP_PAIR_DEVICE, EBUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                hci_conn_put(conn);
+                goto unlock;
+        }
+
+        conn->connect_cfm_cb = pairing_complete_cb;
+        conn->security_cfm_cb = pairing_complete_cb;
+        conn->disconn_cfm_cb = pairing_complete_cb;
+        conn->io_capability = cp->io_cap;
+        cmd->user_data = conn;
+
+        if (conn->state == BT_CONNECTED &&
+                                hci_conn_security(conn, sec_level, auth_type))
+                pairing_complete(cmd, 0);
+
+        err = 0;
+
+unlock:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
+                                                        u16 len, int success)
+{
+        struct mgmt_cp_user_confirm_reply *cp = (void *) data;
+        u16 mgmt_op, hci_op;
+        struct pending_cmd *cmd;
+        struct hci_dev *hdev;
+        int err;
+
+        BT_DBG("");
+
+        if (success) {
+                mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
+                hci_op = HCI_OP_USER_CONFIRM_REPLY;
+        } else {
+                mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
+                hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
+        }
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, mgmt_op, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, mgmt_op, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, mgmt_op, ENETDOWN);
+                goto failed;
+        }
+
+        cmd = mgmt_pending_add(sk, mgmt_op, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
+                                                                u16 len)
+{
+        struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
+        struct hci_cp_write_local_name hci_cp;
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("");
+
+        if (len != sizeof(*mgmt_cp))
+                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME, ENODEV);
+
+        hci_dev_lock(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, index, data, len);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        memcpy(hci_cp.name, mgmt_cp->name, sizeof(hci_cp.name));
+        err = hci_send_cmd(hdev, HCI_OP_WRITE_LOCAL_NAME, sizeof(hci_cp),
+                                                                &hci_cp);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int read_local_oob_data(struct sock *sk, u16 index)
+{
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                ENETDOWN);
+                goto unlock;
+        }
+
+        if (!(hdev->features[6] & LMP_SIMPLE_PAIR)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                EOPNOTSUPP);
+                goto unlock;
+        }
+
+        if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index)) {
+                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA, EBUSY);
+                goto unlock;
+        }
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto unlock;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+unlock:
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
+                                                                        u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
+        int err;
+
+        BT_DBG("hci%u ", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
+                                                                cp->randomizer);
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
+                                                                        0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int remove_remote_oob_data(struct sock *sk, u16 index,
+                                                unsigned char *data, u16 len)
+{
+        struct hci_dev *hdev;
+        struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
+        int err;
+
+        BT_DBG("hci%u ", index);
+
+        if (len != sizeof(*cp))
+                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        EINVAL);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        ENODEV);
+
+        hci_dev_lock(hdev);
+
+        err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
+        if (err < 0)
+                err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                        -err);
+        else
+                err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                                                NULL, 0);
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int start_discovery(struct sock *sk, u16 index)
+{
+        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+        struct hci_cp_inquiry cp;
+        struct pending_cmd *cmd;
+        struct hci_dev *hdev;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY, ENODEV);
+
+        hci_dev_lock_bh(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        memset(&cp, 0, sizeof(cp));
+        memcpy(&cp.lap, lap, 3);
+        cp.length  = 0x08;
+        cp.num_rsp = 0x00;
+
+        err = hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+static int stop_discovery(struct sock *sk, u16 index)
+{
+        struct hci_dev *hdev;
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u", index);
+
+        hdev = hci_dev_get(index);
+        if (!hdev)
+                return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY, ENODEV);
+
+        hci_dev_lock_bh(hdev);
+
+        cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, index, NULL, 0);
+        if (!cmd) {
+                err = -ENOMEM;
+                goto failed;
+        }
+
+        err = hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
+        if (err < 0)
+                mgmt_pending_remove(cmd);
+
+failed:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
+{
+        unsigned char *buf;
+        struct mgmt_hdr *hdr;
+        u16 opcode, index, len;
+        int err;
+
+        BT_DBG("got %zu bytes", msglen);
+
+        if (msglen < sizeof(*hdr))
+                return -EINVAL;
+
+        buf = kmalloc(msglen, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        if (memcpy_fromiovec(buf, msg->msg_iov, msglen)) {
+                err = -EFAULT;
+                goto done;
+        }
+
+        hdr = (struct mgmt_hdr *) buf;
+        opcode = get_unaligned_le16(&hdr->opcode);
+        index = get_unaligned_le16(&hdr->index);
+        len = get_unaligned_le16(&hdr->len);
+
+        if (len != msglen - sizeof(*hdr)) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        switch (opcode) {
+        case MGMT_OP_READ_VERSION:
+                err = read_version(sk);
+                break;
+        case MGMT_OP_READ_INDEX_LIST:
+                err = read_index_list(sk);
+                break;
+        case MGMT_OP_READ_INFO:
+                err = read_controller_info(sk, index);
+                break;
+        case MGMT_OP_SET_POWERED:
+                err = set_powered(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_DISCOVERABLE:
+                err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_CONNECTABLE:
+                err = set_connectable(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_PAIRABLE:
+                err = set_pairable(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_ADD_UUID:
+                err = add_uuid(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_REMOVE_UUID:
+                err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_DEV_CLASS:
+                err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_SERVICE_CACHE:
+                err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_LOAD_KEYS:
+                err = load_keys(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_REMOVE_KEY:
+                err = remove_key(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_DISCONNECT:
+                err = disconnect(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_GET_CONNECTIONS:
+                err = get_connections(sk, index);
+                break;
+        case MGMT_OP_PIN_CODE_REPLY:
+                err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_PIN_CODE_NEG_REPLY:
+                err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_SET_IO_CAPABILITY:
+                err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_PAIR_DEVICE:
+                err = pair_device(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_USER_CONFIRM_REPLY:
+                err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
+                break;
+        case MGMT_OP_USER_CONFIRM_NEG_REPLY:
+                err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
+                break;
+        case MGMT_OP_SET_LOCAL_NAME:
+                err = set_local_name(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_READ_LOCAL_OOB_DATA:
+                err = read_local_oob_data(sk, index);
+                break;
+        case MGMT_OP_ADD_REMOTE_OOB_DATA:
+                err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
+                break;
+        case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
+                err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
+                                                                        len);
+                break;
+        case MGMT_OP_START_DISCOVERY:
+                err = start_discovery(sk, index);
+                break;
+        case MGMT_OP_STOP_DISCOVERY:
+                err = stop_discovery(sk, index);
+                break;
+        default:
+                BT_DBG("Unknown op %u", opcode);
+                err = cmd_status(sk, index, opcode, 0x01);
+                break;
+        }
+
+        if (err < 0)
+                goto done;
+
+        err = msglen;
+
+done:
+        kfree(buf);
+        return err;
+}
+
+int mgmt_index_added(u16 index)
+{
+        return mgmt_event(MGMT_EV_INDEX_ADDED, index, NULL, 0, NULL);
+}
+
+int mgmt_index_removed(u16 index)
+{
+        return mgmt_event(MGMT_EV_INDEX_REMOVED, index, NULL, 0, NULL);
+}
+
+struct cmd_lookup {
+        u8 val;
+        struct sock *sk;
+};
+
+static void mode_rsp(struct pending_cmd *cmd, void *data)
+{
+        struct mgmt_mode *cp = cmd->param;
+        struct cmd_lookup *match = data;
+
+        if (cp->val != match->val)
+                return;
+
+        send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
+
+        list_del(&cmd->list);
+
+        if (match->sk == NULL) {
+                match->sk = cmd->sk;
+                sock_hold(match->sk);
+        }
+
+        mgmt_pending_free(cmd);
+}
+
+int mgmt_powered(u16 index, u8 powered)
+{
+        struct mgmt_mode ev;
+        struct cmd_lookup match = { powered, NULL };
+        int ret;
+
+        mgmt_pending_foreach(MGMT_OP_SET_POWERED, index, mode_rsp, &match);
+
+        ev.val = powered;
+
+        ret = mgmt_event(MGMT_EV_POWERED, index, &ev, sizeof(ev), match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return ret;
+}
+
+int mgmt_discoverable(u16 index, u8 discoverable)
+{
+        struct mgmt_mode ev;
+        struct cmd_lookup match = { discoverable, NULL };
+        int ret;
+
+        mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, index, mode_rsp, &match);
+
+        ev.val = discoverable;
+
+        ret = mgmt_event(MGMT_EV_DISCOVERABLE, index, &ev, sizeof(ev),
+                                                                match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return ret;
+}
+
+int mgmt_connectable(u16 index, u8 connectable)
+{
+        struct mgmt_mode ev;
+        struct cmd_lookup match = { connectable, NULL };
+        int ret;
+
+        mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, index, mode_rsp, &match);
+
+        ev.val = connectable;
+
+        ret = mgmt_event(MGMT_EV_CONNECTABLE, index, &ev, sizeof(ev), match.sk);
+
+        if (match.sk)
+                sock_put(match.sk);
+
+        return ret;
+}
+
+int mgmt_new_key(u16 index, struct link_key *key, u8 persistent)
+{
+        struct mgmt_ev_new_key ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        ev.store_hint = persistent;
+        bacpy(&ev.key.bdaddr, &key->bdaddr);
+        ev.key.type = key->type;
+        memcpy(ev.key.val, key->val, 16);
+        ev.key.pin_len = key->pin_len;
+
+        return mgmt_event(MGMT_EV_NEW_KEY, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_connected(u16 index, bdaddr_t *bdaddr)
+{
+        struct mgmt_ev_connected ev;
+
+        bacpy(&ev.bdaddr, bdaddr);
+
+        return mgmt_event(MGMT_EV_CONNECTED, index, &ev, sizeof(ev), NULL);
+}
+
+static void disconnect_rsp(struct pending_cmd *cmd, void *data)
+{
+        struct mgmt_cp_disconnect *cp = cmd->param;
+        struct sock **sk = data;
+        struct mgmt_rp_disconnect rp;
+
+        bacpy(&rp.bdaddr, &cp->bdaddr);
+
+        cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
+
+        *sk = cmd->sk;
+        sock_hold(*sk);
+
+        mgmt_pending_remove(cmd);
+}
+
+int mgmt_disconnected(u16 index, bdaddr_t *bdaddr)
+{
+        struct mgmt_ev_disconnected ev;
+        struct sock *sk = NULL;
+        int err;
+
+        mgmt_pending_foreach(MGMT_OP_DISCONNECT, index, disconnect_rsp, &sk);
+
+        bacpy(&ev.bdaddr, bdaddr);
+
+        err = mgmt_event(MGMT_EV_DISCONNECTED, index, &ev, sizeof(ev), sk);
+
+        if (sk)
+                sock_put(sk);
+
+        return err;
+}
+
+int mgmt_disconnect_failed(u16 index)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, index);
+        if (!cmd)
+                return -ENOENT;
+
+        err = cmd_status(cmd->sk, index, MGMT_OP_DISCONNECT, EIO);
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        struct mgmt_ev_connect_failed ev;
+
+        bacpy(&ev.bdaddr, bdaddr);
+        ev.status = status;
+
+        return mgmt_event(MGMT_EV_CONNECT_FAILED, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure)
+{
+        struct mgmt_ev_pin_code_request ev;
+
+        bacpy(&ev.bdaddr, bdaddr);
+        ev.secure = secure;
+
+        return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, index, &ev, sizeof(ev),
+                                                                        NULL);
+}
+
+int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        struct pending_cmd *cmd;
+        struct mgmt_rp_pin_code_reply rp;
+        int err;
+
+        cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, index);
+        if (!cmd)
+                return -ENOENT;
+
+        bacpy(&rp.bdaddr, bdaddr);
+        rp.status = status;
+
+        err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_REPLY, &rp,
+                                                                sizeof(rp));
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        struct pending_cmd *cmd;
+        struct mgmt_rp_pin_code_reply rp;
+        int err;
+
+        cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, index);
+        if (!cmd)
+                return -ENOENT;
+
+        bacpy(&rp.bdaddr, bdaddr);
+        rp.status = status;
+
+        err = cmd_complete(cmd->sk, index, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
+                                                                sizeof(rp));
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
+                                                        u8 confirm_hint)
+{
+        struct mgmt_ev_user_confirm_request ev;
+
+        BT_DBG("hci%u", index);
+
+        bacpy(&ev.bdaddr, bdaddr);
+        ev.confirm_hint = confirm_hint;
+        put_unaligned_le32(value, &ev.value);
+
+        return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, index, &ev, sizeof(ev),
+                                                                        NULL);
+}
+
+static int confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status,
+                                                                u8 opcode)
+{
+        struct pending_cmd *cmd;
+        struct mgmt_rp_user_confirm_reply rp;
+        int err;
+
+        cmd = mgmt_pending_find(opcode, index);
+        if (!cmd)
+                return -ENOENT;
+
+        bacpy(&rp.bdaddr, bdaddr);
+        rp.status = status;
+        err = cmd_complete(cmd->sk, index, opcode, &rp, sizeof(rp));
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        return confirm_reply_complete(index, bdaddr, status,
+                                                MGMT_OP_USER_CONFIRM_REPLY);
+}
+
+int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        return confirm_reply_complete(index, bdaddr, status,
+                                        MGMT_OP_USER_CONFIRM_NEG_REPLY);
+}
+
+int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status)
+{
+        struct mgmt_ev_auth_failed ev;
+
+        bacpy(&ev.bdaddr, bdaddr);
+        ev.status = status;
+
+        return mgmt_event(MGMT_EV_AUTH_FAILED, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status)
+{
+        struct pending_cmd *cmd;
+        struct hci_dev *hdev;
+        struct mgmt_cp_set_local_name ev;
+        int err;
+
+        memset(&ev, 0, sizeof(ev));
+        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+
+        cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, index);
+        if (!cmd)
+                goto send_event;
+
+        if (status) {
+                err = cmd_status(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, EIO);
+                goto failed;
+        }
+
+        hdev = hci_dev_get(index);
+        if (hdev) {
+                hci_dev_lock_bh(hdev);
+                update_eir(hdev);
+                hci_dev_unlock_bh(hdev);
+                hci_dev_put(hdev);
+        }
+
+        err = cmd_complete(cmd->sk, index, MGMT_OP_SET_LOCAL_NAME, &ev,
+                                                                sizeof(ev));
+        if (err < 0)
+                goto failed;
+
+send_event:
+        err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, index, &ev, sizeof(ev),
+                                                        cmd ? cmd->sk : NULL);
+
+failed:
+        if (cmd)
+                mgmt_pending_remove(cmd);
+        return err;
+}
+
+int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
+                                                                u8 status)
+{
+        struct pending_cmd *cmd;
+        int err;
+
+        BT_DBG("hci%u status %u", index, status);
+
+        cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, index);
+        if (!cmd)
+                return -ENOENT;
+
+        if (status) {
+                err = cmd_status(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                                        EIO);
+        } else {
+                struct mgmt_rp_read_local_oob_data rp;
+
+                memcpy(rp.hash, hash, sizeof(rp.hash));
+                memcpy(rp.randomizer, randomizer, sizeof(rp.randomizer));
+
+                err = cmd_complete(cmd->sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                                        &rp, sizeof(rp));
+        }
+
+        mgmt_pending_remove(cmd);
+
+        return err;
+}
+
+int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
+                                                                u8 *eir)
+{
+        struct mgmt_ev_device_found ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        bacpy(&ev.bdaddr, bdaddr);
+        memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
+        ev.rssi = rssi;
+
+        if (eir)
+                memcpy(ev.eir, eir, sizeof(ev.eir));
+
+        return mgmt_event(MGMT_EV_DEVICE_FOUND, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name)
+{
+        struct mgmt_ev_remote_name ev;
+
+        memset(&ev, 0, sizeof(ev));
+
+        bacpy(&ev.bdaddr, bdaddr);
+        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+
+        return mgmt_event(MGMT_EV_REMOTE_NAME, index, &ev, sizeof(ev), NULL);
+}
+
+int mgmt_discovering(u16 index, u8 discovering)
+{
+        return mgmt_event(MGMT_EV_DISCOVERING, index, &discovering,
+                                                sizeof(discovering), NULL);
+}
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 7dca91bb8c57..5759bb7054f7 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -41,7 +41,7 @@
 #include <linux/slab.h>
 
 #include <net/sock.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -51,10 +51,10 @@
 
 #define VERSION "1.11"
 
-static int disable_cfc = 0;
+static int disable_cfc;
+static int l2cap_ertm;
 static int channel_mtu = -1;
 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
-static int l2cap_ertm = 0;
 
 static struct task_struct *rfcomm_thread;
 
@@ -79,7 +79,10 @@ static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 
 static void rfcomm_process_connect(struct rfcomm_session *s);
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err);
 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 static void rfcomm_session_del(struct rfcomm_session *s);
 
@@ -113,11 +116,10 @@ static void rfcomm_session_del(struct rfcomm_session *s);
 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 
-static inline void rfcomm_schedule(uint event)
+static inline void rfcomm_schedule(void)
 {
         if (!rfcomm_thread)
                 return;
-        //set_bit(event, &rfcomm_event);
         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
         wake_up_process(rfcomm_thread);
 }
@@ -179,13 +181,13 @@ static unsigned char rfcomm_crc_table[256] = {
 /* FCS on 2 bytes */
 static inline u8 __fcs(u8 *data)
 {
-        return (0xff - __crc(data));
+        return 0xff - __crc(data);
 }
 
 /* FCS on 3 bytes */
 static inline u8 __fcs2(u8 *data)
 {
-        return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
+        return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 }
 
 /* Check FCS */
@@ -203,13 +205,13 @@ static inline int __check_fcs(u8 *data, int type, u8 fcs)
 static void rfcomm_l2state_change(struct sock *sk)
 {
         BT_DBG("%p state %d", sk, sk->sk_state);
-        rfcomm_schedule(RFCOMM_SCHED_STATE);
+        rfcomm_schedule();
 }
 
 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 {
         BT_DBG("%p bytes %d", sk, bytes);
-        rfcomm_schedule(RFCOMM_SCHED_RX);
+        rfcomm_schedule();
 }
 
 static int rfcomm_l2sock_create(struct socket **sock)
@@ -230,6 +232,8 @@ static int rfcomm_l2sock_create(struct socket **sock)
 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 {
         struct sock *sk = d->session->sock->sk;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
+
         __u8 auth_type;
 
         switch (d->sec_level) {
@@ -244,8 +248,7 @@ static inline int rfcomm_check_security(struct rfcomm_dlc *d)
                 break;
         }
 
-        return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
-                                                                auth_type);
+        return hci_conn_security(conn->hcon, d->sec_level, auth_type);
 }
 
 static void rfcomm_session_timeout(unsigned long arg)
@@ -255,7 +258,7 @@ static void rfcomm_session_timeout(unsigned long arg)
         BT_DBG("session %p state %ld", s, s->state);
 
         set_bit(RFCOMM_TIMED_OUT, &s->flags);
-        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+        rfcomm_schedule();
 }
 
 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
@@ -283,7 +286,7 @@ static void rfcomm_dlc_timeout(unsigned long arg)
 
         set_bit(RFCOMM_TIMED_OUT, &d->flags);
         rfcomm_dlc_put(d);
-        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+        rfcomm_schedule();
 }
 
 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
@@ -309,6 +312,7 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
         d->state      = BT_OPEN;
         d->flags      = 0;
         d->mscex      = 0;
+        d->sec_level  = BT_SECURITY_LOW;
         d->mtu        = RFCOMM_DEFAULT_MTU;
         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 
@@ -402,7 +406,7 @@ static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst,
 
         s = rfcomm_session_get(src, dst);
         if (!s) {
-                s = rfcomm_session_create(src, dst, &err);
+                s = rfcomm_session_create(src, dst, d->sec_level, &err);
                 if (!s)
                         return err;
         }
@@ -465,7 +469,7 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
         case BT_CONFIG:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-                        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                        rfcomm_schedule();
                         break;
                 }
                 /* Fall through */
@@ -485,7 +489,7 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
         case BT_CONNECT2:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-                        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                        rfcomm_schedule();
                         break;
                 }
                 /* Fall through */
@@ -533,7 +537,7 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
         skb_queue_tail(&d->tx_queue, skb);
 
         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
-                rfcomm_schedule(RFCOMM_SCHED_TX);
+                rfcomm_schedule();
         return len;
 }
 
@@ -545,7 +549,7 @@ void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
                 d->v24_sig |= RFCOMM_V24_FC;
                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
         }
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
 }
 
 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
@@ -556,7 +560,7 @@ void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
                 d->v24_sig &= ~RFCOMM_V24_FC;
                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
         }
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
 }
 
 /*
@@ -577,7 +581,7 @@ int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
         d->v24_sig = v24_sig;
 
         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
-                rfcomm_schedule(RFCOMM_SCHED_TX);
+                rfcomm_schedule();
 
         return 0;
 }
@@ -680,7 +684,10 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         rfcomm_session_put(s);
 }
 
-static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
+                                                        bdaddr_t *dst,
+                                                        u8 sec_level,
+                                                        int *err)
 {
         struct rfcomm_session *s = NULL;
         struct sockaddr_l2 addr;
@@ -704,9 +711,10 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->chan->imtu = l2cap_mtu;
+        l2cap_pi(sk)->chan->sec_level = sec_level;
         if (l2cap_ertm)
-                l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
+                l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
 
         s = rfcomm_session_add(sock, BT_BOUND);
@@ -816,7 +824,7 @@ static int rfcomm_queue_disc(struct rfcomm_dlc *d)
         cmd->fcs  = __fcs2((u8 *) cmd);
 
         skb_queue_tail(&d->tx_queue, skb);
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
         return 0;
 }
 
@@ -1157,7 +1165,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                          * initiator rfcomm_process_rx already calls
                          * rfcomm_session_put() */
                         if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                         break;
                 }
         }
@@ -1233,6 +1242,7 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
 {
         struct sock *sk = d->session->sock->sk;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 
         BT_DBG("dlc %p", d);
 
@@ -1246,7 +1256,7 @@ void rfcomm_dlc_accept(struct rfcomm_dlc *d)
         rfcomm_dlc_unlock(d);
 
         if (d->role_switch)
-                hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
+                hci_conn_switch_role(conn->hcon, 0x00);
 
         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
 }
@@ -1415,8 +1425,8 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
                 return 0;
 
         if (len == 1) {
-                /* This is a request, return default settings */
-                bit_rate  = RFCOMM_RPN_BR_115200;
+                /* This is a request, return default (according to ETSI TS 07.10) settings */
+                bit_rate  = RFCOMM_RPN_BR_9600;
                 data_bits = RFCOMM_RPN_DATA_8;
                 stop_bits = RFCOMM_RPN_STOP_1;
                 parity    = RFCOMM_RPN_PARITY_NONE;
@@ -1431,9 +1441,9 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 
         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
                 bit_rate = rpn->bit_rate;
-                if (bit_rate != RFCOMM_RPN_BR_115200) {
+                if (bit_rate > RFCOMM_RPN_BR_230400) {
                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
-                        bit_rate = RFCOMM_RPN_BR_115200;
+                        bit_rate = RFCOMM_RPN_BR_9600;
                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
                 }
         }
@@ -1698,7 +1708,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
                 break;
 
         default:
-                BT_ERR("Unknown packet type 0x%02x\n", type);
+                BT_ERR("Unknown packet type 0x%02x", type);
                 break;
         }
         kfree_skb(skb);
@@ -1882,9 +1892,10 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
 
                 /* We should adjust MTU on incoming sessions.
                  * L2CAP MTU minus UIH header and FCS. */
-                s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
+                s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
+                                l2cap_pi(nsock->sk)->chan->imtu) - 5;
 
-                rfcomm_schedule(RFCOMM_SCHED_RX);
+                rfcomm_schedule();
         } else
                 sock_release(nsock);
 }
@@ -1895,13 +1906,13 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
 
         BT_DBG("%p state %ld", s, s->state);
 
-        switch(sk->sk_state) {
+        switch (sk->sk_state) {
         case BT_CONNECTED:
                 s->state = BT_CONNECT;
 
                 /* We can adjust MTU on outgoing sessions.
                  * L2CAP MTU minus UIH header and FCS. */
-                s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
+                s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
 
                 rfcomm_send_sabm(s, 0);
                 break;
@@ -1984,7 +1995,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = l2cap_mtu;
+        l2cap_pi(sk)->chan->imtu = l2cap_mtu;
         release_sock(sk);
 
         /* Start listening on the socket */
@@ -2085,7 +2096,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
                         continue;
 
-                if (!status)
+                if (!status && hci_conn_check_secure(conn, d->sec_level))
                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
                 else
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
@@ -2093,7 +2104,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 
         rfcomm_session_put(s);
 
-        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+        rfcomm_schedule();
 }
 
 static struct hci_cb rfcomm_cb = {
@@ -2146,8 +2157,6 @@ static int __init rfcomm_init(void)
 {
         int err;
 
-        l2cap_load();
-
         hci_register_cb(&rfcomm_cb);
 
         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 194b3a04cfd3..1b10727ce523 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -45,7 +45,7 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -140,11 +140,13 @@ static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 /* Find socket with channel and source bdaddr.
  * Returns closest match.
  */
-static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
+static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 {
         struct sock *sk = NULL, *sk1 = NULL;
         struct hlist_node *node;
 
+        read_lock(&rfcomm_sk_list.lock);
+
         sk_for_each(sk, node, &rfcomm_sk_list.head) {
                 if (state && sk->sk_state != state)
                         continue;
@@ -159,19 +161,10 @@ static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t
                                 sk1 = sk;
                 }
         }
-        return node ? sk : sk1;
-}
 
-/* Find socket with given address (channel, src).
- * Returns locked socket */
-static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
-{
-        struct sock *s;
-        read_lock(&rfcomm_sk_list.lock);
-        s = __rfcomm_get_sock_by_channel(state, channel, src);
-        if (s) bh_lock_sock(s);
         read_unlock(&rfcomm_sk_list.lock);
-        return s;
+
+        return node ? sk : sk1;
 }
 
 static void rfcomm_sock_destruct(struct sock *sk)
@@ -621,121 +614,29 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         return sent;
 }
 
-static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
-{
-        DECLARE_WAITQUEUE(wait, current);
-
-        add_wait_queue(sk_sleep(sk), &wait);
-        for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
-                    sk->sk_err ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
-                    signal_pending(current) ||
-                    !timeo)
-                        break;
-
-                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
-                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-        }
-
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
-        return timeo;
-}
-
 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t size, int flags)
 {
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
-        int err = 0;
-        size_t target, copied = 0;
-        long timeo;
+        int len;
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
                 return 0;
         }
 
-        if (flags & MSG_OOB)
-                return -EOPNOTSUPP;
-
-        msg->msg_namelen = 0;
-
-        BT_DBG("sk %p size %zu", sk, size);
+        len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 
         lock_sock(sk);
+        if (!(flags & MSG_PEEK) && len > 0)
+                atomic_sub(len, &sk->sk_rmem_alloc);
 
-        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
-        timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
-
-        do {
-                struct sk_buff *skb;
-                int chunk;
-
-                skb = skb_dequeue(&sk->sk_receive_queue);
-                if (!skb) {
-                        if (copied >= target)
-                                break;
-
-                        if ((err = sock_error(sk)) != 0)
-                                break;
-                        if (sk->sk_shutdown & RCV_SHUTDOWN)
-                                break;
-
-                        err = -EAGAIN;
-                        if (!timeo)
-                                break;
-
-                        timeo = rfcomm_sock_data_wait(sk, timeo);
-
-                        if (signal_pending(current)) {
-                                err = sock_intr_errno(timeo);
-                                goto out;
-                        }
-                        continue;
-                }
-
-                chunk = min_t(unsigned int, skb->len, size);
-                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        if (!copied)
-                                copied = -EFAULT;
-                        break;
-                }
-                copied += chunk;
-                size   -= chunk;
-
-                sock_recv_ts_and_drops(msg, sk, skb);
-
-                if (!(flags & MSG_PEEK)) {
-                        atomic_sub(chunk, &sk->sk_rmem_alloc);
-
-                        skb_pull(skb, chunk);
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                break;
-                        }
-                        kfree_skb(skb);
-
-                } else {
-                        /* put message back and return */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        break;
-                }
-        } while (size);
-
-out:
         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
-
         release_sock(sk);
-        return copied ? : err;
+
+        return len;
 }
 
 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
@@ -842,6 +743,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
         struct sock *sk = sock->sk;
         struct sock *l2cap_sk;
         struct rfcomm_conninfo cinfo;
+        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -886,8 +788,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
 
                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 
-                cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
-                memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
+                memset(&cinfo, 0, sizeof(cinfo));
+                cinfo.hci_handle = conn->hcon->handle;
+                memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 
                 len = min_t(unsigned int, len, sizeof(cinfo));
                 if (copy_to_user(optval, (char *) &cinfo, len))
@@ -987,7 +890,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how)
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
-        if (!sk) return 0;
+        if (!sk)
+                return 0;
 
         lock_sock(sk);
         if (!sk->sk_shutdown) {
@@ -1037,6 +941,8 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
         if (!parent)
                 return 0;
 
+        bh_lock_sock(parent);
+
         /* Check for backlog size */
         if (sk_acceptq_is_full(parent)) {
                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index befc3a52aa04..c258796313e0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -58,9 +58,9 @@ struct rfcomm_dev {
 
         bdaddr_t                src;
         bdaddr_t                dst;
-        u8                      channel;
+        u8                      channel;
 
-        uint                    modem_status;
+        uint                    modem_status;
 
         struct rfcomm_dlc       *dlc;
         struct tty_struct       *tty;
@@ -69,7 +69,7 @@ struct rfcomm_dev {
 
         struct device           *tty_dev;
 
-        atomic_t                wmem_alloc;
+        atomic_t                wmem_alloc;
 
         struct sk_buff_head     pending;
 };
@@ -183,9 +183,7 @@ static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 {
         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &dev->dst);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&dev->dst));
 }
 
 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
@@ -433,7 +431,8 @@ static int rfcomm_release_dev(void __user *arg)
 
         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 
-        if (!(dev = rfcomm_dev_get(req.dev_id)))
+        dev = rfcomm_dev_get(req.dev_id);
+        if (!dev)
                 return -ENODEV;
 
         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
@@ -472,7 +471,8 @@ static int rfcomm_get_dev_list(void __user *arg)
 
         size = sizeof(*dl) + dev_num * sizeof(*di);
 
-        if (!(dl = kmalloc(size, GFP_KERNEL)))
+        dl = kmalloc(size, GFP_KERNEL);
+        if (!dl)
                 return -ENOMEM;
 
         di = dl->dev_info;
@@ -515,7 +515,8 @@ static int rfcomm_get_dev_info(void __user *arg)
         if (copy_from_user(&di, arg, sizeof(di)))
                 return -EFAULT;
 
-        if (!(dev = rfcomm_dev_get(di.id)))
+        dev = rfcomm_dev_get(di.id);
+        if (!dev)
                 return -ENODEV;
 
         di.flags   = dev->flags;
@@ -563,7 +564,8 @@ static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
                 return;
         }
 
-        if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) {
+        tty = dev->tty;
+        if (!tty || !skb_queue_empty(&dev->pending)) {
                 skb_queue_tail(&dev->pending, skb);
                 return;
         }
@@ -725,7 +727,9 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
                         break;
                 }
 
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&dev->wait, &wait);
@@ -798,7 +802,8 @@ static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, in
 
                 memcpy(skb_put(skb, size), buf + sent, size);
 
-                if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
+                err = rfcomm_dlc_send(dlc, skb);
+                if (err < 0) {
                         kfree_skb(skb);
                         break;
                 }
@@ -827,7 +832,7 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
         return room;
 }
 
-static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
+static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 {
         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 
@@ -844,10 +849,6 @@ static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned
                 BT_DBG("TIOCMIWAIT");
                 break;
 
-        case TIOCGICOUNT:
-                BT_DBG("TIOCGICOUNT");
-                break;
-
         case TIOCGSERIAL:
                 BT_ERR("TIOCGSERIAL is not supported");
                 return -ENOIOCTLCMD;
@@ -898,7 +899,7 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 
         /* Parity on/off and when on, odd/even */
         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
-                        ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
+                        ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
                 changes |= RFCOMM_RPN_PM_PARITY;
                 BT_DBG("Parity change detected.");
         }
@@ -943,11 +944,10 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
         /* POSIX does not support 1.5 stop bits and RFCOMM does not
          * support 2 stop bits. So a request for 2 stop bits gets
          * translated to 1.5 stop bits */
-        if (new->c_cflag & CSTOPB) {
+        if (new->c_cflag & CSTOPB)
                 stop_bits = RFCOMM_RPN_STOP_15;
-        } else {
+        else
                 stop_bits = RFCOMM_RPN_STOP_1;
-        }
 
         /* Handle number of data bits [5-8] */
         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
@@ -1091,7 +1091,7 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
         }
 }
 
-static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
+static int rfcomm_tty_tiocmget(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 
@@ -1100,7 +1100,7 @@ static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
         return dev->modem_status;
 }
 
-static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
+static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
         struct rfcomm_dlc *dlc = dev->dlc;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d0927d1fdada..cb4fb7837e5c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -44,15 +44,13 @@
 #include <net/sock.h>
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/sco.h>
 
-#define VERSION "0.6"
-
-static int disable_esco = 0;
+static int disable_esco;
 
 static const struct proto_ops sco_sock_ops;
 
@@ -138,16 +136,17 @@ static inline struct sock *sco_chan_get(struct sco_conn *conn)
 
 static int sco_conn_del(struct hci_conn *hcon, int err)
 {
-        struct sco_conn *conn;
+        struct sco_conn *conn = hcon->sco_data;
         struct sock *sk;
 
-        if (!(conn = hcon->sco_data))
+        if (!conn)
                 return 0;
 
         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 
         /* Kill socket */
-        if ((sk = sco_chan_get(conn))) {
+        sk = sco_chan_get(conn);
+        if (sk) {
                 bh_lock_sock(sk);
                 sco_sock_clear_timer(sk);
                 sco_chan_del(sk, err);
@@ -185,25 +184,27 @@ static int sco_connect(struct sock *sk)
 
         BT_DBG("%s -> %s", batostr(src), batostr(dst));
 
-        if (!(hdev = hci_get_route(dst, src)))
+        hdev = hci_get_route(dst, src);
+        if (!hdev)
                 return -EHOSTUNREACH;
 
         hci_dev_lock_bh(hdev);
 
-        err = -ENOMEM;
-
         if (lmp_esco_capable(hdev) && !disable_esco)
                 type = ESCO_LINK;
         else
                 type = SCO_LINK;
 
         hcon = hci_connect(hdev, type, dst, BT_SECURITY_LOW, HCI_AT_NO_BONDING);
-        if (!hcon)
+        if (IS_ERR(hcon)) {
+                err = PTR_ERR(hcon);
                 goto done;
+        }
 
         conn = sco_conn_add(hcon, 0);
         if (!conn) {
                 hci_conn_put(hcon);
+                err = -ENOMEM;
                 goto done;
         }
 
@@ -368,6 +369,15 @@ static void __sco_sock_close(struct sock *sk)
 
         case BT_CONNECTED:
         case BT_CONFIG:
+                if (sco_pi(sk)->conn) {
+                        sk->sk_state = BT_DISCONN;
+                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
+                        hci_conn_put(sco_pi(sk)->conn->hcon);
+                        sco_pi(sk)->conn->hcon = NULL;
+                } else
+                        sco_chan_del(sk, ECONNRESET);
+                break;
+
         case BT_CONNECT:
         case BT_DISCONN:
                 sco_chan_del(sk, ECONNRESET);
@@ -510,7 +520,8 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
         /* Set destination address and psm */
         bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
 
-        if ((err = sco_connect(sk)))
+        err = sco_connect(sk);
+        if (err)
                 goto done;
 
         err = bt_sock_wait_state(sk, BT_CONNECTED,
@@ -700,6 +711,7 @@ static int sco_sock_getsockopt_old(struct socket *sock, int optname, char __user
                         break;
                 }
 
+                memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
                 memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 
@@ -816,7 +828,9 @@ static void sco_chan_del(struct sock *sk, int err)
                 conn->sk = NULL;
                 sco_pi(sk)->conn = NULL;
                 sco_conn_unlock(conn);
-                hci_conn_put(conn->hcon);
+
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
         }
 
         sk->sk_state = BT_CLOSED;
@@ -828,13 +842,14 @@ static void sco_chan_del(struct sock *sk, int err)
 
 static void sco_conn_ready(struct sco_conn *conn)
 {
-        struct sock *parent, *sk;
+        struct sock *parent;
+        struct sock *sk = conn->sk;
 
         BT_DBG("conn %p", conn);
 
         sco_conn_lock(conn);
 
-        if ((sk = conn->sk)) {
+        if (sk) {
                 sco_sock_clear_timer(sk);
                 bh_lock_sock(sk);
                 sk->sk_state = BT_CONNECTED;
@@ -882,7 +897,7 @@ static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
         int lm = 0;
 
         if (type != SCO_LINK && type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
 
@@ -908,7 +923,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         if (!status) {
                 struct sco_conn *conn;
@@ -927,7 +942,7 @@ static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
         BT_DBG("hcon %p reason %d", hcon, reason);
 
         if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-                return 0;
+                return -EINVAL;
 
         sco_conn_del(hcon, bt_err(reason));
 
@@ -1019,7 +1034,7 @@ static struct hci_proto sco_hci_proto = {
         .recv_scodata   = sco_recv_scodata
 };
 
-static int __init sco_init(void)
+int __init sco_init(void)
 {
         int err;
 
@@ -1047,7 +1062,6 @@ static int __init sco_init(void)
                         BT_ERR("Failed to create SCO debug file");
         }
 
-        BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
 
         return 0;
@@ -1057,7 +1071,7 @@ error:
         return err;
 }
 
-static void __exit sco_exit(void)
+void __exit sco_exit(void)
 {
         debugfs_remove(sco_debugfs);
 
@@ -1070,14 +1084,5 @@ static void __exit sco_exit(void)
         proto_unregister(&sco_proto);
 }
 
-module_init(sco_init);
-module_exit(sco_exit);
-
 module_param(disable_esco, bool, 0644);
 MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
-
-MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
-MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
-MODULE_VERSION(VERSION);
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("bt-proto-2");