5 files changed, 539 insertions, 111 deletions

diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index e86af08293a8..835f3b229b84 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -77,6 +77,33 @@ struct bt_power {
 #define BT_POWER_FORCE_ACTIVE_OFF 0
 #define BT_POWER_FORCE_ACTIVE_ON  1
 
+#define BT_CHANNEL_POLICY       10
+
+/* BR/EDR only (default policy)
+ *   AMP controllers cannot be used.
+ *   Channel move requests from the remote device are denied.
+ *   If the L2CAP channel is currently using AMP, move the channel to BR/EDR.
+ */
+#define BT_CHANNEL_POLICY_BREDR_ONLY            0
+
+/* BR/EDR Preferred
+ *   Allow use of AMP controllers.
+ *   If the L2CAP channel is currently on AMP, move it to BR/EDR.
+ *   Channel move requests from the remote device are allowed.
+ */
+#define BT_CHANNEL_POLICY_BREDR_PREFERRED       1
+
+/* AMP Preferred
+ *   Allow use of AMP controllers
+ *   If the L2CAP channel is currently on BR/EDR and AMP controller
+ *     resources are available, initiate a channel move to AMP.
+ *   Channel move requests from the remote device are allowed.
+ *   If the L2CAP socket has not been connected yet, try to create
+ *     and configure the channel directly on an AMP controller rather
+ *     than BR/EDR.
+ */
+#define BT_CHANNEL_POLICY_AMP_PREFERRED         2
+
 __printf(2, 3)
 int bt_printk(const char *level, const char *fmt, ...);
 
@@ -158,7 +185,7 @@ struct bt_skb_cb {
         __u8 pkt_type;
         __u8 incoming;
         __u16 expect;
-        __u8 tx_seq;
+        __u16 tx_seq;
         __u8 retries;
         __u8 sar;
         unsigned short channel;
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index aaf79af72432..139ce2aa6eee 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -264,6 +264,13 @@ enum {
 #define HCI_LK_SMP_IRK                  0x82
 #define HCI_LK_SMP_CSRK                 0x83
 
+/* ---- HCI Error Codes ---- */
+#define HCI_ERROR_AUTH_FAILURE          0x05
+#define HCI_ERROR_REJ_BAD_ADDR          0x0f
+#define HCI_ERROR_REMOTE_USER_TERM      0x13
+#define HCI_ERROR_LOCAL_HOST_TERM       0x16
+#define HCI_ERROR_PAIRING_NOT_ALLOWED   0x18
+
 /* -----  HCI Commands ---- */
 #define HCI_OP_NOP                      0x0000
 
@@ -726,6 +733,21 @@ struct hci_cp_write_page_scan_activity {
         #define PAGE_SCAN_TYPE_STANDARD         0x00
         #define PAGE_SCAN_TYPE_INTERLACED       0x01
 
+#define HCI_OP_READ_LOCAL_AMP_INFO      0x1409
+struct hci_rp_read_local_amp_info {
+        __u8     status;
+        __u8     amp_status;
+        __le32   total_bw;
+        __le32   max_bw;
+        __le32   min_latency;
+        __le32   max_pdu;
+        __u8     amp_type;
+        __le16   pal_cap;
+        __le16   max_assoc_size;
+        __le32   max_flush_to;
+        __le32   be_flush_to;
+} __packed;
+
 #define HCI_OP_LE_SET_EVENT_MASK        0x2001
 struct hci_cp_le_set_event_mask {
         __u8     mask[8];
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 3779ea362257..f333e7682607 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -32,6 +32,9 @@
 #define HCI_PROTO_L2CAP 0
 #define HCI_PROTO_SCO   1
 
+/* HCI priority */
+#define HCI_PRIO_MAX    7
+
 /* HCI Core structures */
 struct inquiry_data {
         bdaddr_t        bdaddr;
@@ -64,6 +67,12 @@ struct hci_conn_hash {
         unsigned int     le_num;
 };
 
+struct hci_chan_hash {
+        struct list_head list;
+        spinlock_t       lock;
+        unsigned int     num;
+};
+
 struct bdaddr_list {
         struct list_head list;
         bdaddr_t bdaddr;
@@ -150,6 +159,17 @@ struct hci_dev {
         __u16           sniff_min_interval;
         __u16           sniff_max_interval;
 
+        __u8            amp_status;
+        __u32           amp_total_bw;
+        __u32           amp_max_bw;
+        __u32           amp_min_latency;
+        __u32           amp_max_pdu;
+        __u8            amp_type;
+        __u16           amp_pal_cap;
+        __u16           amp_assoc_size;
+        __u32           amp_max_flush_to;
+        __u32           amp_be_flush_to;
+
         unsigned int    auto_accept_delay;
 
         unsigned long   quirks;
@@ -173,8 +193,10 @@ struct hci_dev {
         struct workqueue_struct *workqueue;
 
         struct work_struct      power_on;
-        struct work_struct      power_off;
-        struct timer_list       off_timer;
+        struct delayed_work     power_off;
+
+        __u16                   discov_timeout;
+        struct delayed_work     discov_off;
 
         struct timer_list       cmd_timer;
         struct tasklet_struct   cmd_task;
@@ -195,6 +217,8 @@ struct hci_dev {
 
         __u16                   init_last_cmd;
 
+        struct list_head        mgmt_pending;
+
         struct inquiry_cache    inq_cache;
         struct hci_conn_hash    conn_hash;
         struct list_head        blacklist;
@@ -273,6 +297,7 @@ struct hci_conn {
         unsigned int    sent;
 
         struct sk_buff_head data_q;
+        struct hci_chan_hash chan_hash;
 
         struct timer_list disc_timer;
         struct timer_list idle_timer;
@@ -295,6 +320,14 @@ struct hci_conn {
         void (*disconn_cfm_cb)  (struct hci_conn *conn, u8 reason);
 };
 
+struct hci_chan {
+        struct list_head list;
+
+        struct hci_conn *conn;
+        struct sk_buff_head data_q;
+        unsigned int    sent;
+};
+
 extern struct hci_proto *hci_proto[];
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
@@ -455,6 +488,28 @@ static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
         return NULL;
 }
 
+static inline void hci_chan_hash_init(struct hci_conn *c)
+{
+        struct hci_chan_hash *h = &c->chan_hash;
+        INIT_LIST_HEAD(&h->list);
+        spin_lock_init(&h->lock);
+        h->num = 0;
+}
+
+static inline void hci_chan_hash_add(struct hci_conn *c, struct hci_chan *chan)
+{
+        struct hci_chan_hash *h = &c->chan_hash;
+        list_add(&chan->list, &h->list);
+        h->num++;
+}
+
+static inline void hci_chan_hash_del(struct hci_conn *c, struct hci_chan *chan)
+{
+        struct hci_chan_hash *h = &c->chan_hash;
+        list_del(&chan->list);
+        h->num--;
+}
+
 void hci_acl_connect(struct hci_conn *conn);
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
 void hci_add_sco(struct hci_conn *conn, __u16 handle);
@@ -466,6 +521,10 @@ int hci_conn_del(struct hci_conn *conn);
 void hci_conn_hash_flush(struct hci_dev *hdev);
 void hci_conn_check_pending(struct hci_dev *hdev);
 
+struct hci_chan *hci_chan_create(struct hci_conn *conn);
+int hci_chan_del(struct hci_chan *chan);
+void hci_chan_hash_flush(struct hci_conn *conn);
+
 struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                                 __u8 sec_level, __u8 auth_type);
 int hci_conn_check_link_mode(struct hci_conn *conn);
@@ -545,7 +604,7 @@ struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
 struct hci_dev *hci_alloc_dev(void);
 void hci_free_dev(struct hci_dev *hdev);
 int hci_register_dev(struct hci_dev *hdev);
-int hci_unregister_dev(struct hci_dev *hdev);
+void hci_unregister_dev(struct hci_dev *hdev);
 int hci_suspend_dev(struct hci_dev *hdev);
 int hci_resume_dev(struct hci_dev *hdev);
 int hci_dev_open(__u16 dev);
@@ -599,8 +658,9 @@ int hci_recv_frame(struct sk_buff *skb);
 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count);
 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count);
 
-int hci_register_sysfs(struct hci_dev *hdev);
-void hci_unregister_sysfs(struct hci_dev *hdev);
+void hci_init_sysfs(struct hci_dev *hdev);
+int hci_add_sysfs(struct hci_dev *hdev);
+void hci_del_sysfs(struct hci_dev *hdev);
 void hci_conn_init_sysfs(struct hci_conn *conn);
 void hci_conn_add_sysfs(struct hci_conn *conn);
 void hci_conn_del_sysfs(struct hci_conn *conn);
@@ -676,7 +736,7 @@ static inline void hci_proto_connect_cfm(struct hci_conn *conn, __u8 status)
 static inline int hci_proto_disconn_ind(struct hci_conn *conn)
 {
         register struct hci_proto *hp;
-        int reason = 0x13;
+        int reason = HCI_ERROR_REMOTE_USER_TERM;
 
         hp = hci_proto[HCI_PROTO_L2CAP];
         if (hp && hp->disconn_ind)
@@ -836,7 +896,7 @@ int hci_register_notifier(struct notifier_block *nb);
 int hci_unregister_notifier(struct notifier_block *nb);
 
 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param);
-void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
+void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags);
 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
 
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode);
@@ -849,34 +909,41 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
 
 /* Management interface */
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t len);
-int mgmt_index_added(u16 index);
-int mgmt_index_removed(u16 index);
-int mgmt_powered(u16 index, u8 powered);
-int mgmt_discoverable(u16 index, u8 discoverable);
-int mgmt_connectable(u16 index, u8 connectable);
-int mgmt_new_key(u16 index, struct link_key *key, u8 persistent);
-int mgmt_connected(u16 index, bdaddr_t *bdaddr, u8 link_type);
-int mgmt_disconnected(u16 index, bdaddr_t *bdaddr);
-int mgmt_disconnect_failed(u16 index);
-int mgmt_connect_failed(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_pin_code_request(u16 index, bdaddr_t *bdaddr, u8 secure);
-int mgmt_pin_code_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_pin_code_neg_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_user_confirm_request(u16 index, bdaddr_t *bdaddr, __le32 value,
-                                                        u8 confirm_hint);
-int mgmt_user_confirm_reply_complete(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_user_confirm_neg_reply_complete(u16 index, bdaddr_t *bdaddr,
+int mgmt_index_added(struct hci_dev *hdev);
+int mgmt_index_removed(struct hci_dev *hdev);
+int mgmt_powered(struct hci_dev *hdev, u8 powered);
+int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
+int mgmt_connectable(struct hci_dev *hdev, u8 connectable);
+int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
+int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
+                                                                u8 persistent);
+int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type);
+int mgmt_disconnect_failed(struct hci_dev *hdev);
+int mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
                                                                 u8 status);
-int mgmt_auth_failed(u16 index, bdaddr_t *bdaddr, u8 status);
-int mgmt_set_local_name_complete(u16 index, u8 *name, u8 status);
-int mgmt_read_local_oob_data_reply_complete(u16 index, u8 *hash, u8 *randomizer,
+int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure);
+int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                                 u8 status);
-int mgmt_device_found(u16 index, bdaddr_t *bdaddr, u8 *dev_class, s8 rssi,
-                                                                u8 *eir);
-int mgmt_remote_name(u16 index, bdaddr_t *bdaddr, u8 *name);
-int mgmt_discovering(u16 index, u8 discovering);
-int mgmt_device_blocked(u16 index, bdaddr_t *bdaddr);
-int mgmt_device_unblocked(u16 index, bdaddr_t *bdaddr);
+int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                u8 status);
+int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                __le32 value, u8 confirm_hint);
+int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                                u8 status);
+int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
+                                                bdaddr_t *bdaddr, u8 status);
+int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status);
+int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status);
+int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
+                                                u8 *randomizer, u8 status);
+int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type,
+                                        u8 *dev_class, s8 rssi, u8 *eir);
+int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name);
+int mgmt_inquiry_failed(struct hci_dev *hdev, u8 status);
+int mgmt_discovering(struct hci_dev *hdev, u8 discovering);
+int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr);
+int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
 /* HCI info for socket */
 #define hci_pi(sk) ((struct hci_pinfo *) sk)
@@ -915,4 +982,7 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
 void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
 void hci_le_ltk_neg_reply(struct hci_conn *conn);
 
+int hci_do_inquiry(struct hci_dev *hdev, u8 length);
+int hci_cancel_inquiry(struct hci_dev *hdev);
+
 #endif /* __HCI_CORE_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index ab90ae0970a6..875021ad0675 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -27,20 +27,29 @@
 #ifndef __L2CAP_H
 #define __L2CAP_H
 
+#include <asm/unaligned.h>
+
 /* L2CAP defaults */
 #define L2CAP_DEFAULT_MTU               672
 #define L2CAP_DEFAULT_MIN_MTU           48
 #define L2CAP_DEFAULT_FLUSH_TO          0xffff
 #define L2CAP_DEFAULT_TX_WINDOW         63
+#define L2CAP_DEFAULT_EXT_WINDOW        0x3FFF
 #define L2CAP_DEFAULT_MAX_TX            3
 #define L2CAP_DEFAULT_RETRANS_TO        2000    /* 2 seconds */
 #define L2CAP_DEFAULT_MONITOR_TO        12000   /* 12 seconds */
 #define L2CAP_DEFAULT_MAX_PDU_SIZE      1009    /* Sized for 3-DH5 packet */
 #define L2CAP_DEFAULT_ACK_TO            200
 #define L2CAP_LE_DEFAULT_MTU            23
+#define L2CAP_DEFAULT_MAX_SDU_SIZE      0xFFFF
+#define L2CAP_DEFAULT_SDU_ITIME         0xFFFFFFFF
+#define L2CAP_DEFAULT_ACC_LAT           0xFFFFFFFF
 
-#define L2CAP_CONN_TIMEOUT      (40000) /* 40 seconds */
-#define L2CAP_INFO_TIMEOUT      (4000)  /*  4 seconds */
+#define L2CAP_DISC_TIMEOUT             (100)
+#define L2CAP_DISC_REJ_TIMEOUT         (5000)  /*  5 seconds */
+#define L2CAP_ENC_TIMEOUT              (5000)  /*  5 seconds */
+#define L2CAP_CONN_TIMEOUT             (40000) /* 40 seconds */
+#define L2CAP_INFO_TIMEOUT             (4000)  /*  4 seconds */
 
 /* L2CAP socket address */
 struct sockaddr_l2 {
@@ -88,52 +97,82 @@ struct l2cap_conninfo {
 #define L2CAP_ECHO_RSP          0x09
 #define L2CAP_INFO_REQ          0x0a
 #define L2CAP_INFO_RSP          0x0b
+#define L2CAP_CREATE_CHAN_REQ   0x0c
+#define L2CAP_CREATE_CHAN_RSP   0x0d
+#define L2CAP_MOVE_CHAN_REQ     0x0e
+#define L2CAP_MOVE_CHAN_RSP     0x0f
+#define L2CAP_MOVE_CHAN_CFM     0x10
+#define L2CAP_MOVE_CHAN_CFM_RSP 0x11
 #define L2CAP_CONN_PARAM_UPDATE_REQ     0x12
 #define L2CAP_CONN_PARAM_UPDATE_RSP     0x13
 
-/* L2CAP feature mask */
+/* L2CAP extended feature mask */
 #define L2CAP_FEAT_FLOWCTL      0x00000001
 #define L2CAP_FEAT_RETRANS      0x00000002
+#define L2CAP_FEAT_BIDIR_QOS    0x00000004
 #define L2CAP_FEAT_ERTM         0x00000008
 #define L2CAP_FEAT_STREAMING    0x00000010
 #define L2CAP_FEAT_FCS          0x00000020
+#define L2CAP_FEAT_EXT_FLOW     0x00000040
 #define L2CAP_FEAT_FIXED_CHAN   0x00000080
+#define L2CAP_FEAT_EXT_WINDOW   0x00000100
+#define L2CAP_FEAT_UCD          0x00000200
 
 /* L2CAP checksum option */
 #define L2CAP_FCS_NONE          0x00
 #define L2CAP_FCS_CRC16         0x01
 
+/* L2CAP fixed channels */
+#define L2CAP_FC_L2CAP          0x02
+#define L2CAP_FC_A2MP           0x08
+
 /* L2CAP Control Field bit masks */
-#define L2CAP_CTRL_SAR               0xC000
-#define L2CAP_CTRL_REQSEQ            0x3F00
-#define L2CAP_CTRL_TXSEQ             0x007E
-#define L2CAP_CTRL_RETRANS           0x0080
-#define L2CAP_CTRL_FINAL             0x0080
-#define L2CAP_CTRL_POLL              0x0010
-#define L2CAP_CTRL_SUPERVISE         0x000C
-#define L2CAP_CTRL_FRAME_TYPE        0x0001 /* I- or S-Frame */
-
-#define L2CAP_CTRL_TXSEQ_SHIFT      1
-#define L2CAP_CTRL_REQSEQ_SHIFT     8
-#define L2CAP_CTRL_SAR_SHIFT       14
+#define L2CAP_CTRL_SAR                  0xC000
+#define L2CAP_CTRL_REQSEQ               0x3F00
+#define L2CAP_CTRL_TXSEQ                0x007E
+#define L2CAP_CTRL_SUPERVISE            0x000C
+
+#define L2CAP_CTRL_RETRANS              0x0080
+#define L2CAP_CTRL_FINAL                0x0080
+#define L2CAP_CTRL_POLL                 0x0010
+#define L2CAP_CTRL_FRAME_TYPE           0x0001 /* I- or S-Frame */
+
+#define L2CAP_CTRL_TXSEQ_SHIFT          1
+#define L2CAP_CTRL_SUPER_SHIFT          2
+#define L2CAP_CTRL_REQSEQ_SHIFT         8
+#define L2CAP_CTRL_SAR_SHIFT            14
+
+/* L2CAP Extended Control Field bit mask */
+#define L2CAP_EXT_CTRL_TXSEQ            0xFFFC0000
+#define L2CAP_EXT_CTRL_SAR              0x00030000
+#define L2CAP_EXT_CTRL_SUPERVISE        0x00030000
+#define L2CAP_EXT_CTRL_REQSEQ           0x0000FFFC
+
+#define L2CAP_EXT_CTRL_POLL             0x00040000
+#define L2CAP_EXT_CTRL_FINAL            0x00000002
+#define L2CAP_EXT_CTRL_FRAME_TYPE       0x00000001 /* I- or S-Frame */
+
+#define L2CAP_EXT_CTRL_REQSEQ_SHIFT     2
+#define L2CAP_EXT_CTRL_SAR_SHIFT        16
+#define L2CAP_EXT_CTRL_SUPER_SHIFT      16
+#define L2CAP_EXT_CTRL_TXSEQ_SHIFT      18
 
 /* L2CAP Supervisory Function */
-#define L2CAP_SUPER_RCV_READY           0x0000
-#define L2CAP_SUPER_REJECT              0x0004
-#define L2CAP_SUPER_RCV_NOT_READY       0x0008
-#define L2CAP_SUPER_SELECT_REJECT       0x000C
+#define L2CAP_SUPER_RR          0x00
+#define L2CAP_SUPER_REJ         0x01
+#define L2CAP_SUPER_RNR         0x02
+#define L2CAP_SUPER_SREJ        0x03
 
 /* L2CAP Segmentation and Reassembly */
-#define L2CAP_SDU_UNSEGMENTED       0x0000
-#define L2CAP_SDU_START             0x4000
-#define L2CAP_SDU_END               0x8000
-#define L2CAP_SDU_CONTINUE          0xC000
+#define L2CAP_SAR_UNSEGMENTED   0x00
+#define L2CAP_SAR_START         0x01
+#define L2CAP_SAR_END           0x02
+#define L2CAP_SAR_CONTINUE      0x03
 
 /* L2CAP Command rej. reasons */
-#define L2CAP_REJ_NOT_UNDERSTOOD      0x0000
-#define L2CAP_REJ_MTU_EXCEEDED        0x0001
-#define L2CAP_REJ_INVALID_CID         0x0002
-
+#define L2CAP_REJ_NOT_UNDERSTOOD        0x0000
+#define L2CAP_REJ_MTU_EXCEEDED          0x0001
+#define L2CAP_REJ_INVALID_CID           0x0002
 
 /* L2CAP structures */
 struct l2cap_hdr {
@@ -141,6 +180,12 @@ struct l2cap_hdr {
         __le16     cid;
 } __packed;
 #define L2CAP_HDR_SIZE          4
+#define L2CAP_ENH_HDR_SIZE      6
+#define L2CAP_EXT_HDR_SIZE      8
+
+#define L2CAP_FCS_SIZE          2
+#define L2CAP_SDULEN_SIZE       2
+#define L2CAP_PSMLEN_SIZE       2
 
 struct l2cap_cmd_hdr {
         __u8       code;
@@ -185,14 +230,15 @@ struct l2cap_conn_rsp {
 #define L2CAP_CID_DYN_START     0x0040
 #define L2CAP_CID_DYN_END       0xffff
 
-/* connect result */
+/* connect/create channel results */
 #define L2CAP_CR_SUCCESS        0x0000
 #define L2CAP_CR_PEND           0x0001
 #define L2CAP_CR_BAD_PSM        0x0002
 #define L2CAP_CR_SEC_BLOCK      0x0003
 #define L2CAP_CR_NO_MEM         0x0004
+#define L2CAP_CR_BAD_AMP        0x0005
 
-/* connect status */
+/* connect/create channel status */
 #define L2CAP_CS_NO_INFO        0x0000
 #define L2CAP_CS_AUTHEN_PEND    0x0001
 #define L2CAP_CS_AUTHOR_PEND    0x0002
@@ -214,6 +260,8 @@ struct l2cap_conf_rsp {
 #define L2CAP_CONF_UNACCEPT     0x0001
 #define L2CAP_CONF_REJECT       0x0002
 #define L2CAP_CONF_UNKNOWN      0x0003
+#define L2CAP_CONF_PENDING      0x0004
+#define L2CAP_CONF_EFS_REJECT   0x0005
 
 struct l2cap_conf_opt {
         __u8       type;
@@ -230,6 +278,8 @@ struct l2cap_conf_opt {
 #define L2CAP_CONF_QOS          0x03
 #define L2CAP_CONF_RFC          0x04
 #define L2CAP_CONF_FCS          0x05
+#define L2CAP_CONF_EFS          0x06
+#define L2CAP_CONF_EWS          0x07
 
 #define L2CAP_CONF_MAX_SIZE     22
 
@@ -248,6 +298,21 @@ struct l2cap_conf_rfc {
 #define L2CAP_MODE_ERTM         0x03
 #define L2CAP_MODE_STREAMING    0x04
 
+struct l2cap_conf_efs {
+        __u8    id;
+        __u8    stype;
+        __le16  msdu;
+        __le32  sdu_itime;
+        __le32  acc_lat;
+        __le32  flush_to;
+} __packed;
+
+#define L2CAP_SERV_NOTRAFIC     0x00
+#define L2CAP_SERV_BESTEFFORT   0x01
+#define L2CAP_SERV_GUARANTEED   0x02
+
+#define L2CAP_BESTEFFORT_ID     0x01
+
 struct l2cap_disconn_req {
         __le16     dcid;
         __le16     scid;
@@ -268,14 +333,57 @@ struct l2cap_info_rsp {
         __u8        data[0];
 } __packed;
 
+struct l2cap_create_chan_req {
+        __le16      psm;
+        __le16      scid;
+        __u8        amp_id;
+} __packed;
+
+struct l2cap_create_chan_rsp {
+        __le16      dcid;
+        __le16      scid;
+        __le16      result;
+        __le16      status;
+} __packed;
+
+struct l2cap_move_chan_req {
+        __le16      icid;
+        __u8        dest_amp_id;
+} __packed;
+
+struct l2cap_move_chan_rsp {
+        __le16      icid;
+        __le16      result;
+} __packed;
+
+#define L2CAP_MR_SUCCESS        0x0000
+#define L2CAP_MR_PEND           0x0001
+#define L2CAP_MR_BAD_ID         0x0002
+#define L2CAP_MR_SAME_ID        0x0003
+#define L2CAP_MR_NOT_SUPP       0x0004
+#define L2CAP_MR_COLLISION      0x0005
+#define L2CAP_MR_NOT_ALLOWED    0x0006
+
+struct l2cap_move_chan_cfm {
+        __le16      icid;
+        __le16      result;
+} __packed;
+
+#define L2CAP_MC_CONFIRMED      0x0000
+#define L2CAP_MC_UNCONFIRMED    0x0001
+
+struct l2cap_move_chan_cfm_rsp {
+        __le16      icid;
+} __packed;
+
 /* info type */
-#define L2CAP_IT_CL_MTU     0x0001
-#define L2CAP_IT_FEAT_MASK  0x0002
-#define L2CAP_IT_FIXED_CHAN 0x0003
+#define L2CAP_IT_CL_MTU         0x0001
+#define L2CAP_IT_FEAT_MASK      0x0002
+#define L2CAP_IT_FIXED_CHAN     0x0003
 
 /* info result */
-#define L2CAP_IR_SUCCESS    0x0000
-#define L2CAP_IR_NOTSUPP    0x0001
+#define L2CAP_IR_SUCCESS        0x0000
+#define L2CAP_IR_NOTSUPP        0x0001
 
 struct l2cap_conn_param_update_req {
         __le16      min;
@@ -294,7 +402,7 @@ struct l2cap_conn_param_update_rsp {
 
 /* ----- L2CAP channels and connections ----- */
 struct srej_list {
-        __u8    tx_seq;
+        __u16   tx_seq;
         struct list_head list;
 };
 
@@ -316,14 +424,11 @@ struct l2cap_chan {
         __u16           flush_to;
         __u8            mode;
         __u8            chan_type;
+        __u8            chan_policy;
 
         __le16          sport;
 
         __u8            sec_level;
-        __u8            role_switch;
-        __u8            force_reliable;
-        __u8            flushable;
-        __u8            force_active;
 
         __u8            ident;
 
@@ -334,7 +439,8 @@ struct l2cap_chan {
 
         __u8            fcs;
 
-        __u8            tx_win;
+        __u16           tx_win;
+        __u16           tx_win_max;
         __u8            max_tx;
         __u16           retrans_timeout;
         __u16           monitor_timeout;
@@ -342,25 +448,40 @@ struct l2cap_chan {
 
         unsigned long   conf_state;
         unsigned long   conn_state;
-
-        __u8            next_tx_seq;
-        __u8            expected_ack_seq;
-        __u8            expected_tx_seq;
-        __u8            buffer_seq;
-        __u8            buffer_seq_srej;
-        __u8            srej_save_reqseq;
-        __u8            frames_sent;
-        __u8            unacked_frames;
+        unsigned long   flags;
+
+        __u16           next_tx_seq;
+        __u16           expected_ack_seq;
+        __u16           expected_tx_seq;
+        __u16           buffer_seq;
+        __u16           buffer_seq_srej;
+        __u16           srej_save_reqseq;
+        __u16           frames_sent;
+        __u16           unacked_frames;
         __u8            retry_count;
         __u8            num_acked;
         __u16           sdu_len;
         struct sk_buff  *sdu;
         struct sk_buff  *sdu_last_frag;
 
-        __u8            remote_tx_win;
+        __u16           remote_tx_win;
         __u8            remote_max_tx;
         __u16           remote_mps;
 
+        __u8            local_id;
+        __u8            local_stype;
+        __u16           local_msdu;
+        __u32           local_sdu_itime;
+        __u32           local_acc_lat;
+        __u32           local_flush_to;
+
+        __u8            remote_id;
+        __u8            remote_stype;
+        __u16           remote_msdu;
+        __u32           remote_sdu_itime;
+        __u32           remote_acc_lat;
+        __u32           remote_flush_to;
+
         struct timer_list       chan_timer;
         struct timer_list       retrans_timer;
         struct timer_list       monitor_timer;
@@ -388,6 +509,7 @@ struct l2cap_ops {
 
 struct l2cap_conn {
         struct hci_conn *hcon;
+        struct hci_chan *hchan;
 
         bdaddr_t        *dst;
         bdaddr_t        *src;
@@ -442,6 +564,9 @@ enum {
         CONF_CONNECT_PEND,
         CONF_NO_FCS_RECV,
         CONF_STATE2_DEVICE,
+        CONF_EWS_RECV,
+        CONF_LOC_CONF_PEND,
+        CONF_REM_CONF_PEND,
 };
 
 #define L2CAP_CONF_MAX_CONF_REQ 2
@@ -459,6 +584,16 @@ enum {
         CONN_RNR_SENT,
 };
 
+/* Definitions for flags in l2cap_chan */
+enum {
+        FLAG_ROLE_SWITCH,
+        FLAG_FORCE_ACTIVE,
+        FLAG_FORCE_RELIABLE,
+        FLAG_FLUSHABLE,
+        FLAG_EXT_CTRL,
+        FLAG_EFS_ENABLE,
+};
+
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
 #define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
@@ -471,6 +606,22 @@ enum {
                 L2CAP_DEFAULT_ACK_TO);
 #define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 
+static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
+{
+        int offset;
+
+        offset = (seq1 - seq2) % (chan->tx_win_max + 1);
+        if (offset < 0)
+                offset += (chan->tx_win_max + 1);
+
+        return offset;
+}
+
+static inline __u16 __next_seq(struct l2cap_chan *chan, __u16 seq)
+{
+        return (seq + 1) % (chan->tx_win_max + 1);
+}
+
 static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
 {
         int sub;
@@ -483,13 +634,165 @@ static inline int l2cap_tx_window_full(struct l2cap_chan *ch)
         return sub == ch->remote_tx_win;
 }
 
-#define __get_txseq(ctrl)       (((ctrl) & L2CAP_CTRL_TXSEQ) >> 1)
-#define __get_reqseq(ctrl)      (((ctrl) & L2CAP_CTRL_REQSEQ) >> 8)
-#define __is_iframe(ctrl)       (!((ctrl) & L2CAP_CTRL_FRAME_TYPE))
-#define __is_sframe(ctrl)       ((ctrl) & L2CAP_CTRL_FRAME_TYPE)
-#define __is_sar_start(ctrl)    (((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START)
+static inline __u16 __get_reqseq(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (ctrl & L2CAP_EXT_CTRL_REQSEQ) >>
+                                                L2CAP_EXT_CTRL_REQSEQ_SHIFT;
+        else
+                return (ctrl & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
+}
+
+static inline __u32 __set_reqseq(struct l2cap_chan *chan, __u32 reqseq)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT) &
+                                                        L2CAP_EXT_CTRL_REQSEQ;
+        else
+                return (reqseq << L2CAP_CTRL_REQSEQ_SHIFT) & L2CAP_CTRL_REQSEQ;
+}
+
+static inline __u16 __get_txseq(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (ctrl & L2CAP_EXT_CTRL_TXSEQ) >>
+                                                L2CAP_EXT_CTRL_TXSEQ_SHIFT;
+        else
+                return (ctrl & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
+}
+
+static inline __u32 __set_txseq(struct l2cap_chan *chan, __u32 txseq)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT) &
+                                                        L2CAP_EXT_CTRL_TXSEQ;
+        else
+                return (txseq << L2CAP_CTRL_TXSEQ_SHIFT) & L2CAP_CTRL_TXSEQ;
+}
+
+static inline bool __is_sframe(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return ctrl & L2CAP_EXT_CTRL_FRAME_TYPE;
+        else
+                return ctrl & L2CAP_CTRL_FRAME_TYPE;
+}
+
+static inline __u32 __set_sframe(struct l2cap_chan *chan)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return L2CAP_EXT_CTRL_FRAME_TYPE;
+        else
+                return L2CAP_CTRL_FRAME_TYPE;
+}
+
+static inline __u8 __get_ctrl_sar(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (ctrl & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
+        else
+                return (ctrl & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
+}
+
+static inline __u32 __set_ctrl_sar(struct l2cap_chan *chan, __u32 sar)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (sar << L2CAP_EXT_CTRL_SAR_SHIFT) & L2CAP_EXT_CTRL_SAR;
+        else
+                return (sar << L2CAP_CTRL_SAR_SHIFT) & L2CAP_CTRL_SAR;
+}
+
+static inline bool __is_sar_start(struct l2cap_chan *chan, __u32 ctrl)
+{
+        return __get_ctrl_sar(chan, ctrl) == L2CAP_SAR_START;
+}
+
+static inline __u32 __get_sar_mask(struct l2cap_chan *chan)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return L2CAP_EXT_CTRL_SAR;
+        else
+                return L2CAP_CTRL_SAR;
+}
+
+static inline __u8 __get_ctrl_super(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (ctrl & L2CAP_EXT_CTRL_SUPERVISE) >>
+                                                L2CAP_EXT_CTRL_SUPER_SHIFT;
+        else
+                return (ctrl & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
+}
+
+static inline __u32 __set_ctrl_super(struct l2cap_chan *chan, __u32 super)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return (super << L2CAP_EXT_CTRL_SUPER_SHIFT) &
+                                                L2CAP_EXT_CTRL_SUPERVISE;
+        else
+                return (super << L2CAP_CTRL_SUPER_SHIFT) &
+                                                        L2CAP_CTRL_SUPERVISE;
+}
+
+static inline __u32 __set_ctrl_final(struct l2cap_chan *chan)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return L2CAP_EXT_CTRL_FINAL;
+        else
+                return L2CAP_CTRL_FINAL;
+}
+
+static inline bool __is_ctrl_final(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return ctrl & L2CAP_EXT_CTRL_FINAL;
+        else
+                return ctrl & L2CAP_CTRL_FINAL;
+}
+
+static inline __u32 __set_ctrl_poll(struct l2cap_chan *chan)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return L2CAP_EXT_CTRL_POLL;
+        else
+                return L2CAP_CTRL_POLL;
+}
+
+static inline bool __is_ctrl_poll(struct l2cap_chan *chan, __u32 ctrl)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return ctrl & L2CAP_EXT_CTRL_POLL;
+        else
+                return ctrl & L2CAP_CTRL_POLL;
+}
+
+static inline __u32 __get_control(struct l2cap_chan *chan, void *p)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return get_unaligned_le32(p);
+        else
+                return get_unaligned_le16(p);
+}
+
+static inline void __put_control(struct l2cap_chan *chan, __u32 control,
+                                                                void *p)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return put_unaligned_le32(control, p);
+        else
+                return put_unaligned_le16(control, p);
+}
+
+static inline __u8 __ctrl_size(struct l2cap_chan *chan)
+{
+        if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                return L2CAP_EXT_HDR_SIZE - L2CAP_HDR_SIZE;
+        else
+                return L2CAP_ENH_HDR_SIZE - L2CAP_HDR_SIZE;
+}
 
 extern int disable_ertm;
+extern int enable_hs;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
@@ -504,7 +807,8 @@ struct l2cap_chan *l2cap_chan_create(struct sock *sk);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan);
-int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len);
+int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
+                                                                u32 priority);
 void l2cap_chan_busy(struct l2cap_chan *chan, int busy);
 
 #endif /* __L2CAP_H */
diff --git a/include/net/bluetooth/mgmt.h b/include/net/bluetooth/mgmt.h
index d66da0f94f95..3e320c9cae8f 100644
--- a/include/net/bluetooth/mgmt.h
+++ b/include/net/bluetooth/mgmt.h
@@ -69,6 +69,10 @@ struct mgmt_mode {
 #define MGMT_OP_SET_POWERED             0x0005
 
 #define MGMT_OP_SET_DISCOVERABLE        0x0006
+struct mgmt_cp_set_discoverable {
+        __u8 val;
+        __u16 timeout;
+} __packed;
 
 #define MGMT_OP_SET_CONNECTABLE         0x0007
 
@@ -96,24 +100,22 @@ struct mgmt_cp_set_service_cache {
         __u8 enable;
 } __packed;
 
-struct mgmt_key_info {
+struct mgmt_link_key_info {
         bdaddr_t bdaddr;
         u8 type;
         u8 val[16];
         u8 pin_len;
-        u8 dlen;
-        u8 data[0];
 } __packed;
 
-#define MGMT_OP_LOAD_KEYS               0x000D
-struct mgmt_cp_load_keys {
+#define MGMT_OP_LOAD_LINK_KEYS          0x000D
+struct mgmt_cp_load_link_keys {
         __u8 debug_keys;
         __le16 key_count;
-        struct mgmt_key_info keys[0];
+        struct mgmt_link_key_info keys[0];
 } __packed;
 
-#define MGMT_OP_REMOVE_KEY              0x000E
-struct mgmt_cp_remove_key {
+#define MGMT_OP_REMOVE_KEYS             0x000E
+struct mgmt_cp_remove_keys {
         bdaddr_t bdaddr;
         __u8 disconnect;
 } __packed;
@@ -126,10 +128,20 @@ struct mgmt_rp_disconnect {
         bdaddr_t bdaddr;
 } __packed;
 
+#define MGMT_ADDR_BREDR                 0x00
+#define MGMT_ADDR_LE                    0x01
+#define MGMT_ADDR_BREDR_LE              0x02
+#define MGMT_ADDR_INVALID               0xff
+
+struct mgmt_addr_info {
+        bdaddr_t bdaddr;
+        __u8 type;
+} __packed;
+
 #define MGMT_OP_GET_CONNECTIONS         0x0010
 struct mgmt_rp_get_connections {
         __le16 conn_count;
-        bdaddr_t conn[0];
+        struct mgmt_addr_info addr[0];
 } __packed;
 
 #define MGMT_OP_PIN_CODE_REPLY          0x0011
@@ -245,26 +257,19 @@ struct mgmt_ev_controller_error {
 
 #define MGMT_EV_PAIRABLE                0x0009
 
-#define MGMT_EV_NEW_KEY                 0x000A
-struct mgmt_ev_new_key {
+#define MGMT_EV_NEW_LINK_KEY            0x000A
+struct mgmt_ev_new_link_key {
         __u8 store_hint;
-        struct mgmt_key_info key;
+        struct mgmt_link_key_info key;
 } __packed;
 
 #define MGMT_EV_CONNECTED               0x000B
-struct mgmt_ev_connected {
-        bdaddr_t bdaddr;
-        __u8 link_type;
-} __packed;
 
 #define MGMT_EV_DISCONNECTED            0x000C
-struct mgmt_ev_disconnected {
-        bdaddr_t bdaddr;
-} __packed;
 
 #define MGMT_EV_CONNECT_FAILED          0x000D
 struct mgmt_ev_connect_failed {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
         __u8 status;
 } __packed;
 
@@ -294,7 +299,7 @@ struct mgmt_ev_local_name_changed {
 
 #define MGMT_EV_DEVICE_FOUND            0x0012
 struct mgmt_ev_device_found {
-        bdaddr_t bdaddr;
+        struct mgmt_addr_info addr;
         __u8 dev_class[3];
         __s8 rssi;
         __u8 eir[HCI_MAX_EIR_LENGTH];