Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1699 commits)
  bnx2/bnx2x: Unsupported Ethtool operations should return -EINVAL.
  vlan: Calling vlan_hwaccel_do_receive() is always valid.
  tproxy: use the interface primary IP address as a default value for --on-ip
  tproxy: added IPv6 support to the socket match
  cxgb3: function namespace cleanup
  tproxy: added IPv6 support to the TPROXY target
  tproxy: added IPv6 socket lookup function to nf_tproxy_core
  be2net: Changes to use only priority codes allowed by f/w
  tproxy: allow non-local binds of IPv6 sockets if IP_TRANSPARENT is enabled
  tproxy: added tproxy sockopt interface in the IPV6 layer
  tproxy: added udp6_lib_lookup function
  tproxy: added const specifiers to udp lookup functions
  tproxy: split off ipv6 defragmentation to a separate module
  l2tp: small cleanup
  nf_nat: restrict ICMP translation for embedded header
  can: mcp251x: fix generation of error frames
  can: mcp251x: fix endless loop in interrupt handler if CANINTF_MERRF is set
  can-raw: add msg_flags to distinguish local traffic
  9p: client code cleanup
  rds: make local functions/variables static
  ...

Fix up conflicts in net/core/dev.c, drivers/net/pcmcia/smc91c92_cs.c and
drivers/net/wireless/ath/ath9k/debug.c as per David

10 files changed, 199 insertions, 166 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 421c45bd1b95..c4cf3f595004 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -265,6 +265,115 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 }
 EXPORT_SYMBOL(bt_sock_recvmsg);
 
+static long bt_sock_data_wait(struct sock *sk, long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+
+        add_wait_queue(sk_sleep(sk), &wait);
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (!skb_queue_empty(&sk->sk_receive_queue))
+                        break;
+
+                if (sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN))
+                        break;
+
+                if (signal_pending(current) || !timeo)
+                        break;
+
+                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return timeo;
+}
+
+int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+                               struct msghdr *msg, size_t size, int flags)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+        size_t target, copied = 0;
+        long timeo;
+
+        if (flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        msg->msg_namelen = 0;
+
+        BT_DBG("sk %p size %zu", sk, size);
+
+        lock_sock(sk);
+
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
+        timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+
+        do {
+                struct sk_buff *skb;
+                int chunk;
+
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                if (!skb) {
+                        if (copied >= target)
+                                break;
+
+                        if ((err = sock_error(sk)) != 0)
+                                break;
+                        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                                break;
+
+                        err = -EAGAIN;
+                        if (!timeo)
+                                break;
+
+                        timeo = bt_sock_data_wait(sk, timeo);
+
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeo);
+                                goto out;
+                        }
+                        continue;
+                }
+
+                chunk = min_t(unsigned int, skb->len, size);
+                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        if (!copied)
+                                copied = -EFAULT;
+                        break;
+                }
+                copied += chunk;
+                size   -= chunk;
+
+                sock_recv_ts_and_drops(msg, sk, skb);
+
+                if (!(flags & MSG_PEEK)) {
+                        skb_pull(skb, chunk);
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                break;
+                        }
+                        kfree_skb(skb);
+
+                } else {
+                        /* put message back and return */
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        break;
+                }
+        } while (size);
+
+out:
+        release_sock(sk);
+        return copied ? : err;
+}
+EXPORT_SYMBOL(bt_sock_stream_recvmsg);
+
 static inline unsigned int bt_accept_poll(struct sock *parent)
 {
         struct list_head *p, *n;
@@ -297,13 +406,12 @@ unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *w
                 mask |= POLLERR;
 
         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLRDHUP;
+                mask |= POLLRDHUP | POLLIN | POLLRDNORM;
 
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= POLLHUP;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
-                        (sk->sk_shutdown & RCV_SHUTDOWN))
+        if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
 
         if (sk->sk_state == BT_CLOSED)
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index d4c6af082d48..ec0a1347f933 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -321,14 +321,10 @@ static int cmtp_session(void *arg)
 int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 {
         struct cmtp_session *session, *s;
-        bdaddr_t src, dst;
         int i, err;
 
         BT_DBG("");
 
-        baswap(&src, &bt_sk(sock->sk)->src);
-        baswap(&dst, &bt_sk(sock->sk)->dst);
-
         session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
         if (!session)
                 return -ENOMEM;
@@ -347,7 +343,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         BT_DBG("mtu %d", session->mtu);
 
-        sprintf(session->name, "%s", batostr(&dst));
+        sprintf(session->name, "%s", batostr(&bt_sk(sock->sk)->dst));
 
         session->sock  = sock;
         session->state = BT_CONFIG;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c52f091ee6de..bc2a052e518b 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -562,7 +562,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hci_dev_lock_bh(hdev);
         inquiry_cache_flush(hdev);
         hci_conn_hash_flush(hdev);
-        hci_blacklist_clear(hdev);
         hci_dev_unlock_bh(hdev);
 
         hci_notify(hdev, HCI_DEV_DOWN);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 8fb967beee80..5fce3d6d07b4 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -37,9 +37,7 @@ static ssize_t show_link_type(struct device *dev, struct device_attribute *attr,
 static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_conn *conn = dev_get_drvdata(dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &conn->dst);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&conn->dst));
 }
 
 static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
@@ -196,8 +194,8 @@ static inline char *host_typetostr(int type)
         switch (type) {
         case HCI_BREDR:
                 return "BR/EDR";
-        case HCI_80211:
-                return "802.11";
+        case HCI_AMP:
+                return "AMP";
         default:
                 return "UNKNOWN";
         }
@@ -238,9 +236,7 @@ static ssize_t show_class(struct device *dev, struct device_attribute *attr, cha
 static ssize_t show_address(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct hci_dev *hdev = dev_get_drvdata(dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &hdev->bdaddr);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&hdev->bdaddr));
 }
 
 static ssize_t show_features(struct device *dev, struct device_attribute *attr, char *buf)
@@ -408,10 +404,8 @@ static int inquiry_cache_show(struct seq_file *f, void *p)
 
         for (e = cache->list; e; e = e->next) {
                 struct inquiry_data *data = &e->data;
-                bdaddr_t bdaddr;
-                baswap(&bdaddr, &data->bdaddr);
                 seq_printf(f, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
-                           batostr(&bdaddr),
+                           batostr(&data->bdaddr),
                            data->pscan_rep_mode, data->pscan_period_mode,
                            data->pscan_mode, data->dev_class[2],
                            data->dev_class[1], data->dev_class[0],
@@ -445,13 +439,10 @@ static int blacklist_show(struct seq_file *f, void *p)
 
         list_for_each(l, &hdev->blacklist) {
                 struct bdaddr_list *b;
-                bdaddr_t bdaddr;
 
                 b = list_entry(l, struct bdaddr_list, list);
 
-                baswap(&bdaddr, &b->bdaddr);
-
-                seq_printf(f, "%s\n", batostr(&bdaddr));
+                seq_printf(f, "%s\n", batostr(&b->bdaddr));
         }
 
         hci_dev_unlock_bh(hdev);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index bfe641b7dfaf..c0ee8b3928ed 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -758,7 +758,6 @@ static int hidp_setup_hid(struct hidp_session *session,
                                 struct hidp_connadd_req *req)
 {
         struct hid_device *hid;
-        bdaddr_t src, dst;
         int err;
 
         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
@@ -781,9 +780,6 @@ static int hidp_setup_hid(struct hidp_session *session,
 
         hid->driver_data = session;
 
-        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
-        baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
-
         hid->bus     = BUS_BLUETOOTH;
         hid->vendor  = req->vendor;
         hid->product = req->product;
@@ -791,8 +787,8 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->country = req->country;
 
         strncpy(hid->name, req->name, 128);
-        strncpy(hid->phys, batostr(&src), 64);
-        strncpy(hid->uniq, batostr(&dst), 64);
+        strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
+        strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
 
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 0b54b7dd8401..daa7a988d9a6 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1008,10 +1008,20 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 goto done;
         }
 
-        if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
-                                !capable(CAP_NET_BIND_SERVICE)) {
-                err = -EACCES;
-                goto done;
+        if (la.l2_psm) {
+                __u16 psm = __le16_to_cpu(la.l2_psm);
+
+                /* PSM must be odd and lsb of upper byte must be 0 */
+                if ((psm & 0x0101) != 0x0001) {
+                        err = -EINVAL;
+                        goto done;
+                }
+
+                /* Restrict usage of well-known PSMs */
+                if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
+                        err = -EACCES;
+                        goto done;
+                }
         }
 
         write_lock_bh(&l2cap_sk_list.lock);
@@ -1190,6 +1200,13 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
                 goto done;
         }
 
+        /* PSM must be odd and lsb of upper byte must be 0 */
+        if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
+                sk->sk_type != SOCK_RAW) {
+                err = -EINVAL;
+                goto done;
+        }
+
         /* Set destination address and psm */
         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
         l2cap_pi(sk)->psm = la.l2_psm;
@@ -1635,7 +1652,7 @@ static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, in
 
                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
                 if (!*frag)
-                        return -EFAULT;
+                        return err;
                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
                         return -EFAULT;
 
@@ -1661,7 +1678,7 @@ static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr
         skb = bt_skb_send_alloc(sk, count + hlen,
                         msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return ERR_PTR(-ENOMEM);
+                return ERR_PTR(err);
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1690,7 +1707,7 @@ static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *ms
         skb = bt_skb_send_alloc(sk, count + hlen,
                         msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return ERR_PTR(-ENOMEM);
+                return ERR_PTR(err);
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1727,7 +1744,7 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *m
         skb = bt_skb_send_alloc(sk, count + hlen,
                         msg->msg_flags & MSG_DONTWAIT, &err);
         if (!skb)
-                return ERR_PTR(-ENOMEM);
+                return ERR_PTR(err);
 
         /* Create L2CAP header */
         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
@@ -1934,6 +1951,9 @@ static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct ms
 
         release_sock(sk);
 
+        if (sock->type == SOCK_STREAM)
+                return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
+
         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 }
 
@@ -2891,7 +2911,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         struct l2cap_chan_list *list = &conn->chan_list;
         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
         struct l2cap_conn_rsp rsp;
-        struct sock *parent, *uninitialized_var(sk);
+        struct sock *parent, *sk = NULL;
         int result, status = L2CAP_CS_NO_INFO;
 
         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
@@ -3000,7 +3020,7 @@ sendresp:
                                         L2CAP_INFO_REQ, sizeof(info), &info);
         }
 
-        if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
+        if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
                                 result == L2CAP_CR_SUCCESS) {
                 u8 buf[128];
                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
@@ -3151,6 +3171,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
                 u8 buf[64];
+                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                                         l2cap_build_conf_req(sk, buf), buf);
                 l2cap_pi(sk)->num_conf_req++;
@@ -4643,6 +4664,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
 
         if (flags & ACL_START) {
                 struct l2cap_hdr *hdr;
+                struct sock *sk;
+                u16 cid;
                 int len;
 
                 if (conn->rx_len) {
@@ -4653,7 +4676,8 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                         l2cap_conn_unreliable(conn, ECOMM);
                 }
 
-                if (skb->len < 2) {
+                /* Start fragment always begin with Basic L2CAP header */
+                if (skb->len < L2CAP_HDR_SIZE) {
                         BT_ERR("Frame is too short (len %d)", skb->len);
                         l2cap_conn_unreliable(conn, ECOMM);
                         goto drop;
@@ -4661,6 +4685,7 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
 
                 hdr = (struct l2cap_hdr *) skb->data;
                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
+                cid = __le16_to_cpu(hdr->cid);
 
                 if (len == skb->len) {
                         /* Complete frame received */
@@ -4677,6 +4702,19 @@ static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 fl
                         goto drop;
                 }
 
+                sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
+
+                if (sk && l2cap_pi(sk)->imtu < len - L2CAP_HDR_SIZE) {
+                        BT_ERR("Frame exceeding recv MTU (len %d, MTU %d)",
+                                        len, l2cap_pi(sk)->imtu);
+                        bh_unlock_sock(sk);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                if (sk)
+                        bh_unlock_sock(sk);
+
                 /* Allocate skb for the complete frame (with header) */
                 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
                 if (!conn->rx_skb)
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index ad2af5814e40..b826d1bf10df 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -51,8 +51,8 @@ char *batostr(bdaddr_t *ba)
 
         i ^= 1;
         sprintf(str[i], "%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X",
-                ba->b[0], ba->b[1], ba->b[2],
-                ba->b[3], ba->b[4], ba->b[5]);
+                ba->b[5], ba->b[4], ba->b[3],
+                ba->b[2], ba->b[1], ba->b[0]);
 
         return str[i];
 }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 7dca91bb8c57..39a5d87e33b4 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -113,11 +113,10 @@ static void rfcomm_session_del(struct rfcomm_session *s);
 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 
-static inline void rfcomm_schedule(uint event)
+static inline void rfcomm_schedule(void)
 {
         if (!rfcomm_thread)
                 return;
-        //set_bit(event, &rfcomm_event);
         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
         wake_up_process(rfcomm_thread);
 }
@@ -179,13 +178,13 @@ static unsigned char rfcomm_crc_table[256] = {
 /* FCS on 2 bytes */
 static inline u8 __fcs(u8 *data)
 {
-        return (0xff - __crc(data));
+        return 0xff - __crc(data);
 }
 
 /* FCS on 3 bytes */
 static inline u8 __fcs2(u8 *data)
 {
-        return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
+        return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 }
 
 /* Check FCS */
@@ -203,13 +202,13 @@ static inline int __check_fcs(u8 *data, int type, u8 fcs)
 static void rfcomm_l2state_change(struct sock *sk)
 {
         BT_DBG("%p state %d", sk, sk->sk_state);
-        rfcomm_schedule(RFCOMM_SCHED_STATE);
+        rfcomm_schedule();
 }
 
 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 {
         BT_DBG("%p bytes %d", sk, bytes);
-        rfcomm_schedule(RFCOMM_SCHED_RX);
+        rfcomm_schedule();
 }
 
 static int rfcomm_l2sock_create(struct socket **sock)
@@ -255,7 +254,7 @@ static void rfcomm_session_timeout(unsigned long arg)
         BT_DBG("session %p state %ld", s, s->state);
 
         set_bit(RFCOMM_TIMED_OUT, &s->flags);
-        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+        rfcomm_schedule();
 }
 
 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
@@ -283,7 +282,7 @@ static void rfcomm_dlc_timeout(unsigned long arg)
 
         set_bit(RFCOMM_TIMED_OUT, &d->flags);
         rfcomm_dlc_put(d);
-        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+        rfcomm_schedule();
 }
 
 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
@@ -465,7 +464,7 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
         case BT_CONFIG:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-                        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                        rfcomm_schedule();
                         break;
                 }
                 /* Fall through */
@@ -485,7 +484,7 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
         case BT_CONNECT2:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
-                        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+                        rfcomm_schedule();
                         break;
                 }
                 /* Fall through */
@@ -533,7 +532,7 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
         skb_queue_tail(&d->tx_queue, skb);
 
         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
-                rfcomm_schedule(RFCOMM_SCHED_TX);
+                rfcomm_schedule();
         return len;
 }
 
@@ -545,7 +544,7 @@ void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
                 d->v24_sig |= RFCOMM_V24_FC;
                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
         }
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
 }
 
 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
@@ -556,7 +555,7 @@ void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
                 d->v24_sig &= ~RFCOMM_V24_FC;
                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
         }
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
 }
 
 /*
@@ -577,7 +576,7 @@ int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
         d->v24_sig = v24_sig;
 
         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
-                rfcomm_schedule(RFCOMM_SCHED_TX);
+                rfcomm_schedule();
 
         return 0;
 }
@@ -816,7 +815,7 @@ static int rfcomm_queue_disc(struct rfcomm_dlc *d)
         cmd->fcs  = __fcs2((u8 *) cmd);
 
         skb_queue_tail(&d->tx_queue, skb);
-        rfcomm_schedule(RFCOMM_SCHED_TX);
+        rfcomm_schedule();
         return 0;
 }
 
@@ -1415,8 +1414,8 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
                 return 0;
 
         if (len == 1) {
-                /* This is a request, return default settings */
-                bit_rate  = RFCOMM_RPN_BR_115200;
+                /* This is a request, return default (according to ETSI TS 07.10) settings */
+                bit_rate  = RFCOMM_RPN_BR_9600;
                 data_bits = RFCOMM_RPN_DATA_8;
                 stop_bits = RFCOMM_RPN_STOP_1;
                 parity    = RFCOMM_RPN_PARITY_NONE;
@@ -1431,9 +1430,9 @@ static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_
 
         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
                 bit_rate = rpn->bit_rate;
-                if (bit_rate != RFCOMM_RPN_BR_115200) {
+                if (bit_rate > RFCOMM_RPN_BR_230400) {
                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
-                        bit_rate = RFCOMM_RPN_BR_115200;
+                        bit_rate = RFCOMM_RPN_BR_9600;
                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
                 }
         }
@@ -1698,7 +1697,7 @@ static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
                 break;
 
         default:
-                BT_ERR("Unknown packet type 0x%02x\n", type);
+                BT_ERR("Unknown packet type 0x%02x", type);
                 break;
         }
         kfree_skb(skb);
@@ -1884,7 +1883,7 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
                  * L2CAP MTU minus UIH header and FCS. */
                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
 
-                rfcomm_schedule(RFCOMM_SCHED_RX);
+                rfcomm_schedule();
         } else
                 sock_release(nsock);
 }
@@ -2093,7 +2092,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 
         rfcomm_session_put(s);
 
-        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+        rfcomm_schedule();
 }
 
 static struct hci_cb rfcomm_cb = {
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 194b3a04cfd3..aec505f934df 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -621,121 +621,29 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         return sent;
 }
 
-static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
-{
-        DECLARE_WAITQUEUE(wait, current);
-
-        add_wait_queue(sk_sleep(sk), &wait);
-        for (;;) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
-                    sk->sk_err ||
-                    (sk->sk_shutdown & RCV_SHUTDOWN) ||
-                    signal_pending(current) ||
-                    !timeo)
-                        break;
-
-                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
-                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-        }
-
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_sleep(sk), &wait);
-        return timeo;
-}
-
 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t size, int flags)
 {
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
-        int err = 0;
-        size_t target, copied = 0;
-        long timeo;
+        int len;
 
         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                 rfcomm_dlc_accept(d);
                 return 0;
         }
 
-        if (flags & MSG_OOB)
-                return -EOPNOTSUPP;
-
-        msg->msg_namelen = 0;
-
-        BT_DBG("sk %p size %zu", sk, size);
+        len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 
         lock_sock(sk);
+        if (!(flags & MSG_PEEK) && len > 0)
+                atomic_sub(len, &sk->sk_rmem_alloc);
 
-        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
-        timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
-
-        do {
-                struct sk_buff *skb;
-                int chunk;
-
-                skb = skb_dequeue(&sk->sk_receive_queue);
-                if (!skb) {
-                        if (copied >= target)
-                                break;
-
-                        if ((err = sock_error(sk)) != 0)
-                                break;
-                        if (sk->sk_shutdown & RCV_SHUTDOWN)
-                                break;
-
-                        err = -EAGAIN;
-                        if (!timeo)
-                                break;
-
-                        timeo = rfcomm_sock_data_wait(sk, timeo);
-
-                        if (signal_pending(current)) {
-                                err = sock_intr_errno(timeo);
-                                goto out;
-                        }
-                        continue;
-                }
-
-                chunk = min_t(unsigned int, skb->len, size);
-                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        if (!copied)
-                                copied = -EFAULT;
-                        break;
-                }
-                copied += chunk;
-                size   -= chunk;
-
-                sock_recv_ts_and_drops(msg, sk, skb);
-
-                if (!(flags & MSG_PEEK)) {
-                        atomic_sub(chunk, &sk->sk_rmem_alloc);
-
-                        skb_pull(skb, chunk);
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                break;
-                        }
-                        kfree_skb(skb);
-
-                } else {
-                        /* put message back and return */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        break;
-                }
-        } while (size);
-
-out:
         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
-
         release_sock(sk);
-        return copied ? : err;
+
+        return len;
 }
 
 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 84c2a4d013c6..a9b81f5dacd1 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -183,9 +183,7 @@ static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 {
         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
-        bdaddr_t bdaddr;
-        baswap(&bdaddr, &dev->dst);
-        return sprintf(buf, "%s\n", batostr(&bdaddr));
+        return sprintf(buf, "%s\n", batostr(&dev->dst));
 }
 
 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)