34 files changed, 16066 insertions, 0 deletions

diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
new file mode 100644
index 000000000000..6929490d095a
--- /dev/null
+++ b/net/bluetooth/Kconfig
@@ -0,0 +1,63 @@
+#
+# Bluetooth subsystem configuration
+#
+
+menuconfig BT
+        depends on NET
+        tristate "Bluetooth subsystem support"
+        help
+          Bluetooth is low-cost, low-power, short-range wireless technology.
+          It was designed as a replacement for cables and other short-range
+          technologies like IrDA.  Bluetooth operates in personal area range
+          that typically extends up to 10 meters.  More information about
+          Bluetooth can be found at <http://www.bluetooth.com/>.
+
+          Linux Bluetooth subsystem consist of several layers:
+             Bluetooth Core (HCI device and connection manager, scheduler)
+             HCI Device drivers (Interface to the hardware)
+             SCO Module (SCO audio links)
+             L2CAP Module (Logical Link Control and Adaptation Protocol)
+             RFCOMM Module (RFCOMM Protocol)  
+             BNEP Module (Bluetooth Network Encapsulation Protocol)
+             CMTP Module (CAPI Message Transport Protocol)
+             HIDP Module (Human Interface Device Protocol)
+
+          Say Y here to compile Bluetooth support into the kernel or say M to
+          compile it as module (bluetooth).
+
+          To use Linux Bluetooth subsystem, you will need several user-space
+          utilities like hciconfig and hcid.  These utilities and updates to
+          Bluetooth kernel modules are provided in the BlueZ packages.
+          For more information, see <http://www.bluez.org/>.
+
+config BT_L2CAP
+        tristate "L2CAP protocol support"
+        depends on BT
+        help
+          L2CAP (Logical Link Control and Adaptation Protocol) provides
+          connection oriented and connection-less data transport.  L2CAP
+          support is required for most Bluetooth applications.
+
+          Say Y here to compile L2CAP support into the kernel or say M to
+          compile it as module (l2cap).
+
+config BT_SCO
+        tristate "SCO links support"
+        depends on BT
+        help
+          SCO link provides voice transport over Bluetooth.  SCO support is
+          required for voice applications like Headset and Audio.
+
+          Say Y here to compile SCO support into the kernel or say M to
+          compile it as module (sco).
+
+source "net/bluetooth/rfcomm/Kconfig"
+
+source "net/bluetooth/bnep/Kconfig"
+
+source "net/bluetooth/cmtp/Kconfig"
+
+source "net/bluetooth/hidp/Kconfig"
+
+source "drivers/bluetooth/Kconfig"
+
diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
new file mode 100644
index 000000000000..d1e433f7d673
--- /dev/null
+++ b/net/bluetooth/Makefile
@@ -0,0 +1,13 @@
+#
+# Makefile for the Linux Bluetooth subsystem.
+#
+
+obj-$(CONFIG_BT)        += bluetooth.o
+obj-$(CONFIG_BT_L2CAP)  += l2cap.o
+obj-$(CONFIG_BT_SCO)    += sco.o
+obj-$(CONFIG_BT_RFCOMM) += rfcomm/
+obj-$(CONFIG_BT_BNEP)   += bnep/
+obj-$(CONFIG_BT_CMTP)   += cmtp/
+obj-$(CONFIG_BT_HIDP)   += hidp/
+
+bluetooth-objs := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o hci_sysfs.o lib.o
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
new file mode 100644
index 000000000000..1650c6bf6997
--- /dev/null
+++ b/net/bluetooth/af_bluetooth.c
@@ -0,0 +1,355 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth address family and sockets. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/list.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+#include <linux/poll.h>
+#include <linux/proc_fs.h>
+#include <net/sock.h>
+
+#if defined(CONFIG_KMOD)
+#include <linux/kmod.h>
+#endif
+
+#include <net/bluetooth/bluetooth.h>
+
+#ifndef CONFIG_BT_SOCK_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "2.7"
+
+struct proc_dir_entry *proc_bt;
+EXPORT_SYMBOL(proc_bt);
+
+/* Bluetooth sockets */
+#define BT_MAX_PROTO    8
+static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+
+int bt_sock_register(int proto, struct net_proto_family *ops)
+{
+        if (proto < 0 || proto >= BT_MAX_PROTO)
+                return -EINVAL;
+
+        if (bt_proto[proto])
+                return -EEXIST;
+
+        bt_proto[proto] = ops;
+        return 0;
+}
+EXPORT_SYMBOL(bt_sock_register);
+
+int bt_sock_unregister(int proto)
+{
+        if (proto < 0 || proto >= BT_MAX_PROTO)
+                return -EINVAL;
+
+        if (!bt_proto[proto])
+                return -ENOENT;
+
+        bt_proto[proto] = NULL;
+        return 0;
+}
+EXPORT_SYMBOL(bt_sock_unregister);
+
+static int bt_sock_create(struct socket *sock, int proto)
+{
+        int err = 0;
+
+        if (proto < 0 || proto >= BT_MAX_PROTO)
+                return -EINVAL;
+
+#if defined(CONFIG_KMOD)
+        if (!bt_proto[proto]) {
+                request_module("bt-proto-%d", proto);
+        }
+#endif
+        err = -EPROTONOSUPPORT;
+        if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
+                err = bt_proto[proto]->create(sock, proto);
+                module_put(bt_proto[proto]->owner);
+        }
+        return err; 
+}
+
+void bt_sock_link(struct bt_sock_list *l, struct sock *sk)
+{
+        write_lock_bh(&l->lock);
+        sk_add_node(sk, &l->head);
+        write_unlock_bh(&l->lock);
+}
+EXPORT_SYMBOL(bt_sock_link);
+
+void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
+{
+        write_lock_bh(&l->lock);
+        sk_del_node_init(sk);
+        write_unlock_bh(&l->lock);
+}
+EXPORT_SYMBOL(bt_sock_unlink);
+
+void bt_accept_enqueue(struct sock *parent, struct sock *sk)
+{
+        BT_DBG("parent %p, sk %p", parent, sk);
+
+        sock_hold(sk);
+        list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
+        bt_sk(sk)->parent = parent;
+        parent->sk_ack_backlog++;
+}
+EXPORT_SYMBOL(bt_accept_enqueue);
+
+void bt_accept_unlink(struct sock *sk)
+{
+        BT_DBG("sk %p state %d", sk, sk->sk_state);
+
+        list_del_init(&bt_sk(sk)->accept_q);
+        bt_sk(sk)->parent->sk_ack_backlog--;
+        bt_sk(sk)->parent = NULL;
+        sock_put(sk);
+}
+EXPORT_SYMBOL(bt_accept_unlink);
+
+struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
+{
+        struct list_head *p, *n;
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
+                sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
+
+                lock_sock(sk);
+
+                /* FIXME: Is this check still needed */
+                if (sk->sk_state == BT_CLOSED) {
+                        release_sock(sk);
+                        bt_accept_unlink(sk);
+                        continue;
+                }
+
+                if (sk->sk_state == BT_CONNECTED || !newsock) {
+                        bt_accept_unlink(sk);
+                        if (newsock)
+                                sock_graft(sk, newsock);
+                        release_sock(sk);
+                        return sk;
+                }
+
+                release_sock(sk);
+        }
+        return NULL;
+}
+EXPORT_SYMBOL(bt_accept_dequeue);
+
+int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+        struct msghdr *msg, size_t len, int flags)
+{
+        int noblock = flags & MSG_DONTWAIT;
+        struct sock *sk = sock->sk;
+        struct sk_buff *skb;
+        size_t copied;
+        int err;
+
+        BT_DBG("sock %p sk %p len %d", sock, sk, len);
+
+        if (flags & (MSG_OOB))
+                return -EOPNOTSUPP;
+
+        if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) {
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
+                        return 0;
+                return err;
+        }
+
+        msg->msg_namelen = 0;
+
+        copied = skb->len;
+        if (len < copied) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+
+        skb->h.raw = skb->data;
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+
+        skb_free_datagram(sk, skb);
+
+        return err ? : copied;
+}
+EXPORT_SYMBOL(bt_sock_recvmsg);
+
+static inline unsigned int bt_accept_poll(struct sock *parent)
+{
+        struct list_head *p, *n;
+        struct sock *sk;
+
+        list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {
+                sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
+                if (sk->sk_state == BT_CONNECTED)
+                        return POLLIN | POLLRDNORM;
+        }
+
+        return 0;
+}
+
+unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *wait)
+{
+        struct sock *sk = sock->sk;
+        unsigned int mask = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        poll_wait(file, sk->sk_sleep, wait);
+
+        if (sk->sk_state == BT_LISTEN)
+                return bt_accept_poll(sk);
+
+        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+                mask |= POLLERR;
+
+        if (sk->sk_shutdown == SHUTDOWN_MASK)
+                mask |= POLLHUP;
+
+        if (!skb_queue_empty(&sk->sk_receive_queue) || 
+                        (sk->sk_shutdown & RCV_SHUTDOWN))
+                mask |= POLLIN | POLLRDNORM;
+
+        if (sk->sk_state == BT_CLOSED)
+                mask |= POLLHUP;
+
+        if (sk->sk_state == BT_CONNECT ||
+                        sk->sk_state == BT_CONNECT2 ||
+                        sk->sk_state == BT_CONFIG)
+                return mask;
+
+        if (sock_writeable(sk))
+                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+        else
+                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
+
+        return mask;
+}
+EXPORT_SYMBOL(bt_sock_poll);
+
+int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        int err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        add_wait_queue(sk->sk_sleep, &wait);
+        while (sk->sk_state != state) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                if (sk->sk_err) {
+                        err = sock_error(sk);
+                        break;
+                }
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+        return err;
+}
+EXPORT_SYMBOL(bt_sock_wait_state);
+
+static struct net_proto_family bt_sock_family_ops = {
+        .owner  = THIS_MODULE,
+        .family = PF_BLUETOOTH,
+        .create = bt_sock_create,
+};
+
+extern int hci_sock_init(void);
+extern int hci_sock_cleanup(void);
+
+extern int bt_sysfs_init(void);
+extern int bt_sysfs_cleanup(void);
+
+static int __init bt_init(void)
+{
+        BT_INFO("Core ver %s", VERSION);
+
+        proc_bt = proc_mkdir("bluetooth", NULL);
+        if (proc_bt)
+                proc_bt->owner = THIS_MODULE;
+
+        sock_register(&bt_sock_family_ops);
+
+        BT_INFO("HCI device and connection manager initialized");
+
+        bt_sysfs_init();
+
+        hci_sock_init();
+
+        return 0;
+}
+
+static void __exit bt_exit(void)
+{
+        hci_sock_cleanup();
+
+        bt_sysfs_cleanup();
+
+        sock_unregister(PF_BLUETOOTH);
+
+        remove_proc_entry("bluetooth", NULL);
+}
+
+subsys_initcall(bt_init);
+module_exit(bt_exit);
+
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETPROTO(PF_BLUETOOTH);
diff --git a/net/bluetooth/bnep/Kconfig b/net/bluetooth/bnep/Kconfig
new file mode 100644
index 000000000000..35158b036d54
--- /dev/null
+++ b/net/bluetooth/bnep/Kconfig
@@ -0,0 +1,24 @@
+config BT_BNEP
+        tristate "BNEP protocol support"
+        depends on BT && BT_L2CAP
+        select CRC32
+        help
+          BNEP (Bluetooth Network Encapsulation Protocol) is Ethernet
+          emulation layer on top of Bluetooth.  BNEP is required for
+          Bluetooth PAN (Personal Area Network).
+
+          Say Y here to compile BNEP support into the kernel or say M to
+          compile it as module (bnep).
+
+config BT_BNEP_MC_FILTER
+        bool "Multicast filter support"
+        depends on BT_BNEP
+        help
+          This option enables the multicast filter support for BNEP.
+
+config BT_BNEP_PROTO_FILTER
+        bool "Protocol filter support"
+        depends on BT_BNEP
+        help
+          This option enables the protocol filter support for BNEP.
+
diff --git a/net/bluetooth/bnep/Makefile b/net/bluetooth/bnep/Makefile
new file mode 100644
index 000000000000..c7821e76ca56
--- /dev/null
+++ b/net/bluetooth/bnep/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for the Linux Bluetooth BNEP layer.
+#
+
+obj-$(CONFIG_BT_BNEP) += bnep.o
+
+bnep-objs := core.o sock.o netdev.o
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
new file mode 100644
index 000000000000..bbb1ed7097a9
--- /dev/null
+++ b/net/bluetooth/bnep/bnep.h
@@ -0,0 +1,184 @@
+/*
+  BNEP protocol definition for Linux Bluetooth stack (BlueZ).
+  Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+        
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License, version 2, as
+  published by the Free Software Foundation.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+*/
+
+/*
+ * $Id: bnep.h,v 1.5 2002/08/04 21:23:58 maxk Exp $
+ */
+
+#ifndef _BNEP_H
+#define _BNEP_H
+
+#include <linux/types.h>
+#include <linux/crc32.h>
+#include <net/bluetooth/bluetooth.h>
+
+// Limits
+#define BNEP_MAX_PROTO_FILTERS     5
+#define BNEP_MAX_MULTICAST_FILTERS 20
+
+// UUIDs
+#define BNEP_BASE_UUID 0x0000000000001000800000805F9B34FB
+#define BNEP_UUID16    0x02
+#define BNEP_UUID32    0x04
+#define BNEP_UUID128   0x16
+
+#define BNEP_SVC_PANU  0x1115
+#define BNEP_SVC_NAP   0x1116
+#define BNEP_SVC_GN    0x1117
+
+// Packet types
+#define BNEP_GENERAL               0x00
+#define BNEP_CONTROL               0x01
+#define BNEP_COMPRESSED            0x02
+#define BNEP_COMPRESSED_SRC_ONLY   0x03
+#define BNEP_COMPRESSED_DST_ONLY   0x04
+
+// Control types
+#define BNEP_CMD_NOT_UNDERSTOOD    0x00
+#define BNEP_SETUP_CONN_REQ        0x01
+#define BNEP_SETUP_CONN_RSP        0x02
+#define BNEP_FILTER_NET_TYPE_SET   0x03
+#define BNEP_FILTER_NET_TYPE_RSP   0x04
+#define BNEP_FILTER_MULTI_ADDR_SET 0x05
+#define BNEP_FILTER_MULTI_ADDR_RSP 0x06
+
+// Extension types
+#define BNEP_EXT_CONTROL           0x00
+
+// Response messages 
+#define BNEP_SUCCESS               0x00
+
+#define BNEP_CONN_INVALID_DST      0x01
+#define BNEP_CONN_INVALID_SRC      0x02
+#define BNEP_CONN_INVALID_SVC      0x03
+#define BNEP_CONN_NOT_ALLOWED      0x04
+
+#define BNEP_FILTER_UNSUPPORTED_REQ    0x01
+#define BNEP_FILTER_INVALID_RANGE      0x02
+#define BNEP_FILTER_INVALID_MCADDR     0x02
+#define BNEP_FILTER_LIMIT_REACHED      0x03
+#define BNEP_FILTER_DENIED_SECURITY    0x04
+
+// L2CAP settings
+#define BNEP_MTU         1691
+#define BNEP_PSM         0x0f
+#define BNEP_FLUSH_TO    0xffff
+#define BNEP_CONNECT_TO  15
+#define BNEP_FILTER_TO   15
+
+// Headers 
+#define BNEP_TYPE_MASK   0x7f
+#define BNEP_EXT_HEADER  0x80
+
+struct bnep_setup_conn_req {
+        __u8  type;
+        __u8  ctrl;
+        __u8  uuid_size;
+        __u8  service[0];
+} __attribute__((packed));
+
+struct bnep_set_filter_req {
+        __u8  type;
+        __u8  ctrl;
+        __u16 len;
+        __u8  list[0];
+} __attribute__((packed));
+
+struct bnep_control_rsp {
+        __u8  type;
+        __u8  ctrl;
+        __u16 resp;
+} __attribute__((packed));
+
+struct bnep_ext_hdr {
+        __u8  type;
+        __u8  len;
+        __u8  data[0];
+} __attribute__((packed));
+
+/* BNEP ioctl defines */
+#define BNEPCONNADD     _IOW('B', 200, int)
+#define BNEPCONNDEL     _IOW('B', 201, int)
+#define BNEPGETCONNLIST _IOR('B', 210, int)
+#define BNEPGETCONNINFO _IOR('B', 211, int)
+
+struct bnep_connadd_req {
+        int   sock;       // Connected socket
+        __u32 flags;
+        __u16 role;
+        char  device[16]; // Name of the Ethernet device
+};
+
+struct bnep_conndel_req {
+        __u32 flags;
+        __u8  dst[ETH_ALEN];
+};
+
+struct bnep_conninfo {
+        __u32 flags;
+        __u16 role;
+        __u16 state;    
+        __u8  dst[ETH_ALEN];
+        char  device[16];
+};
+
+struct bnep_connlist_req {
+        __u32  cnum;
+        struct bnep_conninfo __user *ci;
+};
+
+struct bnep_proto_filter {
+        __u16 start;
+        __u16 end;
+};
+
+int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock);
+int bnep_del_connection(struct bnep_conndel_req *req);
+int bnep_get_connlist(struct bnep_connlist_req *req);
+int bnep_get_conninfo(struct bnep_conninfo *ci);
+
+// BNEP sessions
+struct bnep_session {
+        struct list_head list;
+        
+        unsigned int  role;
+        unsigned long state;
+        unsigned long flags;
+        atomic_t      killed;
+
+        struct ethhdr eh;
+        struct msghdr msg;
+
+        struct bnep_proto_filter proto_filter[BNEP_MAX_PROTO_FILTERS];
+        u64    mc_filter;
+        
+        struct socket    *sock;
+        struct net_device *dev;
+        struct net_device_stats stats;
+};
+
+void bnep_net_setup(struct net_device *dev);
+int bnep_sock_init(void);
+int bnep_sock_cleanup(void);
+
+static inline int bnep_mc_hash(__u8 *addr)
+{
+        return (crc32_be(~0, addr, ETH_ALEN) >> 26);
+}
+
+#endif
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
new file mode 100644
index 000000000000..682bf20af52d
--- /dev/null
+++ b/net/bluetooth/bnep/core.c
@@ -0,0 +1,713 @@
+/* 
+   BNEP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2001-2002 Inventel Systemes
+   Written 2001-2002 by
+        Clément Moreau <clement.moreau@inventel.fr>
+        David Libault  <david.libault@inventel.fr>
+
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * $Id: core.c,v 1.20 2002/08/04 21:23:58 maxk Exp $
+ */ 
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/signal.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <linux/errno.h>
+#include <linux/smp_lock.h>
+#include <linux/net.h>
+#include <net/sock.h>
+
+#include <linux/socket.h>
+#include <linux/file.h>
+
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/l2cap.h>
+
+#include "bnep.h"
+
+#ifndef CONFIG_BT_BNEP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "1.2"
+
+static LIST_HEAD(bnep_session_list);
+static DECLARE_RWSEM(bnep_session_sem);
+
+static struct bnep_session *__bnep_get_session(u8 *dst)
+{
+        struct bnep_session *s;
+        struct list_head *p;
+
+        BT_DBG("");
+
+        list_for_each(p, &bnep_session_list) {
+                s = list_entry(p, struct bnep_session, list);   
+                if (!memcmp(dst, s->eh.h_source, ETH_ALEN))
+                        return s;
+        }
+        return NULL;
+}
+
+static void __bnep_link_session(struct bnep_session *s)
+{
+        /* It's safe to call __module_get() here because sessions are added
+           by the socket layer which has to hold the refference to this module.
+         */
+        __module_get(THIS_MODULE);
+        list_add(&s->list, &bnep_session_list); 
+}
+
+static void __bnep_unlink_session(struct bnep_session *s)
+{
+        list_del(&s->list);
+        module_put(THIS_MODULE);
+}
+
+static int bnep_send(struct bnep_session *s, void *data, size_t len)
+{
+        struct socket *sock = s->sock;
+        struct kvec iv = { data, len };
+
+        return kernel_sendmsg(sock, &s->msg, &iv, 1, len);
+}
+
+static int bnep_send_rsp(struct bnep_session *s, u8 ctrl, u16 resp)
+{
+        struct bnep_control_rsp rsp;
+        rsp.type = BNEP_CONTROL;
+        rsp.ctrl = ctrl;
+        rsp.resp = htons(resp);
+        return bnep_send(s, &rsp, sizeof(rsp));
+}
+
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+static inline void bnep_set_default_proto_filter(struct bnep_session *s)
+{
+        /* (IPv4, ARP)  */
+        s->proto_filter[0].start = htons(0x0800);
+        s->proto_filter[0].end   = htons(0x0806);
+        /* (RARP, AppleTalk) */
+        s->proto_filter[1].start = htons(0x8035);
+        s->proto_filter[1].end   = htons(0x80F3);
+        /* (IPX, IPv6) */
+        s->proto_filter[2].start = htons(0x8137);
+        s->proto_filter[2].end   = htons(0x86DD);
+}
+#endif
+
+static int bnep_ctrl_set_netfilter(struct bnep_session *s, u16 *data, int len)
+{
+        int n;
+
+        if (len < 2)
+                return -EILSEQ;
+
+        n = ntohs(get_unaligned(data));
+        data++; len -= 2;
+
+        if (len < n)
+                return -EILSEQ;
+
+        BT_DBG("filter len %d", n);
+
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+        n /= 4;
+        if (n <= BNEP_MAX_PROTO_FILTERS) {
+                struct bnep_proto_filter *f = s->proto_filter;
+                int i;
+
+                for (i = 0; i < n; i++) {
+                        f[i].start = get_unaligned(data++);
+                        f[i].end   = get_unaligned(data++);
+
+                        BT_DBG("proto filter start %d end %d",
+                                f[i].start, f[i].end);
+                }
+
+                if (i < BNEP_MAX_PROTO_FILTERS)
+                        memset(f + i, 0, sizeof(*f));
+
+                if (n == 0)
+                        bnep_set_default_proto_filter(s);
+
+                bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_SUCCESS);
+        } else {
+                bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_LIMIT_REACHED);
+        }
+#else
+        bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_UNSUPPORTED_REQ);
+#endif
+        return 0;
+}
+
+static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
+{
+        int n;
+
+        if (len < 2)
+                return -EILSEQ;
+
+        n = ntohs(get_unaligned((u16 *) data)); 
+        data += 2; len -= 2;
+
+        if (len < n)
+                return -EILSEQ;
+
+        BT_DBG("filter len %d", n);
+
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+        n /= (ETH_ALEN * 2);
+
+        if (n > 0) {
+                s->mc_filter = 0;
+
+                /* Always send broadcast */
+                set_bit(bnep_mc_hash(s->dev->broadcast), (ulong *) &s->mc_filter);
+
+                /* Add address ranges to the multicast hash */
+                for (; n > 0; n--) {
+                        u8 a1[6], *a2;
+
+                        memcpy(a1, data, ETH_ALEN); data += ETH_ALEN;
+                        a2 = data; data += ETH_ALEN;
+        
+                        BT_DBG("mc filter %s -> %s",
+                                batostr((void *) a1), batostr((void *) a2));
+
+                        #define INCA(a) { int i = 5; while (i >=0 && ++a[i--] == 0); }
+
+                        /* Iterate from a1 to a2 */
+                        set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
+                        while (memcmp(a1, a2, 6) < 0 && s->mc_filter != ~0LL) {
+                                INCA(a1);
+                                set_bit(bnep_mc_hash(a1), (ulong *) &s->mc_filter);
+                        }
+                }
+        }
+
+        BT_DBG("mc filter hash 0x%llx", s->mc_filter);
+
+        bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_SUCCESS);
+#else
+        bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_FILTER_UNSUPPORTED_REQ);
+#endif
+        return 0;
+}
+
+static int bnep_rx_control(struct bnep_session *s, void *data, int len)
+{
+        u8  cmd = *(u8 *)data;
+        int err = 0;
+
+        data++; len--;
+
+        switch (cmd) {
+        case BNEP_CMD_NOT_UNDERSTOOD:
+        case BNEP_SETUP_CONN_REQ:
+        case BNEP_SETUP_CONN_RSP:
+        case BNEP_FILTER_NET_TYPE_RSP:
+        case BNEP_FILTER_MULTI_ADDR_RSP:
+                /* Ignore these for now */
+                break;
+
+        case BNEP_FILTER_NET_TYPE_SET:
+                err = bnep_ctrl_set_netfilter(s, data, len);
+                break;
+
+        case BNEP_FILTER_MULTI_ADDR_SET:
+                err = bnep_ctrl_set_mcfilter(s, data, len);
+                break;
+
+        default: {
+                        u8 pkt[3];
+                        pkt[0] = BNEP_CONTROL;
+                        pkt[1] = BNEP_CMD_NOT_UNDERSTOOD;
+                        pkt[2] = cmd;
+                        bnep_send(s, pkt, sizeof(pkt));
+                }
+                break;
+        }
+
+        return err;
+}
+
+static int bnep_rx_extension(struct bnep_session *s, struct sk_buff *skb)
+{
+        struct bnep_ext_hdr *h;
+        int err = 0;
+
+        do {
+                h = (void *) skb->data;
+                if (!skb_pull(skb, sizeof(*h))) {
+                        err = -EILSEQ;
+                        break;
+                }
+
+                BT_DBG("type 0x%x len %d", h->type, h->len);
+        
+                switch (h->type & BNEP_TYPE_MASK) {
+                case BNEP_EXT_CONTROL:
+                        bnep_rx_control(s, skb->data, skb->len);
+                        break;
+
+                default:
+                        /* Unknown extension, skip it. */
+                        break;
+                }
+
+                if (!skb_pull(skb, h->len)) {
+                        err = -EILSEQ;
+                        break;
+                }
+        } while (!err && (h->type & BNEP_EXT_HEADER));
+        
+        return err;
+}
+
+static u8 __bnep_rx_hlen[] = {
+        ETH_HLEN,     /* BNEP_GENERAL */
+        0,            /* BNEP_CONTROL */
+        2,            /* BNEP_COMPRESSED */
+        ETH_ALEN + 2, /* BNEP_COMPRESSED_SRC_ONLY */
+        ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */
+};
+#define BNEP_RX_TYPES   (sizeof(__bnep_rx_hlen) - 1)
+
+static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
+{
+        struct net_device *dev = s->dev;
+        struct sk_buff *nskb;
+        u8 type;
+
+        dev->last_rx = jiffies;
+        s->stats.rx_bytes += skb->len;
+
+        type = *(u8 *) skb->data; skb_pull(skb, 1);
+
+        if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)
+                goto badframe;
+        
+        if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
+                bnep_rx_control(s, skb->data, skb->len);
+                kfree_skb(skb);
+                return 0;
+        }
+
+        skb->mac.raw = skb->data;
+
+        /* Verify and pull out header */
+        if (!skb_pull(skb, __bnep_rx_hlen[type & BNEP_TYPE_MASK]))
+                goto badframe;
+
+        s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));
+
+        if (type & BNEP_EXT_HEADER) {
+                if (bnep_rx_extension(s, skb) < 0)
+                        goto badframe;
+        }
+
+        /* Strip 802.1p header */
+        if (ntohs(s->eh.h_proto) == 0x8100) {
+                if (!skb_pull(skb, 4))
+                        goto badframe;
+                s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));
+        }
+        
+        /* We have to alloc new skb and copy data here :(. Because original skb
+         * may not be modified and because of the alignment requirements. */
+        nskb = alloc_skb(2 + ETH_HLEN + skb->len, GFP_KERNEL);
+        if (!nskb) {
+                s->stats.rx_dropped++;
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+        skb_reserve(nskb, 2);
+
+        /* Decompress header and construct ether frame */
+        switch (type & BNEP_TYPE_MASK) {
+        case BNEP_COMPRESSED:
+                memcpy(__skb_put(nskb, ETH_HLEN), &s->eh, ETH_HLEN);
+                break;
+        
+        case BNEP_COMPRESSED_SRC_ONLY:
+                memcpy(__skb_put(nskb, ETH_ALEN), s->eh.h_dest, ETH_ALEN);
+                memcpy(__skb_put(nskb, ETH_ALEN), skb->mac.raw, ETH_ALEN);
+                put_unaligned(s->eh.h_proto, (u16 *) __skb_put(nskb, 2));
+                break;
+
+        case BNEP_COMPRESSED_DST_ONLY:
+                memcpy(__skb_put(nskb, ETH_ALEN), skb->mac.raw, ETH_ALEN);
+                memcpy(__skb_put(nskb, ETH_ALEN + 2), s->eh.h_source, ETH_ALEN + 2);
+                break;
+
+        case BNEP_GENERAL:
+                memcpy(__skb_put(nskb, ETH_ALEN * 2), skb->mac.raw, ETH_ALEN * 2);
+                put_unaligned(s->eh.h_proto, (u16 *) __skb_put(nskb, 2));
+                break;
+        }
+
+        memcpy(__skb_put(nskb, skb->len), skb->data, skb->len);
+        kfree_skb(skb);
+        
+        s->stats.rx_packets++;
+        nskb->dev       = dev;
+        nskb->ip_summed = CHECKSUM_NONE;
+        nskb->protocol  = eth_type_trans(nskb, dev);
+        netif_rx_ni(nskb);
+        return 0;
+
+badframe:
+        s->stats.rx_errors++;
+        kfree_skb(skb);
+        return 0;
+}
+
+static u8 __bnep_tx_types[] = {
+        BNEP_GENERAL,
+        BNEP_COMPRESSED_SRC_ONLY,
+        BNEP_COMPRESSED_DST_ONLY,
+        BNEP_COMPRESSED
+};
+
+static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
+{
+        struct ethhdr *eh = (void *) skb->data;
+        struct socket *sock = s->sock;
+        struct kvec iv[3];
+        int len = 0, il = 0;
+        u8 type = 0;
+
+        BT_DBG("skb %p dev %p type %d", skb, skb->dev, skb->pkt_type);
+
+        if (!skb->dev) {
+                /* Control frame sent by us */
+                goto send;
+        }
+
+        iv[il++] = (struct kvec) { &type, 1 };
+        len++;
+
+        if (!memcmp(eh->h_dest, s->eh.h_source, ETH_ALEN))
+                type |= 0x01;
+
+        if (!memcmp(eh->h_source, s->eh.h_dest, ETH_ALEN))
+                type |= 0x02;
+
+        if (type)
+                skb_pull(skb, ETH_ALEN * 2);
+
+        type = __bnep_tx_types[type];
+        switch (type) {
+        case BNEP_COMPRESSED_SRC_ONLY:
+                iv[il++] = (struct kvec) { eh->h_source, ETH_ALEN };
+                len += ETH_ALEN;
+                break;
+                
+        case BNEP_COMPRESSED_DST_ONLY:
+                iv[il++] = (struct kvec) { eh->h_dest, ETH_ALEN };
+                len += ETH_ALEN;
+                break;
+        }
+
+send:
+        iv[il++] = (struct kvec) { skb->data, skb->len };
+        len += skb->len;
+        
+        /* FIXME: linearize skb */
+        {
+                len = kernel_sendmsg(sock, &s->msg, iv, il, len);
+        }
+        kfree_skb(skb);
+
+        if (len > 0) {
+                s->stats.tx_bytes += len;
+                s->stats.tx_packets++;
+                return 0;
+        }
+
+        return len;
+}
+
+static int bnep_session(void *arg)
+{
+        struct bnep_session *s = arg;
+        struct net_device *dev = s->dev;
+        struct sock *sk = s->sock->sk;
+        struct sk_buff *skb;
+        wait_queue_t wait;
+
+        BT_DBG("");
+
+        daemonize("kbnepd %s", dev->name);
+        set_user_nice(current, -15);
+        current->flags |= PF_NOFREEZE;
+
+        init_waitqueue_entry(&wait, current);
+        add_wait_queue(sk->sk_sleep, &wait);
+        while (!atomic_read(&s->killed)) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                // RX
+                while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
+                        skb_orphan(skb);
+                        bnep_rx_frame(s, skb);
+                }
+
+                if (sk->sk_state != BT_CONNECTED)
+                        break;
+        
+                // TX
+                while ((skb = skb_dequeue(&sk->sk_write_queue)))
+                        if (bnep_tx_frame(s, skb))
+                                break;
+                netif_wake_queue(dev);
+        
+                schedule();
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+
+        /* Cleanup session */
+        down_write(&bnep_session_sem);
+
+        /* Delete network device */
+        unregister_netdev(dev);
+
+        /* Release the socket */
+        fput(s->sock->file);
+
+        __bnep_unlink_session(s);
+
+        up_write(&bnep_session_sem);
+        free_netdev(dev);
+        return 0;
+}
+
+int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
+{
+        struct net_device *dev;
+        struct bnep_session *s, *ss;
+        u8 dst[ETH_ALEN], src[ETH_ALEN];
+        int err;
+
+        BT_DBG("");
+
+        baswap((void *) dst, &bt_sk(sock->sk)->dst);
+        baswap((void *) src, &bt_sk(sock->sk)->src);
+
+        /* session struct allocated as private part of net_device */
+        dev = alloc_netdev(sizeof(struct bnep_session),
+                           (*req->device) ? req->device : "bnep%d",
+                           bnep_net_setup);
+        if (!dev) 
+                return ENOMEM;
+
+
+        down_write(&bnep_session_sem);
+
+        ss = __bnep_get_session(dst);
+        if (ss && ss->state == BT_CONNECTED) {
+                err = -EEXIST;
+                goto failed;
+        }
+
+        s = dev->priv;
+
+        /* This is rx header therefore addresses are swapped.
+         * ie eh.h_dest is our local address. */
+        memcpy(s->eh.h_dest,   &src, ETH_ALEN);
+        memcpy(s->eh.h_source, &dst, ETH_ALEN);
+        memcpy(dev->dev_addr, s->eh.h_dest, ETH_ALEN);
+
+        s->dev = dev;
+        s->sock  = sock;
+        s->role  = req->role;
+        s->state = BT_CONNECTED;
+        
+        s->msg.msg_flags = MSG_NOSIGNAL;
+
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+        /* Set default mc filter */
+        set_bit(bnep_mc_hash(dev->broadcast), (ulong *) &s->mc_filter);
+#endif
+
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+        /* Set default protocol filter */
+        bnep_set_default_proto_filter(s);
+#endif
+
+        err = register_netdev(dev);
+        if (err) {
+                goto failed;
+        }
+
+        __bnep_link_session(s);
+        
+        err = kernel_thread(bnep_session, s, CLONE_KERNEL);
+        if (err < 0) {
+                /* Session thread start failed, gotta cleanup. */
+                unregister_netdev(dev);
+                __bnep_unlink_session(s);
+                goto failed;
+        }
+
+        up_write(&bnep_session_sem);
+        strcpy(req->device, dev->name);
+        return 0;
+
+failed:
+        up_write(&bnep_session_sem);
+        free_netdev(dev);
+        return err;
+}
+
+int bnep_del_connection(struct bnep_conndel_req *req)
+{
+        struct bnep_session *s;
+        int  err = 0;
+
+        BT_DBG("");
+
+        down_read(&bnep_session_sem);
+
+        s = __bnep_get_session(req->dst);
+        if (s) {
+                /* Wakeup user-space which is polling for socket errors.
+                 * This is temporary hack untill we have shutdown in L2CAP */
+                s->sock->sk->sk_err = EUNATCH;
+                
+                /* Kill session thread */
+                atomic_inc(&s->killed);
+                wake_up_interruptible(s->sock->sk->sk_sleep);
+        } else
+                err = -ENOENT;
+
+        up_read(&bnep_session_sem);
+        return err;
+}
+
+static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
+{
+        memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
+        strcpy(ci->device, s->dev->name);
+        ci->flags = s->flags;
+        ci->state = s->state;
+        ci->role  = s->role;
+}
+
+int bnep_get_connlist(struct bnep_connlist_req *req)
+{
+        struct list_head *p;
+        int err = 0, n = 0;
+
+        down_read(&bnep_session_sem);
+
+        list_for_each(p, &bnep_session_list) {
+                struct bnep_session *s;
+                struct bnep_conninfo ci;
+
+                s = list_entry(p, struct bnep_session, list);
+
+                __bnep_copy_ci(&ci, s);
+                
+                if (copy_to_user(req->ci, &ci, sizeof(ci))) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (++n >= req->cnum)
+                        break;
+
+                req->ci++;
+        }
+        req->cnum = n;
+
+        up_read(&bnep_session_sem);
+        return err;
+}
+
+int bnep_get_conninfo(struct bnep_conninfo *ci)
+{
+        struct bnep_session *s;
+        int err = 0;
+
+        down_read(&bnep_session_sem);
+
+        s = __bnep_get_session(ci->dst);
+        if (s)
+                __bnep_copy_ci(ci, s);
+        else
+                err = -ENOENT;
+
+        up_read(&bnep_session_sem);
+        return err;
+}
+
+static int __init bnep_init(void)
+{       
+        char flt[50] = "";
+
+        l2cap_load();
+
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+        strcat(flt, "protocol ");
+#endif
+
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+        strcat(flt, "multicast");
+#endif
+
+        BT_INFO("BNEP (Ethernet Emulation) ver %s", VERSION);
+        if (flt[0])
+                BT_INFO("BNEP filters: %s", flt);
+
+        bnep_sock_init();
+        return 0;
+}
+
+static void __exit bnep_exit(void)
+{
+        bnep_sock_cleanup();
+}
+
+module_init(bnep_init);
+module_exit(bnep_exit);
+
+MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>");
+MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-4");
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
new file mode 100644
index 000000000000..921204f95f4a
--- /dev/null
+++ b/net/bluetooth/bnep/netdev.c
@@ -0,0 +1,247 @@
+/* 
+   BNEP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2001-2002 Inventel Systemes
+   Written 2001-2002 by
+        Clément Moreau <clement.moreau@inventel.fr>
+        David Libault  <david.libault@inventel.fr>
+
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * $Id: netdev.c,v 1.8 2002/08/04 21:23:58 maxk Exp $
+ */ 
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/socket.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+#include <linux/wait.h>
+
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+
+#include "bnep.h"
+
+#ifndef CONFIG_BT_BNEP_DEBUG
+#undef  BT_DBG
+#define BT_DBG( A... )
+#endif
+
+#define BNEP_TX_QUEUE_LEN 20
+
+static int bnep_net_open(struct net_device *dev)
+{
+        netif_start_queue(dev);
+        return 0;
+}
+
+static int bnep_net_close(struct net_device *dev)
+{
+        netif_stop_queue(dev);
+        return 0;
+}
+
+static struct net_device_stats *bnep_net_get_stats(struct net_device *dev)
+{
+        struct bnep_session *s = dev->priv;
+        return &s->stats;
+}
+
+static void bnep_net_set_mc_list(struct net_device *dev)
+{
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+        struct bnep_session *s = dev->priv;
+        struct sock *sk = s->sock->sk;
+        struct bnep_set_filter_req *r;
+        struct sk_buff *skb;
+        int size;
+
+        BT_DBG("%s mc_count %d", dev->name, dev->mc_count);
+
+        size = sizeof(*r) + (BNEP_MAX_MULTICAST_FILTERS + 1) * ETH_ALEN * 2;
+        skb  = alloc_skb(size, GFP_ATOMIC);
+        if (!skb) {
+                BT_ERR("%s Multicast list allocation failed", dev->name);
+                return;
+        }
+
+        r = (void *) skb->data;
+        __skb_put(skb, sizeof(*r));
+
+        r->type = BNEP_CONTROL;
+        r->ctrl = BNEP_FILTER_MULTI_ADDR_SET;
+
+        if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
+                u8 start[ETH_ALEN] = { 0x01 };
+
+                /* Request all addresses */
+                memcpy(__skb_put(skb, ETH_ALEN), start, ETH_ALEN);
+                memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
+                r->len = htons(ETH_ALEN * 2);
+        } else {
+                struct dev_mc_list *dmi = dev->mc_list;
+                int i, len = skb->len;
+
+                if (dev->flags & IFF_BROADCAST) {
+                        memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
+                        memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
+                }       
+                
+                /* FIXME: We should group addresses here. */
+
+                for (i = 0; i < dev->mc_count && i < BNEP_MAX_MULTICAST_FILTERS; i++) {
+                        memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
+                        memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
+                        dmi = dmi->next;
+                }
+                r->len = htons(skb->len - len);
+        }
+
+        skb_queue_tail(&sk->sk_write_queue, skb);
+        wake_up_interruptible(sk->sk_sleep);
+#endif
+}
+
+static int bnep_net_set_mac_addr(struct net_device *dev, void *arg)
+{
+        BT_DBG("%s", dev->name);
+        return 0;
+}
+
+static void bnep_net_timeout(struct net_device *dev)
+{
+        BT_DBG("net_timeout");
+        netif_wake_queue(dev);
+}
+
+static int bnep_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+{
+        return -EINVAL;
+}
+
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+static inline int bnep_net_mc_filter(struct sk_buff *skb, struct bnep_session *s)
+{
+        struct ethhdr *eh = (void *) skb->data;
+
+        if ((eh->h_dest[0] & 1) && !test_bit(bnep_mc_hash(eh->h_dest), (ulong *) &s->mc_filter))
+                return 1;
+        return 0;
+}
+#endif
+
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+/* Determine ether protocol. Based on eth_type_trans. */
+static inline u16 bnep_net_eth_proto(struct sk_buff *skb)
+{
+        struct ethhdr *eh = (void *) skb->data;
+        
+        if (ntohs(eh->h_proto) >= 1536)
+                return eh->h_proto;
+                
+        if (get_unaligned((u16 *) skb->data) == 0xFFFF)
+                return htons(ETH_P_802_3);
+                
+        return htons(ETH_P_802_2);
+}
+
+static inline int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session *s)
+{
+        u16 proto = bnep_net_eth_proto(skb);
+        struct bnep_proto_filter *f = s->proto_filter;
+        int i;
+        
+        for (i = 0; i < BNEP_MAX_PROTO_FILTERS && f[i].end; i++) {
+                if (proto >= f[i].start && proto <= f[i].end)
+                        return 0;
+        }
+
+        BT_DBG("BNEP: filtered skb %p, proto 0x%.4x", skb, proto);
+        return 1;
+}
+#endif
+
+static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct bnep_session *s = dev->priv;
+        struct sock *sk = s->sock->sk;
+
+        BT_DBG("skb %p, dev %p", skb, dev);
+
+#ifdef CONFIG_BT_BNEP_MC_FILTER
+        if (bnep_net_mc_filter(skb, s)) {
+                kfree_skb(skb);
+                return 0;
+        }
+#endif
+        
+#ifdef CONFIG_BT_BNEP_PROTO_FILTER
+        if (bnep_net_proto_filter(skb, s)) {
+                kfree_skb(skb);
+                return 0;
+        }
+#endif
+        
+        /*
+         * We cannot send L2CAP packets from here as we are potentially in a bh.
+         * So we have to queue them and wake up session thread which is sleeping
+         * on the sk->sk_sleep.
+         */
+        dev->trans_start = jiffies;
+        skb_queue_tail(&sk->sk_write_queue, skb);
+        wake_up_interruptible(sk->sk_sleep);
+
+        if (skb_queue_len(&sk->sk_write_queue) >= BNEP_TX_QUEUE_LEN) {
+                BT_DBG("tx queue is full");
+
+                /* Stop queuing.
+                 * Session thread will do netif_wake_queue() */
+                netif_stop_queue(dev);
+        }
+
+        return 0;
+}
+
+void bnep_net_setup(struct net_device *dev)
+{
+
+        memset(dev->broadcast, 0xff, ETH_ALEN);
+        dev->addr_len = ETH_ALEN;
+
+        ether_setup(dev);
+
+        dev->open            = bnep_net_open;
+        dev->stop            = bnep_net_close;
+        dev->hard_start_xmit = bnep_net_xmit;
+        dev->get_stats       = bnep_net_get_stats;
+        dev->do_ioctl        = bnep_net_ioctl;
+        dev->set_mac_address = bnep_net_set_mac_addr;
+        dev->set_multicast_list = bnep_net_set_mc_list;
+
+        dev->watchdog_timeo  = HZ * 2;
+        dev->tx_timeout      = bnep_net_timeout;
+}
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
new file mode 100644
index 000000000000..9a8d99a39b6d
--- /dev/null
+++ b/net/bluetooth/bnep/sock.c
@@ -0,0 +1,237 @@
+/* 
+   BNEP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2001-2002 Inventel Systemes
+   Written 2001-2002 by
+        David Libault  <david.libault@inventel.fr>
+
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * $Id: sock.c,v 1.4 2002/08/04 21:23:58 maxk Exp $
+ */ 
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <linux/init.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+#include "bnep.h"
+
+#ifndef CONFIG_BT_BNEP_DEBUG
+#undef  BT_DBG
+#define BT_DBG( A... )
+#endif
+
+static int bnep_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        sock_orphan(sk);
+        sock_put(sk);
+        return 0;
+}
+
+static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct bnep_connlist_req cl;
+        struct bnep_connadd_req  ca;
+        struct bnep_conndel_req  cd;
+        struct bnep_conninfo ci;
+        struct socket *nsock;
+        void __user *argp = (void __user *)arg;
+        int err;
+
+        BT_DBG("cmd %x arg %lx", cmd, arg);
+
+        switch (cmd) {
+        case BNEPCONNADD:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&ca, argp, sizeof(ca)))
+                        return -EFAULT;
+        
+                nsock = sockfd_lookup(ca.sock, &err);
+                if (!nsock)
+                        return err;
+
+                if (nsock->sk->sk_state != BT_CONNECTED) {
+                        fput(nsock->file);
+                        return -EBADFD;
+                }
+
+                err = bnep_add_connection(&ca, nsock);
+                if (!err) {
+                        if (copy_to_user(argp, &ca, sizeof(ca)))
+                                err = -EFAULT;
+                } else
+                        fput(nsock->file);
+
+                return err;
+        
+        case BNEPCONNDEL:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&cd, argp, sizeof(cd)))
+                        return -EFAULT;
+        
+                return bnep_del_connection(&cd);
+
+        case BNEPGETCONNLIST:
+                if (copy_from_user(&cl, argp, sizeof(cl)))
+                        return -EFAULT;
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+        
+                err = bnep_get_connlist(&cl);
+                if (!err && copy_to_user(argp, &cl, sizeof(cl)))
+                        return -EFAULT;
+
+                return err;
+
+        case BNEPGETCONNINFO:
+                if (copy_from_user(&ci, argp, sizeof(ci)))
+                        return -EFAULT;
+
+                err = bnep_get_conninfo(&ci);
+                if (!err && copy_to_user(argp, &ci, sizeof(ci)))
+                        return -EFAULT;
+
+                return err;
+
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct proto_ops bnep_sock_ops = {
+        .family     = PF_BLUETOOTH,
+        .owner      = THIS_MODULE,
+        .release    = bnep_sock_release,
+        .ioctl      = bnep_sock_ioctl,
+        .bind       = sock_no_bind,
+        .getname    = sock_no_getname,
+        .sendmsg    = sock_no_sendmsg,
+        .recvmsg    = sock_no_recvmsg,
+        .poll       = sock_no_poll,
+        .listen     = sock_no_listen,
+        .shutdown   = sock_no_shutdown,
+        .setsockopt = sock_no_setsockopt,
+        .getsockopt = sock_no_getsockopt,
+        .connect    = sock_no_connect,
+        .socketpair = sock_no_socketpair,
+        .accept     = sock_no_accept,
+        .mmap       = sock_no_mmap
+};
+
+static struct proto bnep_proto = {
+        .name           = "BNEP",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct bt_sock)
+};
+
+static int bnep_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        if (sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &bnep_proto, 1);
+        if (!sk)
+                return -ENOMEM;
+
+        sock_init_data(sock, sk);
+
+        sock->ops = &bnep_sock_ops;
+
+        sock->state = SS_UNCONNECTED;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = protocol;
+        sk->sk_state    = BT_OPEN;
+
+        return 0;
+}
+
+static struct net_proto_family bnep_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = bnep_sock_create
+};
+
+int __init bnep_sock_init(void)
+{
+        int err;
+
+        err = proto_register(&bnep_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_BNEP, &bnep_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        return 0;
+
+error:
+        BT_ERR("Can't register BNEP socket");
+        proto_unregister(&bnep_proto);
+        return err;
+}
+
+int __exit bnep_sock_cleanup(void)
+{
+        if (bt_sock_unregister(BTPROTO_BNEP) < 0)
+                BT_ERR("Can't unregister BNEP socket");
+
+        proto_unregister(&bnep_proto);
+
+        return 0;
+}
diff --git a/net/bluetooth/cmtp/Kconfig b/net/bluetooth/cmtp/Kconfig
new file mode 100644
index 000000000000..d6b0382f6f3a
--- /dev/null
+++ b/net/bluetooth/cmtp/Kconfig
@@ -0,0 +1,11 @@
+config BT_CMTP
+        tristate "CMTP protocol support"
+        depends on BT && BT_L2CAP && ISDN_CAPI
+        help
+          CMTP (CAPI Message Transport Protocol) is a transport layer
+          for CAPI messages.  CMTP is required for the Bluetooth Common
+          ISDN Access Profile.
+
+          Say Y here to compile CMTP support into the kernel or say M to
+          compile it as module (cmtp).
+
diff --git a/net/bluetooth/cmtp/Makefile b/net/bluetooth/cmtp/Makefile
new file mode 100644
index 000000000000..890a9a5a6861
--- /dev/null
+++ b/net/bluetooth/cmtp/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for the Linux Bluetooth CMTP layer
+#
+
+obj-$(CONFIG_BT_CMTP) += cmtp.o
+
+cmtp-objs := core.o sock.o capi.o
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
new file mode 100644
index 000000000000..1e5c030b72ad
--- /dev/null
+++ b/net/bluetooth/cmtp/capi.c
@@ -0,0 +1,600 @@
+/* 
+   CMTP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <linux/wait.h>
+#include <net/sock.h>
+
+#include <linux/isdn/capilli.h>
+#include <linux/isdn/capicmd.h>
+#include <linux/isdn/capiutil.h>
+
+#include "cmtp.h"
+
+#ifndef CONFIG_BT_CMTP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define CAPI_INTEROPERABILITY           0x20
+
+#define CAPI_INTEROPERABILITY_REQ       CAPICMD(CAPI_INTEROPERABILITY, CAPI_REQ)
+#define CAPI_INTEROPERABILITY_CONF      CAPICMD(CAPI_INTEROPERABILITY, CAPI_CONF)
+#define CAPI_INTEROPERABILITY_IND       CAPICMD(CAPI_INTEROPERABILITY, CAPI_IND)
+#define CAPI_INTEROPERABILITY_RESP      CAPICMD(CAPI_INTEROPERABILITY, CAPI_RESP)
+
+#define CAPI_INTEROPERABILITY_REQ_LEN   (CAPI_MSG_BASELEN + 2)
+#define CAPI_INTEROPERABILITY_CONF_LEN  (CAPI_MSG_BASELEN + 4)
+#define CAPI_INTEROPERABILITY_IND_LEN   (CAPI_MSG_BASELEN + 2)
+#define CAPI_INTEROPERABILITY_RESP_LEN  (CAPI_MSG_BASELEN + 2)
+
+#define CAPI_FUNCTION_REGISTER          0
+#define CAPI_FUNCTION_RELEASE           1
+#define CAPI_FUNCTION_GET_PROFILE       2
+#define CAPI_FUNCTION_GET_MANUFACTURER  3
+#define CAPI_FUNCTION_GET_VERSION       4
+#define CAPI_FUNCTION_GET_SERIAL_NUMBER 5
+#define CAPI_FUNCTION_MANUFACTURER      6
+#define CAPI_FUNCTION_LOOPBACK          7
+
+
+#define CMTP_MSGNUM     1
+#define CMTP_APPLID     2
+#define CMTP_MAPPING    3
+
+static struct cmtp_application *cmtp_application_add(struct cmtp_session *session, __u16 appl)
+{
+        struct cmtp_application *app = kmalloc(sizeof(*app), GFP_KERNEL);
+
+        BT_DBG("session %p application %p appl %d", session, app, appl);
+
+        if (!app)
+                return NULL;
+
+        memset(app, 0, sizeof(*app));
+
+        app->state = BT_OPEN;
+        app->appl = appl;
+
+        list_add_tail(&app->list, &session->applications);
+
+        return app;
+}
+
+static void cmtp_application_del(struct cmtp_session *session, struct cmtp_application *app)
+{
+        BT_DBG("session %p application %p", session, app);
+
+        if (app) {
+                list_del(&app->list);
+                kfree(app);
+        }
+}
+
+static struct cmtp_application *cmtp_application_get(struct cmtp_session *session, int pattern, __u16 value)
+{
+        struct cmtp_application *app;
+        struct list_head *p, *n;
+
+        list_for_each_safe(p, n, &session->applications) {
+                app = list_entry(p, struct cmtp_application, list);
+                switch (pattern) {
+                case CMTP_MSGNUM:
+                        if (app->msgnum == value)
+                                return app;
+                        break;
+                case CMTP_APPLID:
+                        if (app->appl == value)
+                                return app;
+                        break;
+                case CMTP_MAPPING:
+                        if (app->mapping == value)
+                                return app;
+                        break;
+                }
+        }
+
+        return NULL;
+}
+
+static int cmtp_msgnum_get(struct cmtp_session *session)
+{
+        session->msgnum++;
+
+        if ((session->msgnum & 0xff) > 200)
+                session->msgnum = CMTP_INITIAL_MSGNUM + 1;
+
+        return session->msgnum;
+}
+
+static void cmtp_send_capimsg(struct cmtp_session *session, struct sk_buff *skb)
+{
+        struct cmtp_scb *scb = (void *) skb->cb;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        scb->id = -1;
+        scb->data = (CAPIMSG_COMMAND(skb->data) == CAPI_DATA_B3);
+
+        skb_queue_tail(&session->transmit, skb);
+
+        cmtp_schedule(session);
+}
+
+static void cmtp_send_interopmsg(struct cmtp_session *session,
+                                        __u8 subcmd, __u16 appl, __u16 msgnum,
+                                        __u16 function, unsigned char *buf, int len)
+{
+        struct sk_buff *skb;
+        unsigned char *s;
+
+        BT_DBG("session %p subcmd 0x%02x appl %d msgnum %d", session, subcmd, appl, msgnum);
+
+        if (!(skb = alloc_skb(CAPI_MSG_BASELEN + 6 + len, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for interoperability packet");
+                return;
+        }
+
+        s = skb_put(skb, CAPI_MSG_BASELEN + 6 + len);
+
+        capimsg_setu16(s, 0, CAPI_MSG_BASELEN + 6 + len);
+        capimsg_setu16(s, 2, appl);
+        capimsg_setu8 (s, 4, CAPI_INTEROPERABILITY);
+        capimsg_setu8 (s, 5, subcmd);
+        capimsg_setu16(s, 6, msgnum);
+
+        /* Interoperability selector (Bluetooth Device Management) */
+        capimsg_setu16(s, 8, 0x0001);
+
+        capimsg_setu8 (s, 10, 3 + len);
+        capimsg_setu16(s, 11, function);
+        capimsg_setu8 (s, 13, len);
+
+        if (len > 0)
+                memcpy(s + 14, buf, len);
+
+        cmtp_send_capimsg(session, skb);
+}
+
+static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *skb)
+{
+        struct capi_ctr *ctrl = &session->ctrl;
+        struct cmtp_application *application;
+        __u16 appl, msgnum, func, info;
+        __u32 controller;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        switch (CAPIMSG_SUBCOMMAND(skb->data)) {
+        case CAPI_CONF:
+                func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
+                info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
+
+                switch (func) {
+                case CAPI_FUNCTION_REGISTER:
+                        msgnum = CAPIMSG_MSGID(skb->data);
+
+                        application = cmtp_application_get(session, CMTP_MSGNUM, msgnum);
+                        if (application) {
+                                application->state = BT_CONNECTED;
+                                application->msgnum = 0;
+                                application->mapping = CAPIMSG_APPID(skb->data);
+                                wake_up_interruptible(&session->wait);
+                        }
+
+                        break;
+
+                case CAPI_FUNCTION_RELEASE:
+                        appl = CAPIMSG_APPID(skb->data);
+
+                        application = cmtp_application_get(session, CMTP_MAPPING, appl);
+                        if (application) {
+                                application->state = BT_CLOSED;
+                                application->msgnum = 0;
+                                wake_up_interruptible(&session->wait);
+                        }
+
+                        break;
+
+                case CAPI_FUNCTION_GET_PROFILE:
+                        controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
+                        msgnum = CAPIMSG_MSGID(skb->data);
+
+                        if (!info && (msgnum == CMTP_INITIAL_MSGNUM)) {
+                                session->ncontroller = controller;
+                                wake_up_interruptible(&session->wait);
+                                break;
+                        }
+
+                        if (!info && ctrl) {
+                                memcpy(&ctrl->profile,
+                                        skb->data + CAPI_MSG_BASELEN + 11,
+                                        sizeof(capi_profile));
+                                session->state = BT_CONNECTED;
+                                capi_ctr_ready(ctrl);
+                        }
+
+                        break;
+
+                case CAPI_FUNCTION_GET_MANUFACTURER:
+                        controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
+
+                        if (!info && ctrl) {
+                                strncpy(ctrl->manu,
+                                        skb->data + CAPI_MSG_BASELEN + 15,
+                                        skb->data[CAPI_MSG_BASELEN + 14]);
+                        }
+
+                        break;
+
+                case CAPI_FUNCTION_GET_VERSION:
+                        controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
+
+                        if (!info && ctrl) {
+                                ctrl->version.majorversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 16);
+                                ctrl->version.minorversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 20);
+                                ctrl->version.majormanuversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 24);
+                                ctrl->version.minormanuversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 28);
+                        }
+
+                        break;
+
+                case CAPI_FUNCTION_GET_SERIAL_NUMBER:
+                        controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
+
+                        if (!info && ctrl) {
+                                memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
+                                strncpy(ctrl->serial,
+                                        skb->data + CAPI_MSG_BASELEN + 17,
+                                        skb->data[CAPI_MSG_BASELEN + 16]);
+                        }
+
+                        break;
+                }
+
+                break;
+
+        case CAPI_IND:
+                func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
+
+                if (func == CAPI_FUNCTION_LOOPBACK) {
+                        appl = CAPIMSG_APPID(skb->data);
+                        msgnum = CAPIMSG_MSGID(skb->data);
+                        cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
+                                                skb->data + CAPI_MSG_BASELEN + 6,
+                                                skb->data[CAPI_MSG_BASELEN + 5]);
+                }
+
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
+{
+        struct capi_ctr *ctrl = &session->ctrl;
+        struct cmtp_application *application;
+        __u16 cmd, appl;
+        __u32 contr;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
+                cmtp_recv_interopmsg(session, skb);
+                return;
+        }
+
+        if (session->flags & (1 << CMTP_LOOPBACK)) {
+                kfree_skb(skb);
+                return;
+        }
+
+        cmd = CAPICMD(CAPIMSG_COMMAND(skb->data), CAPIMSG_SUBCOMMAND(skb->data));
+        appl = CAPIMSG_APPID(skb->data);
+        contr = CAPIMSG_CONTROL(skb->data);
+
+        application = cmtp_application_get(session, CMTP_MAPPING, appl);
+        if (application) {
+                appl = application->appl;
+                CAPIMSG_SETAPPID(skb->data, appl);
+        } else {
+                BT_ERR("Can't find application with id %d", appl);
+                kfree_skb(skb);
+                return;
+        }
+
+        if ((contr & 0x7f) == 0x01) {
+                contr = (contr & 0xffffff80) | session->num;
+                CAPIMSG_SETCONTROL(skb->data, contr);
+        }
+
+        if (!ctrl) {
+                BT_ERR("Can't find controller %d for message", session->num);
+                kfree_skb(skb);
+                return;
+        }
+
+        capi_ctr_handle_message(ctrl, appl, skb);
+}
+
+static int cmtp_load_firmware(struct capi_ctr *ctrl, capiloaddata *data)
+{
+        BT_DBG("ctrl %p data %p", ctrl, data);
+
+        return 0;
+}
+
+static void cmtp_reset_ctr(struct capi_ctr *ctrl)
+{
+        struct cmtp_session *session = ctrl->driverdata;
+
+        BT_DBG("ctrl %p", ctrl);
+
+        capi_ctr_reseted(ctrl);
+
+        atomic_inc(&session->terminate);
+        cmtp_schedule(session);
+}
+
+static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct cmtp_session *session = ctrl->driverdata;
+        struct cmtp_application *application;
+        unsigned long timeo = CMTP_INTEROP_TIMEOUT;
+        unsigned char buf[8];
+        int err = 0, nconn, want = rp->level3cnt;
+
+        BT_DBG("ctrl %p appl %d level3cnt %d datablkcnt %d datablklen %d",
+                ctrl, appl, rp->level3cnt, rp->datablkcnt, rp->datablklen);
+
+        application = cmtp_application_add(session, appl);
+        if (!application) {
+                BT_ERR("Can't allocate memory for new application");
+                return;
+        }
+
+        if (want < 0)
+                nconn = ctrl->profile.nbchannel * -want;
+        else
+                nconn = want;
+
+        if (nconn == 0)
+                nconn = ctrl->profile.nbchannel;
+
+        capimsg_setu16(buf, 0, nconn);
+        capimsg_setu16(buf, 2, rp->datablkcnt);
+        capimsg_setu16(buf, 4, rp->datablklen);
+
+        application->state = BT_CONFIG;
+        application->msgnum = cmtp_msgnum_get(session);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0x0000, application->msgnum,
+                                CAPI_FUNCTION_REGISTER, buf, 6);
+
+        add_wait_queue(&session->wait, &wait);
+        while (1) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                if (application->state == BT_CLOSED) {
+                        err = -application->err;
+                        break;
+                }
+
+                if (application->state == BT_CONNECTED)
+                        break;
+
+                if (signal_pending(current)) {
+                        err = -EINTR;
+                        break;
+                }
+
+                timeo = schedule_timeout(timeo);
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(&session->wait, &wait);
+
+        if (err) {
+                cmtp_application_del(session, application);
+                return;
+        }
+}
+
+static void cmtp_release_appl(struct capi_ctr *ctrl, __u16 appl)
+{
+        struct cmtp_session *session = ctrl->driverdata;
+        struct cmtp_application *application;
+
+        BT_DBG("ctrl %p appl %d", ctrl, appl);
+
+        application = cmtp_application_get(session, CMTP_APPLID, appl);
+        if (!application) {
+                BT_ERR("Can't find application");
+                return;
+        }
+
+        application->msgnum = cmtp_msgnum_get(session);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, application->mapping, application->msgnum,
+                                CAPI_FUNCTION_RELEASE, NULL, 0);
+
+        wait_event_interruptible_timeout(session->wait,
+                        (application->state == BT_CLOSED), CMTP_INTEROP_TIMEOUT);
+
+        cmtp_application_del(session, application);
+}
+
+static u16 cmtp_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
+{
+        struct cmtp_session *session = ctrl->driverdata;
+        struct cmtp_application *application;
+        __u16 appl;
+        __u32 contr;
+
+        BT_DBG("ctrl %p skb %p", ctrl, skb);
+
+        appl = CAPIMSG_APPID(skb->data);
+        contr = CAPIMSG_CONTROL(skb->data);
+
+        application = cmtp_application_get(session, CMTP_APPLID, appl);
+        if ((!application) || (application->state != BT_CONNECTED)) {
+                BT_ERR("Can't find application with id %d", appl);
+                return CAPI_ILLAPPNR;
+        }
+
+        CAPIMSG_SETAPPID(skb->data, application->mapping);
+
+        if ((contr & 0x7f) == session->num) {
+                contr = (contr & 0xffffff80) | 0x01;
+                CAPIMSG_SETCONTROL(skb->data, contr);
+        }
+
+        cmtp_send_capimsg(session, skb);
+
+        return CAPI_NOERROR;
+}
+
+static char *cmtp_procinfo(struct capi_ctr *ctrl)
+{
+        return "CAPI Message Transport Protocol";
+}
+
+static int cmtp_ctr_read_proc(char *page, char **start, off_t off, int count, int *eof, struct capi_ctr *ctrl)
+{
+        struct cmtp_session *session = ctrl->driverdata;
+        struct cmtp_application *app;
+        struct list_head *p, *n;
+        int len = 0;
+
+        len += sprintf(page + len, "%s\n\n", cmtp_procinfo(ctrl));
+        len += sprintf(page + len, "addr %s\n", session->name);
+        len += sprintf(page + len, "ctrl %d\n", session->num);
+
+        list_for_each_safe(p, n, &session->applications) {
+                app = list_entry(p, struct cmtp_application, list);
+                len += sprintf(page + len, "appl %d -> %d\n", app->appl, app->mapping);
+        }
+
+        if (off + count >= len)
+                *eof = 1;
+
+        if (len < off)
+                return 0;
+
+        *start = page + off;
+
+        return ((count < len - off) ? count : len - off);
+}
+
+
+int cmtp_attach_device(struct cmtp_session *session)
+{
+        unsigned char buf[4];
+        long ret;
+
+        BT_DBG("session %p", session);
+
+        capimsg_setu32(buf, 0, 0);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, CMTP_INITIAL_MSGNUM,
+                                CAPI_FUNCTION_GET_PROFILE, buf, 4);
+
+        ret = wait_event_interruptible_timeout(session->wait,
+                        session->ncontroller, CMTP_INTEROP_TIMEOUT);
+        
+        BT_INFO("Found %d CAPI controller(s) on device %s", session->ncontroller, session->name);
+
+        if (!ret)
+                return -ETIMEDOUT;
+
+        if (!session->ncontroller)
+                return -ENODEV;
+
+        if (session->ncontroller > 1)
+                BT_INFO("Setting up only CAPI controller 1");
+
+        session->ctrl.owner      = THIS_MODULE;
+        session->ctrl.driverdata = session;
+        strcpy(session->ctrl.name, session->name);
+
+        session->ctrl.driver_name   = "cmtp";
+        session->ctrl.load_firmware = cmtp_load_firmware;
+        session->ctrl.reset_ctr     = cmtp_reset_ctr;
+        session->ctrl.register_appl = cmtp_register_appl;
+        session->ctrl.release_appl  = cmtp_release_appl;
+        session->ctrl.send_message  = cmtp_send_message;
+
+        session->ctrl.procinfo      = cmtp_procinfo;
+        session->ctrl.ctr_read_proc = cmtp_ctr_read_proc;
+
+        if (attach_capi_ctr(&session->ctrl) < 0) {
+                BT_ERR("Can't attach new controller");
+                return -EBUSY;
+        }
+
+        session->num = session->ctrl.cnr;
+
+        BT_DBG("session %p num %d", session, session->num);
+
+        capimsg_setu32(buf, 0, 1);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
+                                CAPI_FUNCTION_GET_MANUFACTURER, buf, 4);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
+                                CAPI_FUNCTION_GET_VERSION, buf, 4);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
+                                CAPI_FUNCTION_GET_SERIAL_NUMBER, buf, 4);
+
+        cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
+                                CAPI_FUNCTION_GET_PROFILE, buf, 4);
+
+        return 0;
+}
+
+void cmtp_detach_device(struct cmtp_session *session)
+{
+        BT_DBG("session %p", session);
+
+        detach_capi_ctr(&session->ctrl);
+}
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
new file mode 100644
index 000000000000..40e3dfec0cc8
--- /dev/null
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -0,0 +1,135 @@
+/* 
+   CMTP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#ifndef __CMTP_H
+#define __CMTP_H
+
+#include <linux/types.h>
+#include <net/bluetooth/bluetooth.h>
+
+#define BTNAMSIZ 18
+
+/* CMTP ioctl defines */
+#define CMTPCONNADD     _IOW('C', 200, int)
+#define CMTPCONNDEL     _IOW('C', 201, int)
+#define CMTPGETCONNLIST _IOR('C', 210, int)
+#define CMTPGETCONNINFO _IOR('C', 211, int)
+
+#define CMTP_LOOPBACK   0
+
+struct cmtp_connadd_req {
+        int   sock;     // Connected socket
+        __u32 flags;
+};
+
+struct cmtp_conndel_req {
+        bdaddr_t bdaddr;
+        __u32    flags;
+};
+
+struct cmtp_conninfo {
+        bdaddr_t bdaddr;
+        __u32    flags;
+        __u16    state;
+        int      num;
+};
+
+struct cmtp_connlist_req {
+        __u32  cnum;
+        struct cmtp_conninfo __user *ci;
+};
+
+int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock);
+int cmtp_del_connection(struct cmtp_conndel_req *req);
+int cmtp_get_connlist(struct cmtp_connlist_req *req);
+int cmtp_get_conninfo(struct cmtp_conninfo *ci);
+
+/* CMTP session defines */
+#define CMTP_INTEROP_TIMEOUT    (HZ * 5)
+#define CMTP_INITIAL_MSGNUM     0xff00
+
+struct cmtp_session {
+        struct list_head list;
+
+        struct socket *sock;
+
+        bdaddr_t bdaddr;
+
+        unsigned long state;
+        unsigned long flags;
+
+        uint mtu;
+
+        char name[BTNAMSIZ];
+
+        atomic_t terminate;
+
+        wait_queue_head_t wait;
+
+        int ncontroller;
+        int num;
+        struct capi_ctr ctrl;
+
+        struct list_head applications;
+
+        unsigned long blockids;
+        int msgnum;
+
+        struct sk_buff_head transmit;
+
+        struct sk_buff *reassembly[16];
+};
+
+struct cmtp_application {
+        struct list_head list;
+
+        unsigned long state;
+        int err;
+
+        __u16 appl;
+        __u16 mapping;
+
+        __u16 msgnum;
+};
+
+struct cmtp_scb {
+        int id;
+        int data;
+};
+
+int  cmtp_attach_device(struct cmtp_session *session);
+void cmtp_detach_device(struct cmtp_session *session);
+
+void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb);
+
+static inline void cmtp_schedule(struct cmtp_session *session)
+{
+        struct sock *sk = session->sock->sk;
+
+        wake_up_interruptible(sk->sk_sleep);
+}
+
+/* CMTP init defines */
+int cmtp_init_sockets(void);
+void cmtp_cleanup_sockets(void);
+
+#endif /* __CMTP_H */
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
new file mode 100644
index 000000000000..20ce04f2be8b
--- /dev/null
+++ b/net/bluetooth/cmtp/core.c
@@ -0,0 +1,504 @@
+/* 
+   CMTP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <linux/init.h>
+#include <net/sock.h>
+
+#include <linux/isdn/capilli.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/l2cap.h>
+
+#include "cmtp.h"
+
+#ifndef CONFIG_BT_CMTP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "1.0"
+
+static DECLARE_RWSEM(cmtp_session_sem);
+static LIST_HEAD(cmtp_session_list);
+
+static struct cmtp_session *__cmtp_get_session(bdaddr_t *bdaddr)
+{
+        struct cmtp_session *session;
+        struct list_head *p;
+
+        BT_DBG("");
+
+        list_for_each(p, &cmtp_session_list) {
+                session = list_entry(p, struct cmtp_session, list);
+                if (!bacmp(bdaddr, &session->bdaddr))
+                        return session;
+        }
+        return NULL;
+}
+
+static void __cmtp_link_session(struct cmtp_session *session)
+{
+        __module_get(THIS_MODULE);
+        list_add(&session->list, &cmtp_session_list);
+}
+
+static void __cmtp_unlink_session(struct cmtp_session *session)
+{
+        list_del(&session->list);
+        module_put(THIS_MODULE);
+}
+
+static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
+{
+        bacpy(&ci->bdaddr, &session->bdaddr);
+
+        ci->flags = session->flags;
+        ci->state = session->state;
+
+        ci->num = session->num;
+}
+
+
+static inline int cmtp_alloc_block_id(struct cmtp_session *session)
+{
+        int i, id = -1;
+
+        for (i = 0; i < 16; i++)
+                if (!test_and_set_bit(i, &session->blockids)) {
+                        id = i;
+                        break;
+                }
+
+        return id;
+}
+
+static inline void cmtp_free_block_id(struct cmtp_session *session, int id)
+{
+        clear_bit(id, &session->blockids);
+}
+
+static inline void cmtp_add_msgpart(struct cmtp_session *session, int id, const unsigned char *buf, int count)
+{
+        struct sk_buff *skb = session->reassembly[id], *nskb;
+        int size;
+
+        BT_DBG("session %p buf %p count %d", session, buf, count);
+
+        size = (skb) ? skb->len + count : count;
+
+        if (!(nskb = alloc_skb(size, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for CAPI message");
+                return;
+        }
+
+        if (skb && (skb->len > 0))
+                memcpy(skb_put(nskb, skb->len), skb->data, skb->len);
+
+        memcpy(skb_put(nskb, count), buf, count);
+
+        session->reassembly[id] = nskb;
+
+        if (skb)
+                kfree_skb(skb);
+}
+
+static inline int cmtp_recv_frame(struct cmtp_session *session, struct sk_buff *skb)
+{
+        __u8 hdr, hdrlen, id;
+        __u16 len;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        while (skb->len > 0) {
+                hdr = skb->data[0];
+
+                switch (hdr & 0xc0) {
+                case 0x40:
+                        hdrlen = 2;
+                        len = skb->data[1];
+                        break;
+                case 0x80:
+                        hdrlen = 3;
+                        len = skb->data[1] | (skb->data[2] << 8);
+                        break;
+                default:
+                        hdrlen = 1;
+                        len = 0;
+                        break;
+                }
+
+                id = (hdr & 0x3c) >> 2;
+
+                BT_DBG("hdr 0x%02x hdrlen %d len %d id %d", hdr, hdrlen, len, id);
+
+                if (hdrlen + len > skb->len) {
+                        BT_ERR("Wrong size or header information in CMTP frame");
+                        break;
+                }
+
+                if (len == 0) {
+                        skb_pull(skb, hdrlen);
+                        continue;
+                }
+
+                switch (hdr & 0x03) {
+                case 0x00:
+                        cmtp_add_msgpart(session, id, skb->data + hdrlen, len);
+                        cmtp_recv_capimsg(session, session->reassembly[id]);
+                        session->reassembly[id] = NULL;
+                        break;
+                case 0x01:
+                        cmtp_add_msgpart(session, id, skb->data + hdrlen, len);
+                        break;
+                default:
+                        if (session->reassembly[id] != NULL)
+                                kfree_skb(session->reassembly[id]);
+                        session->reassembly[id] = NULL;
+                        break;
+                }
+
+                skb_pull(skb, hdrlen + len);
+        }
+
+        kfree_skb(skb);
+        return 0;
+}
+
+static int cmtp_send_frame(struct cmtp_session *session, unsigned char *data, int len)
+{
+        struct socket *sock = session->sock;
+        struct kvec iv = { data, len };
+        struct msghdr msg;
+
+        BT_DBG("session %p data %p len %d", session, data, len);
+
+        if (!len)
+                return 0;
+
+        memset(&msg, 0, sizeof(msg));
+
+        return kernel_sendmsg(sock, &msg, &iv, 1, len);
+}
+
+static int cmtp_process_transmit(struct cmtp_session *session)
+{
+        struct sk_buff *skb, *nskb;
+        unsigned char *hdr;
+        unsigned int size, tail;
+
+        BT_DBG("session %p", session);
+
+        if (!(nskb = alloc_skb(session->mtu, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        while ((skb = skb_dequeue(&session->transmit))) {
+                struct cmtp_scb *scb = (void *) skb->cb;
+
+                if ((tail = (session->mtu - nskb->len)) < 5) {
+                        cmtp_send_frame(session, nskb->data, nskb->len);
+                        skb_trim(nskb, 0);
+                        tail = session->mtu;
+                }
+
+                size = min_t(uint, ((tail < 258) ? (tail - 2) : (tail - 3)), skb->len);
+
+                if ((scb->id < 0) && ((scb->id = cmtp_alloc_block_id(session)) < 0)) {
+                        skb_queue_head(&session->transmit, skb);
+                        break;
+                }
+
+                if (size < 256) {
+                        hdr = skb_put(nskb, 2);
+                        hdr[0] = 0x40
+                                | ((scb->id << 2) & 0x3c)
+                                | ((skb->len == size) ? 0x00 : 0x01);
+                        hdr[1] = size;
+                } else {
+                        hdr = skb_put(nskb, 3);
+                        hdr[0] = 0x80
+                                | ((scb->id << 2) & 0x3c)
+                                | ((skb->len == size) ? 0x00 : 0x01);
+                        hdr[1] = size & 0xff;
+                        hdr[2] = size >> 8;
+                }
+
+                memcpy(skb_put(nskb, size), skb->data, size);
+                skb_pull(skb, size);
+
+                if (skb->len > 0) {
+                        skb_queue_head(&session->transmit, skb);
+                } else {
+                        cmtp_free_block_id(session, scb->id);
+                        if (scb->data) {
+                                cmtp_send_frame(session, nskb->data, nskb->len);
+                                skb_trim(nskb, 0);
+                        }
+                        kfree_skb(skb);
+                }
+        }
+
+        cmtp_send_frame(session, nskb->data, nskb->len);
+
+        kfree_skb(nskb);
+
+        return skb_queue_len(&session->transmit);
+}
+
+static int cmtp_session(void *arg)
+{
+        struct cmtp_session *session = arg;
+        struct sock *sk = session->sock->sk;
+        struct sk_buff *skb;
+        wait_queue_t wait;
+
+        BT_DBG("session %p", session);
+
+        daemonize("kcmtpd_ctr_%d", session->num);
+        set_user_nice(current, -15);
+        current->flags |= PF_NOFREEZE;
+
+        init_waitqueue_entry(&wait, current);
+        add_wait_queue(sk->sk_sleep, &wait);
+        while (!atomic_read(&session->terminate)) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (sk->sk_state != BT_CONNECTED)
+                        break;
+
+                while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
+                        skb_orphan(skb);
+                        cmtp_recv_frame(session, skb);
+                }
+
+                cmtp_process_transmit(session);
+
+                schedule();
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+
+        down_write(&cmtp_session_sem);
+
+        if (!(session->flags & (1 << CMTP_LOOPBACK)))
+                cmtp_detach_device(session);
+
+        fput(session->sock->file);
+
+        __cmtp_unlink_session(session);
+
+        up_write(&cmtp_session_sem);
+
+        kfree(session);
+        return 0;
+}
+
+int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
+{
+        struct cmtp_session *session, *s;
+        bdaddr_t src, dst;
+        int i, err;
+
+        BT_DBG("");
+
+        baswap(&src, &bt_sk(sock->sk)->src);
+        baswap(&dst, &bt_sk(sock->sk)->dst);
+
+        session = kmalloc(sizeof(struct cmtp_session), GFP_KERNEL);
+        if (!session) 
+                return -ENOMEM;
+        memset(session, 0, sizeof(struct cmtp_session));
+
+        down_write(&cmtp_session_sem);
+
+        s = __cmtp_get_session(&bt_sk(sock->sk)->dst);
+        if (s && s->state == BT_CONNECTED) {
+                err = -EEXIST;
+                goto failed;
+        }
+
+        bacpy(&session->bdaddr, &bt_sk(sock->sk)->dst);
+
+        session->mtu = min_t(uint, l2cap_pi(sock->sk)->omtu, l2cap_pi(sock->sk)->imtu);
+
+        BT_DBG("mtu %d", session->mtu);
+
+        sprintf(session->name, "%s", batostr(&dst));
+
+        session->sock  = sock;
+        session->state = BT_CONFIG;
+
+        init_waitqueue_head(&session->wait);
+
+        session->msgnum = CMTP_INITIAL_MSGNUM;
+
+        INIT_LIST_HEAD(&session->applications);
+
+        skb_queue_head_init(&session->transmit);
+
+        for (i = 0; i < 16; i++)
+                session->reassembly[i] = NULL;
+
+        session->flags = req->flags;
+
+        __cmtp_link_session(session);
+
+        err = kernel_thread(cmtp_session, session, CLONE_KERNEL);
+        if (err < 0)
+                goto unlink;
+
+        if (!(session->flags & (1 << CMTP_LOOPBACK))) {
+                err = cmtp_attach_device(session);
+                if (err < 0)
+                        goto detach;
+        }
+
+        up_write(&cmtp_session_sem);
+        return 0;
+
+detach:
+        cmtp_detach_device(session);
+
+unlink:
+        __cmtp_unlink_session(session);
+
+failed:
+        up_write(&cmtp_session_sem);
+        kfree(session);
+        return err;
+}
+
+int cmtp_del_connection(struct cmtp_conndel_req *req)
+{
+        struct cmtp_session *session;
+        int err = 0;
+
+        BT_DBG("");
+
+        down_read(&cmtp_session_sem);
+
+        session = __cmtp_get_session(&req->bdaddr);
+        if (session) {
+                /* Flush the transmit queue */
+                skb_queue_purge(&session->transmit);
+
+                /* Kill session thread */
+                atomic_inc(&session->terminate);
+                cmtp_schedule(session);
+        } else
+                err = -ENOENT;
+
+        up_read(&cmtp_session_sem);
+        return err;
+}
+
+int cmtp_get_connlist(struct cmtp_connlist_req *req)
+{
+        struct list_head *p;
+        int err = 0, n = 0;
+
+        BT_DBG("");
+
+        down_read(&cmtp_session_sem);
+
+        list_for_each(p, &cmtp_session_list) {
+                struct cmtp_session *session;
+                struct cmtp_conninfo ci;
+
+                session = list_entry(p, struct cmtp_session, list);
+
+                __cmtp_copy_session(session, &ci);
+
+                if (copy_to_user(req->ci, &ci, sizeof(ci))) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (++n >= req->cnum)
+                        break;
+
+                req->ci++;
+        }
+        req->cnum = n;
+
+        up_read(&cmtp_session_sem);
+        return err;
+}
+
+int cmtp_get_conninfo(struct cmtp_conninfo *ci)
+{
+        struct cmtp_session *session;
+        int err = 0;
+
+        down_read(&cmtp_session_sem);
+
+        session = __cmtp_get_session(&ci->bdaddr);
+        if (session)
+                __cmtp_copy_session(session, ci);
+        else
+                err = -ENOENT;
+
+        up_read(&cmtp_session_sem);
+        return err;
+}
+
+
+static int __init cmtp_init(void)
+{
+        l2cap_load();
+
+        BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION);
+
+        cmtp_init_sockets();
+
+        return 0;
+}
+
+static void __exit cmtp_exit(void)
+{
+        cmtp_cleanup_sockets();
+}
+
+module_init(cmtp_init);
+module_exit(cmtp_exit);
+
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth CMTP ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-5");
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
new file mode 100644
index 000000000000..4c7f9e20dade
--- /dev/null
+++ b/net/bluetooth/cmtp/sock.c
@@ -0,0 +1,226 @@
+/* 
+   CMTP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <net/sock.h>
+
+#include <linux/isdn/capilli.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+#include "cmtp.h"
+
+#ifndef CONFIG_BT_CMTP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static int cmtp_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        sock_orphan(sk);
+        sock_put(sk);
+
+        return 0;
+}
+
+static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct cmtp_connadd_req ca;
+        struct cmtp_conndel_req cd;
+        struct cmtp_connlist_req cl;
+        struct cmtp_conninfo ci;
+        struct socket *nsock;
+        void __user *argp = (void __user *)arg;
+        int err;
+
+        BT_DBG("cmd %x arg %lx", cmd, arg);
+
+        switch (cmd) {
+        case CMTPCONNADD:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&ca, argp, sizeof(ca)))
+                        return -EFAULT;
+
+                nsock = sockfd_lookup(ca.sock, &err);
+                if (!nsock)
+                        return err;
+
+                if (nsock->sk->sk_state != BT_CONNECTED) {
+                        fput(nsock->file);
+                        return -EBADFD;
+                }
+
+                err = cmtp_add_connection(&ca, nsock);
+                if (!err) {
+                        if (copy_to_user(argp, &ca, sizeof(ca)))
+                                err = -EFAULT;
+                } else
+                        fput(nsock->file);
+
+                return err;
+
+        case CMTPCONNDEL:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&cd, argp, sizeof(cd)))
+                        return -EFAULT;
+
+                return cmtp_del_connection(&cd);
+
+        case CMTPGETCONNLIST:
+                if (copy_from_user(&cl, argp, sizeof(cl)))
+                        return -EFAULT;
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+
+                err = cmtp_get_connlist(&cl);
+                if (!err && copy_to_user(argp, &cl, sizeof(cl)))
+                        return -EFAULT;
+
+                return err;
+
+        case CMTPGETCONNINFO:
+                if (copy_from_user(&ci, argp, sizeof(ci)))
+                        return -EFAULT;
+
+                err = cmtp_get_conninfo(&ci);
+                if (!err && copy_to_user(argp, &ci, sizeof(ci)))
+                        return -EFAULT;
+
+                return err;
+        }
+
+        return -EINVAL;
+}
+
+static struct proto_ops cmtp_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = cmtp_sock_release,
+        .ioctl          = cmtp_sock_ioctl,
+        .bind           = sock_no_bind,
+        .getname        = sock_no_getname,
+        .sendmsg        = sock_no_sendmsg,
+        .recvmsg        = sock_no_recvmsg,
+        .poll           = sock_no_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .mmap           = sock_no_mmap
+};
+
+static struct proto cmtp_proto = {
+        .name           = "CMTP",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct bt_sock)
+};
+
+static int cmtp_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        if (sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &cmtp_proto, 1);
+        if (!sk)
+                return -ENOMEM;
+
+        sock_init_data(sock, sk);
+
+        sock->ops = &cmtp_sock_ops;
+
+        sock->state = SS_UNCONNECTED;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = protocol;
+        sk->sk_state    = BT_OPEN;
+
+        return 0;
+}
+
+static struct net_proto_family cmtp_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = cmtp_sock_create
+};
+
+int cmtp_init_sockets(void)
+{
+        int err;
+
+        err = proto_register(&cmtp_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_CMTP, &cmtp_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        return 0;
+
+error:
+        BT_ERR("Can't register CMTP socket");
+        proto_unregister(&cmtp_proto);
+        return err;
+}
+
+void cmtp_cleanup_sockets(void)
+{
+        if (bt_sock_unregister(BTPROTO_CMTP) < 0)
+                BT_ERR("Can't unregister CMTP socket");
+
+        proto_unregister(&cmtp_proto);
+}
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
new file mode 100644
index 000000000000..71762d7e9970
--- /dev/null
+++ b/net/bluetooth/hci_conn.c
@@ -0,0 +1,471 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI connection handling. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifndef CONFIG_BT_HCI_CORE_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static void hci_acl_connect(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct inquiry_entry *ie;
+        struct hci_cp_create_conn cp;
+
+        BT_DBG("%p", conn);
+
+        conn->state = BT_CONNECT;
+        conn->out   = 1;
+        conn->link_mode = HCI_LM_MASTER;
+
+        memset(&cp, 0, sizeof(cp));
+        bacpy(&cp.bdaddr, &conn->dst);
+        cp.pscan_rep_mode = 0x02;
+
+        if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst)) &&
+                        inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
+                cp.pscan_rep_mode = ie->data.pscan_rep_mode;
+                cp.pscan_mode     = ie->data.pscan_mode;
+                cp.clock_offset   = ie->data.clock_offset | __cpu_to_le16(0x8000);
+                memcpy(conn->dev_class, ie->data.dev_class, 3);
+        }
+
+        cp.pkt_type = __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
+        if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
+                cp.role_switch  = 0x01;
+        else
+                cp.role_switch  = 0x00;
+                
+        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
+}
+
+void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
+{
+        struct hci_cp_disconnect cp;
+
+        BT_DBG("%p", conn);
+
+        conn->state = BT_DISCONN;
+
+        cp.handle = __cpu_to_le16(conn->handle);
+        cp.reason = reason;
+        hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_DISCONNECT, sizeof(cp), &cp);
+}
+
+void hci_add_sco(struct hci_conn *conn, __u16 handle)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_cp_add_sco cp;
+
+        BT_DBG("%p", conn);
+
+        conn->state = BT_CONNECT;
+        conn->out = 1;
+
+        cp.pkt_type = __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
+        cp.handle   = __cpu_to_le16(handle);
+
+        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, sizeof(cp), &cp);
+}
+
+static void hci_conn_timeout(unsigned long arg)
+{
+        struct hci_conn *conn = (void *)arg;
+        struct hci_dev  *hdev = conn->hdev;
+
+        BT_DBG("conn %p state %d", conn, conn->state);
+
+        if (atomic_read(&conn->refcnt))
+                return;
+
+        hci_dev_lock(hdev);
+        if (conn->state == BT_CONNECTED)
+                hci_acl_disconn(conn, 0x13);
+        else
+                conn->state = BT_CLOSED;
+        hci_dev_unlock(hdev);
+        return;
+}
+
+static void hci_conn_init_timer(struct hci_conn *conn)
+{
+        init_timer(&conn->timer);
+        conn->timer.function = hci_conn_timeout;
+        conn->timer.data = (unsigned long)conn;
+}
+
+struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
+{
+        struct hci_conn *conn;
+
+        BT_DBG("%s dst %s", hdev->name, batostr(dst));
+
+        if (!(conn = kmalloc(sizeof(struct hci_conn), GFP_ATOMIC)))
+                return NULL;
+        memset(conn, 0, sizeof(struct hci_conn));
+
+        bacpy(&conn->dst, dst);
+        conn->type   = type;
+        conn->hdev   = hdev;
+        conn->state  = BT_OPEN;
+
+        skb_queue_head_init(&conn->data_q);
+        hci_conn_init_timer(conn);
+
+        atomic_set(&conn->refcnt, 0);
+
+        hci_dev_hold(hdev);
+
+        tasklet_disable(&hdev->tx_task);
+
+        hci_conn_hash_add(hdev, conn);
+        if (hdev->notify)
+                hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
+
+        tasklet_enable(&hdev->tx_task);
+
+        return conn;
+}
+
+int hci_conn_del(struct hci_conn *conn)
+{
+        struct hci_dev *hdev = conn->hdev;
+
+        BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
+
+        hci_conn_del_timer(conn);
+
+        if (conn->type == SCO_LINK) {
+                struct hci_conn *acl = conn->link;
+                if (acl) {
+                        acl->link = NULL;
+                        hci_conn_put(acl);
+                }
+        } else {
+                struct hci_conn *sco = conn->link;
+                if (sco)
+                        sco->link = NULL;
+
+                /* Unacked frames */
+                hdev->acl_cnt += conn->sent;
+        }
+
+        tasklet_disable(&hdev->tx_task);
+
+        hci_conn_hash_del(hdev, conn);
+        if (hdev->notify)
+                hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);
+
+        tasklet_enable(&hdev->tx_task);
+
+        skb_queue_purge(&conn->data_q);
+
+        hci_dev_put(hdev);
+
+        kfree(conn);
+        return 0;
+}
+
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
+{
+        int use_src = bacmp(src, BDADDR_ANY);
+        struct hci_dev *hdev = NULL;
+        struct list_head *p;
+
+        BT_DBG("%s -> %s", batostr(src), batostr(dst));
+
+        read_lock_bh(&hci_dev_list_lock);
+
+        list_for_each(p, &hci_dev_list) {
+                struct hci_dev *d = list_entry(p, struct hci_dev, list);
+
+                if (!test_bit(HCI_UP, &d->flags) || test_bit(HCI_RAW, &d->flags))
+                        continue;
+
+                /* Simple routing: 
+                 *   No source address - find interface with bdaddr != dst
+                 *   Source address    - find interface with bdaddr == src
+                 */
+
+                if (use_src) {
+                        if (!bacmp(&d->bdaddr, src)) {
+                                hdev = d; break;
+                        }
+                } else {
+                        if (bacmp(&d->bdaddr, dst)) {
+                                hdev = d; break;
+                        }
+                }
+        }
+
+        if (hdev)
+                hdev = hci_dev_hold(hdev);
+
+        read_unlock_bh(&hci_dev_list_lock);
+        return hdev;
+}
+EXPORT_SYMBOL(hci_get_route);
+
+/* Create SCO or ACL connection.
+ * Device _must_ be locked */
+struct hci_conn * hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
+{
+        struct hci_conn *acl;
+
+        BT_DBG("%s dst %s", hdev->name, batostr(dst));
+
+        if (!(acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
+                if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
+                        return NULL;
+        }
+
+        hci_conn_hold(acl);
+
+        if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
+                hci_acl_connect(acl);
+
+        if (type == SCO_LINK) {
+                struct hci_conn *sco;
+
+                if (!(sco = hci_conn_hash_lookup_ba(hdev, SCO_LINK, dst))) {
+                        if (!(sco = hci_conn_add(hdev, SCO_LINK, dst))) {
+                                hci_conn_put(acl);
+                                return NULL;
+                        }
+                }
+                acl->link = sco;
+                sco->link = acl;
+
+                hci_conn_hold(sco);
+
+                if (acl->state == BT_CONNECTED && 
+                                (sco->state == BT_OPEN || sco->state == BT_CLOSED))
+                        hci_add_sco(sco, acl->handle);
+
+                return sco;
+        } else {
+                return acl;
+        }
+}
+EXPORT_SYMBOL(hci_connect);
+
+/* Authenticate remote device */
+int hci_conn_auth(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (conn->link_mode & HCI_LM_AUTH)
+                return 1;
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                struct hci_cp_auth_requested cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED, sizeof(cp), &cp);
+        }
+        return 0;
+}
+EXPORT_SYMBOL(hci_conn_auth);
+
+/* Enable encryption */
+int hci_conn_encrypt(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (conn->link_mode & HCI_LM_ENCRYPT)
+                return 1;
+
+        if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
+                return 0;
+
+        if (hci_conn_auth(conn)) {
+                struct hci_cp_set_conn_encrypt cp;
+                cp.handle  = __cpu_to_le16(conn->handle);
+                cp.encrypt = 1; 
+                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT, sizeof(cp), &cp);
+        }
+        return 0;
+}
+EXPORT_SYMBOL(hci_conn_encrypt);
+
+/* Change link key */
+int hci_conn_change_link_key(struct hci_conn *conn)
+{
+        BT_DBG("conn %p", conn);
+
+        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+                struct hci_cp_change_conn_link_key cp;
+                cp.handle = __cpu_to_le16(conn->handle);
+                hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_LINK_KEY, sizeof(cp), &cp);
+        }
+        return 0;
+}
+EXPORT_SYMBOL(hci_conn_change_link_key);
+
+/* Switch role */
+int hci_conn_switch_role(struct hci_conn *conn, uint8_t role)
+{
+        BT_DBG("conn %p", conn);
+
+        if (!role && conn->link_mode & HCI_LM_MASTER)
+                return 1;
+
+        if (!test_and_set_bit(HCI_CONN_RSWITCH_PEND, &conn->pend)) {
+                struct hci_cp_switch_role cp;
+                bacpy(&cp.bdaddr, &conn->dst);
+                cp.role = role;
+                hci_send_cmd(conn->hdev, OGF_LINK_POLICY, OCF_SWITCH_ROLE, sizeof(cp), &cp);
+        }
+        return 0;
+}
+EXPORT_SYMBOL(hci_conn_switch_role);
+
+/* Drop all connection on the device */
+void hci_conn_hash_flush(struct hci_dev *hdev)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        struct list_head *p;
+
+        BT_DBG("hdev %s", hdev->name);
+
+        p = h->list.next;
+        while (p != &h->list) {
+                struct hci_conn *c;
+
+                c = list_entry(p, struct hci_conn, list);
+                p = p->next;
+
+                c->state = BT_CLOSED;
+
+                hci_proto_disconn_ind(c, 0x16);
+                hci_conn_del(c);
+        }
+}
+
+int hci_get_conn_list(void __user *arg)
+{
+        struct hci_conn_list_req req, *cl;
+        struct hci_conn_info *ci;
+        struct hci_dev *hdev;
+        struct list_head *p;
+        int n = 0, size, err;
+
+        if (copy_from_user(&req, arg, sizeof(req)))
+                return -EFAULT;
+
+        if (!req.conn_num || req.conn_num > (PAGE_SIZE * 2) / sizeof(*ci))
+                return -EINVAL;
+
+        size = sizeof(req) + req.conn_num * sizeof(*ci);
+
+        if (!(cl = (void *) kmalloc(size, GFP_KERNEL)))
+                return -ENOMEM;
+
+        if (!(hdev = hci_dev_get(req.dev_id))) {
+                kfree(cl);
+                return -ENODEV;
+        }
+
+        ci = cl->conn_info;
+
+        hci_dev_lock_bh(hdev);
+        list_for_each(p, &hdev->conn_hash.list) {
+                register struct hci_conn *c;
+                c = list_entry(p, struct hci_conn, list);
+
+                bacpy(&(ci + n)->bdaddr, &c->dst);
+                (ci + n)->handle = c->handle;
+                (ci + n)->type  = c->type;
+                (ci + n)->out   = c->out;
+                (ci + n)->state = c->state;
+                (ci + n)->link_mode = c->link_mode;
+                if (++n >= req.conn_num)
+                        break;
+        }
+        hci_dev_unlock_bh(hdev);
+
+        cl->dev_id = hdev->id;
+        cl->conn_num = n;
+        size = sizeof(req) + n * sizeof(*ci);
+
+        hci_dev_put(hdev);
+
+        err = copy_to_user(arg, cl, size);
+        kfree(cl);
+
+        return err ? -EFAULT : 0;
+}
+
+int hci_get_conn_info(struct hci_dev *hdev, void __user *arg)
+{
+        struct hci_conn_info_req req;
+        struct hci_conn_info ci;
+        struct hci_conn *conn;
+        char __user *ptr = arg + sizeof(req);
+
+        if (copy_from_user(&req, arg, sizeof(req)))
+                return -EFAULT;
+
+        hci_dev_lock_bh(hdev);
+        conn = hci_conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
+        if (conn) {
+                bacpy(&ci.bdaddr, &conn->dst);
+                ci.handle = conn->handle;
+                ci.type  = conn->type;
+                ci.out   = conn->out;
+                ci.state = conn->state;
+                ci.link_mode = conn->link_mode;
+        }
+        hci_dev_unlock_bh(hdev);
+
+        if (!conn)
+                return -ENOENT;
+
+        return copy_to_user(ptr, &ci, sizeof(ci)) ? -EFAULT : 0;
+}
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
new file mode 100644
index 000000000000..860dba7bdd89
--- /dev/null
+++ b/net/bluetooth/hci_core.c
@@ -0,0 +1,1434 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI core. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kmod.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifndef CONFIG_BT_HCI_CORE_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static void hci_cmd_task(unsigned long arg);
+static void hci_rx_task(unsigned long arg);
+static void hci_tx_task(unsigned long arg);
+static void hci_notify(struct hci_dev *hdev, int event);
+
+static DEFINE_RWLOCK(hci_task_lock);
+
+/* HCI device list */
+LIST_HEAD(hci_dev_list);
+DEFINE_RWLOCK(hci_dev_list_lock);
+
+/* HCI callback list */
+LIST_HEAD(hci_cb_list);
+DEFINE_RWLOCK(hci_cb_list_lock);
+
+/* HCI protocols */
+#define HCI_MAX_PROTO   2
+struct hci_proto *hci_proto[HCI_MAX_PROTO];
+
+/* HCI notifiers list */
+static struct notifier_block *hci_notifier;
+
+/* ---- HCI notifications ---- */
+
+int hci_register_notifier(struct notifier_block *nb)
+{
+        return notifier_chain_register(&hci_notifier, nb);
+}
+
+int hci_unregister_notifier(struct notifier_block *nb)
+{
+        return notifier_chain_unregister(&hci_notifier, nb);
+}
+
+void hci_notify(struct hci_dev *hdev, int event)
+{
+        notifier_call_chain(&hci_notifier, event, hdev);
+}
+
+/* ---- HCI requests ---- */
+
+void hci_req_complete(struct hci_dev *hdev, int result)
+{
+        BT_DBG("%s result 0x%2.2x", hdev->name, result);
+
+        if (hdev->req_status == HCI_REQ_PEND) {
+                hdev->req_result = result;
+                hdev->req_status = HCI_REQ_DONE;
+                wake_up_interruptible(&hdev->req_wait_q);
+        }
+}
+
+static void hci_req_cancel(struct hci_dev *hdev, int err)
+{
+        BT_DBG("%s err 0x%2.2x", hdev->name, err);
+
+        if (hdev->req_status == HCI_REQ_PEND) {
+                hdev->req_result = err;
+                hdev->req_status = HCI_REQ_CANCELED;
+                wake_up_interruptible(&hdev->req_wait_q);
+        }
+}
+
+/* Execute request and wait for completion. */
+static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 
+                                unsigned long opt, __u32 timeout)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        int err = 0;
+
+        BT_DBG("%s start", hdev->name);
+
+        hdev->req_status = HCI_REQ_PEND;
+
+        add_wait_queue(&hdev->req_wait_q, &wait);
+        set_current_state(TASK_INTERRUPTIBLE);
+
+        req(hdev, opt);
+        schedule_timeout(timeout);
+
+        remove_wait_queue(&hdev->req_wait_q, &wait);
+
+        if (signal_pending(current))
+                return -EINTR;
+
+        switch (hdev->req_status) {
+        case HCI_REQ_DONE:
+                err = -bt_err(hdev->req_result);
+                break;
+
+        case HCI_REQ_CANCELED:
+                err = -hdev->req_result;
+                break;
+
+        default:
+                err = -ETIMEDOUT;
+                break;
+        };
+
+        hdev->req_status = hdev->req_result = 0;
+
+        BT_DBG("%s end: err %d", hdev->name, err);
+
+        return err;
+}
+
+static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
+                                unsigned long opt, __u32 timeout)
+{
+        int ret;
+
+        /* Serialize all requests */
+        hci_req_lock(hdev);
+        ret = __hci_request(hdev, req, opt, timeout);
+        hci_req_unlock(hdev);
+
+        return ret;
+}
+
+static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
+{
+        BT_DBG("%s %ld", hdev->name, opt);
+
+        /* Reset device */
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
+}
+
+static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
+{
+        struct sk_buff *skb;
+        __u16 param;
+
+        BT_DBG("%s %ld", hdev->name, opt);
+
+        /* Driver initialization */
+
+        /* Special commands */
+        while ((skb = skb_dequeue(&hdev->driver_init))) {
+                skb->pkt_type = HCI_COMMAND_PKT;
+                skb->dev = (void *) hdev;
+                skb_queue_tail(&hdev->cmd_q, skb);
+                hci_sched_cmd(hdev);
+        }
+        skb_queue_purge(&hdev->driver_init);
+
+        /* Mandatory initialization */
+
+        /* Reset */
+        if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
+                        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
+
+        /* Read Local Supported Features */
+        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
+
+        /* Read Buffer Size (ACL mtu, max pkt, etc.) */
+        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
+
+#if 0
+        /* Host buffer size */
+        {
+                struct hci_cp_host_buffer_size cp;
+                cp.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE);
+                cp.sco_mtu = HCI_MAX_SCO_SIZE;
+                cp.acl_max_pkt = __cpu_to_le16(0xffff);
+                cp.sco_max_pkt = __cpu_to_le16(0xffff);
+                hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp);
+        }
+#endif
+
+        /* Read BD Address */
+        hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
+
+        /* Read Voice Setting */
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
+
+        /* Optional initialization */
+
+        /* Clear Event Filters */
+        {
+                struct hci_cp_set_event_flt cp;
+                cp.flt_type  = HCI_FLT_CLEAR_ALL;
+                hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp);
+        }
+
+        /* Page timeout ~20 secs */
+        param = __cpu_to_le16(0x8000);
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, &param);
+
+        /* Connection accept timeout ~20 secs */
+        param = __cpu_to_le16(0x7d00);
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, &param);
+}
+
+static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
+{
+        __u8 scan = opt;
+
+        BT_DBG("%s %x", hdev->name, scan);
+
+        /* Inquiry and Page scans */
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
+}
+
+static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
+{
+        __u8 auth = opt;
+
+        BT_DBG("%s %x", hdev->name, auth);
+
+        /* Authentication */
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
+}
+
+static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
+{
+        __u8 encrypt = opt;
+
+        BT_DBG("%s %x", hdev->name, encrypt);
+
+        /* Authentication */
+        hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
+}
+
+/* Get HCI device by index. 
+ * Device is held on return. */
+struct hci_dev *hci_dev_get(int index)
+{
+        struct hci_dev *hdev = NULL;
+        struct list_head *p;
+
+        BT_DBG("%d", index);
+
+        if (index < 0)
+                return NULL;
+
+        read_lock(&hci_dev_list_lock);
+        list_for_each(p, &hci_dev_list) {
+                struct hci_dev *d = list_entry(p, struct hci_dev, list);
+                if (d->id == index) {
+                        hdev = hci_dev_hold(d);
+                        break;
+                }
+        }
+        read_unlock(&hci_dev_list_lock);
+        return hdev;
+}
+EXPORT_SYMBOL(hci_dev_get);
+
+/* ---- Inquiry support ---- */
+static void inquiry_cache_flush(struct hci_dev *hdev)
+{
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_entry *next  = cache->list, *e;
+
+        BT_DBG("cache %p", cache);
+
+        cache->list = NULL;
+        while ((e = next)) {
+                next = e->next;
+                kfree(e);
+        }
+}
+
+struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_entry *e;
+
+        BT_DBG("cache %p, %s", cache, batostr(bdaddr));
+
+        for (e = cache->list; e; e = e->next)
+                if (!bacmp(&e->data.bdaddr, bdaddr))
+                        break;
+        return e;
+}
+
+void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
+{
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_entry *e;
+
+        BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
+
+        if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
+                /* Entry not in the cache. Add new one. */
+                if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
+                        return;
+                memset(e, 0, sizeof(struct inquiry_entry));
+                e->next     = cache->list;
+                cache->list = e;
+        }
+
+        memcpy(&e->data, data, sizeof(*data));
+        e->timestamp = jiffies;
+        cache->timestamp = jiffies;
+}
+
+static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
+{
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_info *info = (struct inquiry_info *) buf;
+        struct inquiry_entry *e;
+        int copied = 0;
+
+        for (e = cache->list; e && copied < num; e = e->next, copied++) {
+                struct inquiry_data *data = &e->data;
+                bacpy(&info->bdaddr, &data->bdaddr);
+                info->pscan_rep_mode    = data->pscan_rep_mode;
+                info->pscan_period_mode = data->pscan_period_mode;
+                info->pscan_mode        = data->pscan_mode;
+                memcpy(info->dev_class, data->dev_class, 3);
+                info->clock_offset      = data->clock_offset;
+                info++;
+        }
+
+        BT_DBG("cache %p, copied %d", cache, copied);
+        return copied;
+}
+
+static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
+{
+        struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
+        struct hci_cp_inquiry cp;
+
+        BT_DBG("%s", hdev->name);
+
+        if (test_bit(HCI_INQUIRY, &hdev->flags))
+                return;
+
+        /* Start Inquiry */
+        memcpy(&cp.lap, &ir->lap, 3);
+        cp.length  = ir->length;
+        cp.num_rsp = ir->num_rsp;
+        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp);
+}
+
+int hci_inquiry(void __user *arg)
+{
+        __u8 __user *ptr = arg;
+        struct hci_inquiry_req ir;
+        struct hci_dev *hdev;
+        int err = 0, do_inquiry = 0, max_rsp;
+        long timeo;
+        __u8 *buf;
+
+        if (copy_from_user(&ir, ptr, sizeof(ir)))
+                return -EFAULT;
+
+        if (!(hdev = hci_dev_get(ir.dev_id)))
+                return -ENODEV;
+
+        hci_dev_lock_bh(hdev);
+        if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 
+                                        inquiry_cache_empty(hdev) ||
+                                        ir.flags & IREQ_CACHE_FLUSH) {
+                inquiry_cache_flush(hdev);
+                do_inquiry = 1;
+        }
+        hci_dev_unlock_bh(hdev);
+
+        timeo = ir.length * 2 * HZ;
+        if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
+                goto done;
+
+        /* for unlimited number of responses we will use buffer with 255 entries */
+        max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
+
+        /* cache_dump can't sleep. Therefore we allocate temp buffer and then
+         * copy it to the user space.
+         */
+        if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
+                err = -ENOMEM;
+                goto done;
+        }
+
+        hci_dev_lock_bh(hdev);
+        ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
+        hci_dev_unlock_bh(hdev);
+
+        BT_DBG("num_rsp %d", ir.num_rsp);
+
+        if (!copy_to_user(ptr, &ir, sizeof(ir))) {
+                ptr += sizeof(ir);
+                if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
+                                        ir.num_rsp))
+                        err = -EFAULT;
+        } else 
+                err = -EFAULT;
+
+        kfree(buf);
+
+done:
+        hci_dev_put(hdev);
+        return err;
+}
+
+/* ---- HCI ioctl helpers ---- */
+
+int hci_dev_open(__u16 dev)
+{
+        struct hci_dev *hdev;
+        int ret = 0;
+
+        if (!(hdev = hci_dev_get(dev)))
+                return -ENODEV;
+
+        BT_DBG("%s %p", hdev->name, hdev);
+
+        hci_req_lock(hdev);
+
+        if (test_bit(HCI_UP, &hdev->flags)) {
+                ret = -EALREADY;
+                goto done;
+        }
+
+        if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+                set_bit(HCI_RAW, &hdev->flags);
+
+        if (hdev->open(hdev)) {
+                ret = -EIO;
+                goto done;
+        }
+
+        if (!test_bit(HCI_RAW, &hdev->flags)) {
+                atomic_set(&hdev->cmd_cnt, 1);
+                set_bit(HCI_INIT, &hdev->flags);
+
+                //__hci_request(hdev, hci_reset_req, 0, HZ);
+                ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
+
+                clear_bit(HCI_INIT, &hdev->flags);
+        }
+
+        if (!ret) {
+                hci_dev_hold(hdev);
+                set_bit(HCI_UP, &hdev->flags);
+                hci_notify(hdev, HCI_DEV_UP);
+        } else {        
+                /* Init failed, cleanup */
+                tasklet_kill(&hdev->rx_task);
+                tasklet_kill(&hdev->tx_task);
+                tasklet_kill(&hdev->cmd_task);
+
+                skb_queue_purge(&hdev->cmd_q);
+                skb_queue_purge(&hdev->rx_q);
+
+                if (hdev->flush)
+                        hdev->flush(hdev);
+
+                if (hdev->sent_cmd) {
+                        kfree_skb(hdev->sent_cmd);
+                        hdev->sent_cmd = NULL;
+                }
+
+                hdev->close(hdev);
+                hdev->flags = 0;
+        }
+
+done:
+        hci_req_unlock(hdev);
+        hci_dev_put(hdev);
+        return ret;
+}
+
+static int hci_dev_do_close(struct hci_dev *hdev)
+{
+        BT_DBG("%s %p", hdev->name, hdev);
+
+        hci_req_cancel(hdev, ENODEV);
+        hci_req_lock(hdev);
+
+        if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+                hci_req_unlock(hdev);
+                return 0;
+        }
+
+        /* Kill RX and TX tasks */
+        tasklet_kill(&hdev->rx_task);
+        tasklet_kill(&hdev->tx_task);
+
+        hci_dev_lock_bh(hdev);
+        inquiry_cache_flush(hdev);
+        hci_conn_hash_flush(hdev);
+        hci_dev_unlock_bh(hdev);
+
+        hci_notify(hdev, HCI_DEV_DOWN);
+
+        if (hdev->flush)
+                hdev->flush(hdev);
+
+        /* Reset device */
+        skb_queue_purge(&hdev->cmd_q);
+        atomic_set(&hdev->cmd_cnt, 1);
+        if (!test_bit(HCI_RAW, &hdev->flags)) {
+                set_bit(HCI_INIT, &hdev->flags);
+                __hci_request(hdev, hci_reset_req, 0, HZ/4);
+                clear_bit(HCI_INIT, &hdev->flags);
+        }
+
+        /* Kill cmd task */
+        tasklet_kill(&hdev->cmd_task);
+
+        /* Drop queues */
+        skb_queue_purge(&hdev->rx_q);
+        skb_queue_purge(&hdev->cmd_q);
+        skb_queue_purge(&hdev->raw_q);
+
+        /* Drop last sent command */
+        if (hdev->sent_cmd) {
+                kfree_skb(hdev->sent_cmd);
+                hdev->sent_cmd = NULL;
+        }
+
+        /* After this point our queues are empty
+         * and no tasks are scheduled. */
+        hdev->close(hdev);
+
+        /* Clear flags */
+        hdev->flags = 0;
+
+        hci_req_unlock(hdev);
+
+        hci_dev_put(hdev);
+        return 0;
+}
+
+int hci_dev_close(__u16 dev)
+{
+        struct hci_dev *hdev;
+        int err;
+
+        if (!(hdev = hci_dev_get(dev)))
+                return -ENODEV;
+        err = hci_dev_do_close(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+int hci_dev_reset(__u16 dev)
+{
+        struct hci_dev *hdev;
+        int ret = 0;
+
+        if (!(hdev = hci_dev_get(dev)))
+                return -ENODEV;
+
+        hci_req_lock(hdev);
+        tasklet_disable(&hdev->tx_task);
+
+        if (!test_bit(HCI_UP, &hdev->flags))
+                goto done;
+
+        /* Drop queues */
+        skb_queue_purge(&hdev->rx_q);
+        skb_queue_purge(&hdev->cmd_q);
+
+        hci_dev_lock_bh(hdev);
+        inquiry_cache_flush(hdev);
+        hci_conn_hash_flush(hdev);
+        hci_dev_unlock_bh(hdev);
+
+        if (hdev->flush)
+                hdev->flush(hdev);
+
+        atomic_set(&hdev->cmd_cnt, 1); 
+        hdev->acl_cnt = 0; hdev->sco_cnt = 0;
+
+        if (!test_bit(HCI_RAW, &hdev->flags))
+                ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
+
+done:
+        tasklet_enable(&hdev->tx_task);
+        hci_req_unlock(hdev);
+        hci_dev_put(hdev);
+        return ret;
+}
+
+int hci_dev_reset_stat(__u16 dev)
+{
+        struct hci_dev *hdev;
+        int ret = 0;
+
+        if (!(hdev = hci_dev_get(dev)))
+                return -ENODEV;
+
+        memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
+
+        hci_dev_put(hdev);
+
+        return ret;
+}
+
+int hci_dev_cmd(unsigned int cmd, void __user *arg)
+{
+        struct hci_dev *hdev;
+        struct hci_dev_req dr;
+        int err = 0;
+
+        if (copy_from_user(&dr, arg, sizeof(dr)))
+                return -EFAULT;
+
+        if (!(hdev = hci_dev_get(dr.dev_id)))
+                return -ENODEV;
+
+        switch (cmd) {
+        case HCISETAUTH:
+                err = hci_request(hdev, hci_auth_req, dr.dev_opt, HCI_INIT_TIMEOUT);
+                break;
+
+        case HCISETENCRYPT:
+                if (!lmp_encrypt_capable(hdev)) {
+                        err = -EOPNOTSUPP;
+                        break;
+                }
+
+                if (!test_bit(HCI_AUTH, &hdev->flags)) {
+                        /* Auth must be enabled first */
+                        err = hci_request(hdev, hci_auth_req,
+                                        dr.dev_opt, HCI_INIT_TIMEOUT);
+                        if (err)
+                                break;
+                }
+
+                err = hci_request(hdev, hci_encrypt_req,
+                                        dr.dev_opt, HCI_INIT_TIMEOUT);
+                break;
+
+        case HCISETSCAN:
+                err = hci_request(hdev, hci_scan_req, dr.dev_opt, HCI_INIT_TIMEOUT);
+                break;
+
+        case HCISETPTYPE:
+                hdev->pkt_type = (__u16) dr.dev_opt;
+                break;
+
+        case HCISETLINKPOL:
+                hdev->link_policy = (__u16) dr.dev_opt;
+                break;
+
+        case HCISETLINKMODE:
+                hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
+                break;
+
+        case HCISETACLMTU:
+                hdev->acl_mtu  = *((__u16 *)&dr.dev_opt + 1);
+                hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
+                break;
+
+        case HCISETSCOMTU:
+                hdev->sco_mtu  = *((__u16 *)&dr.dev_opt + 1);
+                hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
+                break;
+
+        default:
+                err = -EINVAL;
+                break;
+        }
+        hci_dev_put(hdev);
+        return err;
+}
+
+int hci_get_dev_list(void __user *arg)
+{
+        struct hci_dev_list_req *dl;
+        struct hci_dev_req *dr;
+        struct list_head *p;
+        int n = 0, size, err;
+        __u16 dev_num;
+
+        if (get_user(dev_num, (__u16 __user *) arg))
+                return -EFAULT;
+
+        if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
+                return -EINVAL;
+
+        size = sizeof(*dl) + dev_num * sizeof(*dr);
+
+        if (!(dl = kmalloc(size, GFP_KERNEL)))
+                return -ENOMEM;
+
+        dr = dl->dev_req;
+
+        read_lock_bh(&hci_dev_list_lock);
+        list_for_each(p, &hci_dev_list) {
+                struct hci_dev *hdev;
+                hdev = list_entry(p, struct hci_dev, list);
+                (dr + n)->dev_id  = hdev->id;
+                (dr + n)->dev_opt = hdev->flags;
+                if (++n >= dev_num)
+                        break;
+        }
+        read_unlock_bh(&hci_dev_list_lock);
+
+        dl->dev_num = n;
+        size = sizeof(*dl) + n * sizeof(*dr);
+
+        err = copy_to_user(arg, dl, size);
+        kfree(dl);
+
+        return err ? -EFAULT : 0;
+}
+
+int hci_get_dev_info(void __user *arg)
+{
+        struct hci_dev *hdev;
+        struct hci_dev_info di;
+        int err = 0;
+
+        if (copy_from_user(&di, arg, sizeof(di)))
+                return -EFAULT;
+
+        if (!(hdev = hci_dev_get(di.dev_id)))
+                return -ENODEV;
+
+        strcpy(di.name, hdev->name);
+        di.bdaddr   = hdev->bdaddr;
+        di.type     = hdev->type;
+        di.flags    = hdev->flags;
+        di.pkt_type = hdev->pkt_type;
+        di.acl_mtu  = hdev->acl_mtu;
+        di.acl_pkts = hdev->acl_pkts;
+        di.sco_mtu  = hdev->sco_mtu;
+        di.sco_pkts = hdev->sco_pkts;
+        di.link_policy = hdev->link_policy;
+        di.link_mode   = hdev->link_mode;
+
+        memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
+        memcpy(&di.features, &hdev->features, sizeof(di.features));
+
+        if (copy_to_user(arg, &di, sizeof(di)))
+                err = -EFAULT;
+
+        hci_dev_put(hdev);
+
+        return err;
+}
+
+/* ---- Interface to HCI drivers ---- */
+
+/* Alloc HCI device */
+struct hci_dev *hci_alloc_dev(void)
+{
+        struct hci_dev *hdev;
+
+        hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL);
+        if (!hdev)
+                return NULL;
+
+        memset(hdev, 0, sizeof(struct hci_dev));
+
+        skb_queue_head_init(&hdev->driver_init);
+
+        return hdev;
+}
+EXPORT_SYMBOL(hci_alloc_dev);
+
+/* Free HCI device */
+void hci_free_dev(struct hci_dev *hdev)
+{
+        skb_queue_purge(&hdev->driver_init);
+
+        /* will free via class release */
+        class_device_put(&hdev->class_dev);
+}
+EXPORT_SYMBOL(hci_free_dev);
+
+/* Register HCI device */
+int hci_register_dev(struct hci_dev *hdev)
+{
+        struct list_head *head = &hci_dev_list, *p;
+        int id = 0;
+
+        BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
+
+        if (!hdev->open || !hdev->close || !hdev->destruct)
+                return -EINVAL;
+
+        write_lock_bh(&hci_dev_list_lock);
+
+        /* Find first available device id */
+        list_for_each(p, &hci_dev_list) {
+                if (list_entry(p, struct hci_dev, list)->id != id)
+                        break;
+                head = p; id++;
+        }
+        
+        sprintf(hdev->name, "hci%d", id);
+        hdev->id = id;
+        list_add(&hdev->list, head);
+
+        atomic_set(&hdev->refcnt, 1);
+        spin_lock_init(&hdev->lock);
+
+        hdev->flags = 0;
+        hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
+        hdev->link_mode = (HCI_LM_ACCEPT);
+
+        tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
+        tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
+        tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
+
+        skb_queue_head_init(&hdev->rx_q);
+        skb_queue_head_init(&hdev->cmd_q);
+        skb_queue_head_init(&hdev->raw_q);
+
+        init_waitqueue_head(&hdev->req_wait_q);
+        init_MUTEX(&hdev->req_lock);
+
+        inquiry_cache_init(hdev);
+
+        hci_conn_hash_init(hdev);
+
+        memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
+
+        atomic_set(&hdev->promisc, 0);
+
+        write_unlock_bh(&hci_dev_list_lock);
+
+        hci_register_sysfs(hdev);
+
+        hci_notify(hdev, HCI_DEV_REG);
+
+        return id;
+}
+EXPORT_SYMBOL(hci_register_dev);
+
+/* Unregister HCI device */
+int hci_unregister_dev(struct hci_dev *hdev)
+{
+        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+
+        hci_unregister_sysfs(hdev);
+
+        write_lock_bh(&hci_dev_list_lock);
+        list_del(&hdev->list);
+        write_unlock_bh(&hci_dev_list_lock);
+
+        hci_dev_do_close(hdev);
+
+        hci_notify(hdev, HCI_DEV_UNREG);
+
+        __hci_dev_put(hdev);
+        return 0;
+}
+EXPORT_SYMBOL(hci_unregister_dev);
+
+/* Suspend HCI device */
+int hci_suspend_dev(struct hci_dev *hdev)
+{
+        hci_notify(hdev, HCI_DEV_SUSPEND);
+        return 0;
+}
+EXPORT_SYMBOL(hci_suspend_dev);
+
+/* Resume HCI device */
+int hci_resume_dev(struct hci_dev *hdev)
+{
+        hci_notify(hdev, HCI_DEV_RESUME);
+        return 0;
+}
+EXPORT_SYMBOL(hci_resume_dev);
+
+/* ---- Interface to upper protocols ---- */
+
+/* Register/Unregister protocols.
+ * hci_task_lock is used to ensure that no tasks are running. */
+int hci_register_proto(struct hci_proto *hp)
+{
+        int err = 0;
+
+        BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
+
+        if (hp->id >= HCI_MAX_PROTO)
+                return -EINVAL;
+
+        write_lock_bh(&hci_task_lock);
+
+        if (!hci_proto[hp->id])
+                hci_proto[hp->id] = hp;
+        else
+                err = -EEXIST;
+
+        write_unlock_bh(&hci_task_lock);
+
+        return err;
+}
+EXPORT_SYMBOL(hci_register_proto);
+
+int hci_unregister_proto(struct hci_proto *hp)
+{
+        int err = 0;
+
+        BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
+
+        if (hp->id >= HCI_MAX_PROTO)
+                return -EINVAL;
+
+        write_lock_bh(&hci_task_lock);
+
+        if (hci_proto[hp->id])
+                hci_proto[hp->id] = NULL;
+        else
+                err = -ENOENT;
+
+        write_unlock_bh(&hci_task_lock);
+
+        return err;
+}
+EXPORT_SYMBOL(hci_unregister_proto);
+
+int hci_register_cb(struct hci_cb *cb)
+{
+        BT_DBG("%p name %s", cb, cb->name);
+
+        write_lock_bh(&hci_cb_list_lock);
+        list_add(&cb->list, &hci_cb_list);
+        write_unlock_bh(&hci_cb_list_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL(hci_register_cb);
+
+int hci_unregister_cb(struct hci_cb *cb)
+{
+        BT_DBG("%p name %s", cb, cb->name);
+
+        write_lock_bh(&hci_cb_list_lock);
+        list_del(&cb->list);
+        write_unlock_bh(&hci_cb_list_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL(hci_unregister_cb);
+
+static int hci_send_frame(struct sk_buff *skb)
+{
+        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
+
+        if (!hdev) {
+                kfree_skb(skb);
+                return -ENODEV;
+        }
+
+        BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+
+        if (atomic_read(&hdev->promisc)) {
+                /* Time stamp */
+                do_gettimeofday(&skb->stamp);
+
+                hci_send_to_sock(hdev, skb);
+        }
+
+        /* Get rid of skb owner, prior to sending to the driver. */
+        skb_orphan(skb);
+
+        return hdev->send(skb);
+}
+
+/* Send HCI command */
+int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
+{
+        int len = HCI_COMMAND_HDR_SIZE + plen;
+        struct hci_command_hdr *hdr;
+        struct sk_buff *skb;
+
+        BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
+
+        skb = bt_skb_alloc(len, GFP_ATOMIC);
+        if (!skb) {
+                BT_ERR("%s Can't allocate memory for HCI command", hdev->name);
+                return -ENOMEM;
+        }
+
+        hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
+        hdr->opcode = __cpu_to_le16(hci_opcode_pack(ogf, ocf));
+        hdr->plen   = plen;
+
+        if (plen)
+                memcpy(skb_put(skb, plen), param, plen);
+
+        BT_DBG("skb len %d", skb->len);
+
+        skb->pkt_type = HCI_COMMAND_PKT;
+        skb->dev = (void *) hdev;
+        skb_queue_tail(&hdev->cmd_q, skb);
+        hci_sched_cmd(hdev);
+
+        return 0;
+}
+EXPORT_SYMBOL(hci_send_cmd);
+
+/* Get data from the previously sent command */
+void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
+{
+        struct hci_command_hdr *hdr;
+
+        if (!hdev->sent_cmd)
+                return NULL;
+
+        hdr = (void *) hdev->sent_cmd->data;
+
+        if (hdr->opcode != __cpu_to_le16(hci_opcode_pack(ogf, ocf)))
+                return NULL;
+
+        BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
+
+        return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
+}
+
+/* Send ACL data */
+static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
+{
+        struct hci_acl_hdr *hdr;
+        int len = skb->len;
+
+        hdr = (struct hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE);
+        hdr->handle = __cpu_to_le16(hci_handle_pack(handle, flags));
+        hdr->dlen   = __cpu_to_le16(len);
+
+        skb->h.raw = (void *) hdr;
+}
+
+int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct sk_buff *list;
+
+        BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
+
+        skb->dev = (void *) hdev;
+        skb->pkt_type = HCI_ACLDATA_PKT;
+        hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
+
+        if (!(list = skb_shinfo(skb)->frag_list)) {
+                /* Non fragmented */
+                BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
+
+                skb_queue_tail(&conn->data_q, skb);
+        } else {
+                /* Fragmented */
+                BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
+
+                skb_shinfo(skb)->frag_list = NULL;
+
+                /* Queue all fragments atomically */
+                spin_lock_bh(&conn->data_q.lock);
+
+                __skb_queue_tail(&conn->data_q, skb);
+                do {
+                        skb = list; list = list->next;
+                        
+                        skb->dev = (void *) hdev;
+                        skb->pkt_type = HCI_ACLDATA_PKT;
+                        hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
+
+                        BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
+
+                        __skb_queue_tail(&conn->data_q, skb);
+                } while (list);
+
+                spin_unlock_bh(&conn->data_q.lock);
+        }
+
+        hci_sched_tx(hdev);
+        return 0;
+}
+EXPORT_SYMBOL(hci_send_acl);
+
+/* Send SCO data */
+int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
+{
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_sco_hdr hdr;
+
+        BT_DBG("%s len %d", hdev->name, skb->len);
+
+        if (skb->len > hdev->sco_mtu) {
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        hdr.handle = __cpu_to_le16(conn->handle);
+        hdr.dlen   = skb->len;
+
+        skb->h.raw = skb_push(skb, HCI_SCO_HDR_SIZE);
+        memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
+
+        skb->dev = (void *) hdev;
+        skb->pkt_type = HCI_SCODATA_PKT;
+        skb_queue_tail(&conn->data_q, skb);
+        hci_sched_tx(hdev);
+        return 0;
+}
+EXPORT_SYMBOL(hci_send_sco);
+
+/* ---- HCI TX task (outgoing data) ---- */
+
+/* HCI Connection scheduler */
+static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        struct hci_conn  *conn = NULL;
+        int num = 0, min = ~0;
+        struct list_head *p;
+
+        /* We don't have to lock device here. Connections are always 
+         * added and removed with TX task disabled. */
+        list_for_each(p, &h->list) {
+                struct hci_conn *c;
+                c = list_entry(p, struct hci_conn, list);
+
+                if (c->type != type || c->state != BT_CONNECTED
+                                || skb_queue_empty(&c->data_q))
+                        continue;
+                num++;
+
+                if (c->sent < min) {
+                        min  = c->sent;
+                        conn = c;
+                }
+        }
+
+        if (conn) {
+                int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
+                int q = cnt / num;
+                *quote = q ? q : 1;
+        } else
+                *quote = 0;
+
+        BT_DBG("conn %p quote %d", conn, *quote);
+        return conn;
+}
+
+static inline void hci_acl_tx_to(struct hci_dev *hdev)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        struct list_head *p;
+        struct hci_conn  *c;
+
+        BT_ERR("%s ACL tx timeout", hdev->name);
+
+        /* Kill stalled connections */
+        list_for_each(p, &h->list) {
+                c = list_entry(p, struct hci_conn, list);
+                if (c->type == ACL_LINK && c->sent) {
+                        BT_ERR("%s killing stalled ACL connection %s",
+                                hdev->name, batostr(&c->dst));
+                        hci_acl_disconn(c, 0x13);
+                }
+        }
+}
+
+static inline void hci_sched_acl(struct hci_dev *hdev)
+{
+        struct hci_conn *conn;
+        struct sk_buff *skb;
+        int quote;
+
+        BT_DBG("%s", hdev->name);
+
+        if (!test_bit(HCI_RAW, &hdev->flags)) {
+                /* ACL tx timeout must be longer than maximum
+                 * link supervision timeout (40.9 seconds) */
+                if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
+                        hci_acl_tx_to(hdev);
+        }
+
+        while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
+                while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
+                        BT_DBG("skb %p len %d", skb, skb->len);
+                        hci_send_frame(skb);
+                        hdev->acl_last_tx = jiffies;
+
+                        hdev->acl_cnt--;
+                        conn->sent++;
+                }
+        }
+}
+
+/* Schedule SCO */
+static inline void hci_sched_sco(struct hci_dev *hdev)
+{
+        struct hci_conn *conn;
+        struct sk_buff *skb;
+        int quote;
+
+        BT_DBG("%s", hdev->name);
+
+        while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
+                while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
+                        BT_DBG("skb %p len %d", skb, skb->len);
+                        hci_send_frame(skb);
+
+                        conn->sent++;
+                        if (conn->sent == ~0)
+                                conn->sent = 0;
+                }
+        }
+}
+
+static void hci_tx_task(unsigned long arg)
+{
+        struct hci_dev *hdev = (struct hci_dev *) arg;
+        struct sk_buff *skb;
+
+        read_lock(&hci_task_lock);
+
+        BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
+
+        /* Schedule queues and send stuff to HCI driver */
+
+        hci_sched_acl(hdev);
+
+        hci_sched_sco(hdev);
+
+        /* Send next queued raw (unknown type) packet */
+        while ((skb = skb_dequeue(&hdev->raw_q)))
+                hci_send_frame(skb);
+
+        read_unlock(&hci_task_lock);
+}
+
+/* ----- HCI RX task (incoming data proccessing) ----- */
+
+/* ACL data packet */
+static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_acl_hdr *hdr = (void *) skb->data;
+        struct hci_conn *conn;
+        __u16 handle, flags;
+
+        skb_pull(skb, HCI_ACL_HDR_SIZE);
+
+        handle = __le16_to_cpu(hdr->handle);
+        flags  = hci_flags(handle);
+        handle = hci_handle(handle);
+
+        BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
+
+        hdev->stat.acl_rx++;
+
+        hci_dev_lock(hdev);
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        hci_dev_unlock(hdev);
+        
+        if (conn) {
+                register struct hci_proto *hp;
+
+                /* Send to upper protocol */
+                if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
+                        hp->recv_acldata(conn, skb, flags);
+                        return;
+                }
+        } else {
+                BT_ERR("%s ACL packet for unknown connection handle %d", 
+                        hdev->name, handle);
+        }
+
+        kfree_skb(skb);
+}
+
+/* SCO data packet */
+static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_sco_hdr *hdr = (void *) skb->data;
+        struct hci_conn *conn;
+        __u16 handle;
+
+        skb_pull(skb, HCI_SCO_HDR_SIZE);
+
+        handle = __le16_to_cpu(hdr->handle);
+
+        BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
+
+        hdev->stat.sco_rx++;
+
+        hci_dev_lock(hdev);
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        hci_dev_unlock(hdev);
+
+        if (conn) {
+                register struct hci_proto *hp;
+
+                /* Send to upper protocol */
+                if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
+                        hp->recv_scodata(conn, skb);
+                        return;
+                }
+        } else {
+                BT_ERR("%s SCO packet for unknown connection handle %d", 
+                        hdev->name, handle);
+        }
+
+        kfree_skb(skb);
+}
+
+void hci_rx_task(unsigned long arg)
+{
+        struct hci_dev *hdev = (struct hci_dev *) arg;
+        struct sk_buff *skb;
+
+        BT_DBG("%s", hdev->name);
+
+        read_lock(&hci_task_lock);
+
+        while ((skb = skb_dequeue(&hdev->rx_q))) {
+                if (atomic_read(&hdev->promisc)) {
+                        /* Send copy to the sockets */
+                        hci_send_to_sock(hdev, skb);
+                }
+
+                if (test_bit(HCI_RAW, &hdev->flags)) {
+                        kfree_skb(skb);
+                        continue;
+                }
+
+                if (test_bit(HCI_INIT, &hdev->flags)) {
+                        /* Don't process data packets in this states. */
+                        switch (skb->pkt_type) {
+                        case HCI_ACLDATA_PKT:
+                        case HCI_SCODATA_PKT:
+                                kfree_skb(skb);
+                                continue;
+                        };
+                }
+
+                /* Process frame */
+                switch (skb->pkt_type) {
+                case HCI_EVENT_PKT:
+                        hci_event_packet(hdev, skb);
+                        break;
+
+                case HCI_ACLDATA_PKT:
+                        BT_DBG("%s ACL data packet", hdev->name);
+                        hci_acldata_packet(hdev, skb);
+                        break;
+
+                case HCI_SCODATA_PKT:
+                        BT_DBG("%s SCO data packet", hdev->name);
+                        hci_scodata_packet(hdev, skb);
+                        break;
+
+                default:
+                        kfree_skb(skb);
+                        break;
+                }
+        }
+
+        read_unlock(&hci_task_lock);
+}
+
+static void hci_cmd_task(unsigned long arg)
+{
+        struct hci_dev *hdev = (struct hci_dev *) arg;
+        struct sk_buff *skb;
+
+        BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
+
+        if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
+                BT_ERR("%s command tx timeout", hdev->name);
+                atomic_set(&hdev->cmd_cnt, 1);
+        }
+
+        /* Send queued commands */
+        if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
+                if (hdev->sent_cmd)
+                        kfree_skb(hdev->sent_cmd);
+
+                if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
+                        atomic_dec(&hdev->cmd_cnt);
+                        hci_send_frame(skb);
+                        hdev->cmd_last_tx = jiffies;
+                } else {
+                        skb_queue_head(&hdev->cmd_q, skb);
+                        hci_sched_cmd(hdev);
+                }
+        }
+}
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
new file mode 100644
index 000000000000..8ccba8ee9979
--- /dev/null
+++ b/net/bluetooth/hci_event.c
@@ -0,0 +1,1044 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI event handling. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/interrupt.h>
+#include <linux/notifier.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifndef CONFIG_BT_HCI_CORE_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+/* Handle HCI Event packets */
+
+/* Command Complete OGF LINK_CTL  */
+static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+{
+        __u8 status;
+
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        case OCF_INQUIRY_CANCEL:
+                status = *((__u8 *) skb->data);
+
+                if (status) {
+                        BT_DBG("%s Inquiry cancel error: status 0x%x", hdev->name, status);
+                } else {
+                        clear_bit(HCI_INQUIRY, &hdev->flags);
+                        hci_req_complete(hdev, status);
+                }
+                break;
+
+        default:
+                BT_DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Complete OGF LINK_POLICY  */
+static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+{
+        struct hci_conn *conn;
+        struct hci_rp_role_discovery *rd;
+
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        case OCF_ROLE_DISCOVERY: 
+                rd = (void *) skb->data;
+
+                if (rd->status)
+                        break;
+
+                hci_dev_lock(hdev);
+
+                conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rd->handle));
+                if (conn) {
+                        if (rd->role)
+                                conn->link_mode &= ~HCI_LM_MASTER;
+                        else
+                                conn->link_mode |= HCI_LM_MASTER;
+                }
+
+                hci_dev_unlock(hdev);
+                break;
+
+        default:
+                BT_DBG("%s: Command complete: ogf LINK_POLICY ocf %x", 
+                                hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Complete OGF HOST_CTL  */
+static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+{
+        __u8 status, param;
+        __u16 setting;
+        struct hci_rp_read_voice_setting *vs;
+        void *sent;
+
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        case OCF_RESET:
+                status = *((__u8 *) skb->data);
+                hci_req_complete(hdev, status);
+                break;
+
+        case OCF_SET_EVENT_FLT:
+                status = *((__u8 *) skb->data);
+                if (status) {
+                        BT_DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
+                } else {
+                        BT_DBG("%s SET_EVENT_FLT succeseful", hdev->name);
+                }
+                break;
+
+        case OCF_WRITE_AUTH_ENABLE:
+                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE);
+                if (!sent)
+                        break;
+
+                status = *((__u8 *) skb->data);
+                param  = *((__u8 *) sent);
+
+                if (!status) {
+                        if (param == AUTH_ENABLED)
+                                set_bit(HCI_AUTH, &hdev->flags);
+                        else
+                                clear_bit(HCI_AUTH, &hdev->flags);
+                }
+                hci_req_complete(hdev, status);
+                break;
+
+        case OCF_WRITE_ENCRYPT_MODE:
+                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE);
+                if (!sent)
+                        break;
+
+                status = *((__u8 *) skb->data);
+                param  = *((__u8 *) sent);
+
+                if (!status) {
+                        if (param)
+                                set_bit(HCI_ENCRYPT, &hdev->flags);
+                        else
+                                clear_bit(HCI_ENCRYPT, &hdev->flags);
+                }
+                hci_req_complete(hdev, status);
+                break;
+
+        case OCF_WRITE_CA_TIMEOUT:
+                status = *((__u8 *) skb->data);
+                if (status) {
+                        BT_DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
+                } else {
+                        BT_DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
+                }
+                break;
+
+        case OCF_WRITE_PG_TIMEOUT:
+                status = *((__u8 *) skb->data);
+                if (status) {
+                        BT_DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
+                } else {
+                        BT_DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
+                }
+                break;
+
+        case OCF_WRITE_SCAN_ENABLE:
+                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE);
+                if (!sent)
+                        break;
+
+                status = *((__u8 *) skb->data);
+                param  = *((__u8 *) sent);
+
+                BT_DBG("param 0x%x", param);
+
+                if (!status) {
+                        clear_bit(HCI_PSCAN, &hdev->flags);
+                        clear_bit(HCI_ISCAN, &hdev->flags);
+                        if (param & SCAN_INQUIRY) 
+                                set_bit(HCI_ISCAN, &hdev->flags);
+
+                        if (param & SCAN_PAGE) 
+                                set_bit(HCI_PSCAN, &hdev->flags);
+                }
+                hci_req_complete(hdev, status);
+                break;
+
+        case OCF_READ_VOICE_SETTING:
+                vs = (struct hci_rp_read_voice_setting *) skb->data;
+
+                if (vs->status) {
+                        BT_DBG("%s READ_VOICE_SETTING failed %d", hdev->name, vs->status);
+                        break;
+                }
+
+                setting = __le16_to_cpu(vs->voice_setting);
+
+                if (hdev->voice_setting != setting ) {
+                        hdev->voice_setting = setting;
+
+                        BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
+
+                        if (hdev->notify) {
+                                tasklet_disable(&hdev->tx_task);
+                                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
+                                tasklet_enable(&hdev->tx_task);
+                        }
+                }
+                break;
+
+        case OCF_WRITE_VOICE_SETTING:
+                sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING);
+                if (!sent)
+                        break;
+
+                status = *((__u8 *) skb->data);
+                setting = __le16_to_cpu(get_unaligned((__u16 *) sent));
+
+                if (!status && hdev->voice_setting != setting) {
+                        hdev->voice_setting = setting;
+
+                        BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
+
+                        if (hdev->notify) {
+                                tasklet_disable(&hdev->tx_task);
+                                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
+                                tasklet_enable(&hdev->tx_task);
+                        }
+                }
+                hci_req_complete(hdev, status);
+                break;
+
+        case OCF_HOST_BUFFER_SIZE:
+                status = *((__u8 *) skb->data);
+                if (status) {
+                        BT_DBG("%s OCF_BUFFER_SIZE failed %d", hdev->name, status);
+                        hci_req_complete(hdev, status);
+                }
+                break;
+
+        default:
+                BT_DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Complete OGF INFO_PARAM  */
+static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
+{
+        struct hci_rp_read_loc_features *lf;
+        struct hci_rp_read_buffer_size *bs;
+        struct hci_rp_read_bd_addr *ba;
+
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        case OCF_READ_LOCAL_FEATURES:
+                lf = (struct hci_rp_read_loc_features *) skb->data;
+
+                if (lf->status) {
+                        BT_DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
+                        break;
+                }
+
+                memcpy(hdev->features, lf->features, sizeof(hdev->features));
+
+                /* Adjust default settings according to features 
+                 * supported by device. */
+                if (hdev->features[0] & LMP_3SLOT)
+                        hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
+
+                if (hdev->features[0] & LMP_5SLOT)
+                        hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
+
+                if (hdev->features[1] & LMP_HV2)
+                        hdev->pkt_type |= (HCI_HV2);
+
+                if (hdev->features[1] & LMP_HV3)
+                        hdev->pkt_type |= (HCI_HV3);
+
+                BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
+
+                break;
+
+        case OCF_READ_BUFFER_SIZE:
+                bs = (struct hci_rp_read_buffer_size *) skb->data;
+
+                if (bs->status) {
+                        BT_DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
+                        hci_req_complete(hdev, bs->status);
+                        break;
+                }
+
+                hdev->acl_mtu  = __le16_to_cpu(bs->acl_mtu);
+                hdev->sco_mtu  = bs->sco_mtu ? bs->sco_mtu : 64;
+                hdev->acl_pkts = hdev->acl_cnt = __le16_to_cpu(bs->acl_max_pkt);
+                hdev->sco_pkts = hdev->sco_cnt = __le16_to_cpu(bs->sco_max_pkt);
+
+                BT_DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
+                        hdev->acl_mtu, hdev->sco_mtu, hdev->acl_pkts, hdev->sco_pkts);
+                break;
+
+        case OCF_READ_BD_ADDR:
+                ba = (struct hci_rp_read_bd_addr *) skb->data;
+
+                if (!ba->status) {
+                        bacpy(&hdev->bdaddr, &ba->bdaddr);
+                } else {
+                        BT_DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
+                }
+
+                hci_req_complete(hdev, ba->status);
+                break;
+
+        default:
+                BT_DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Status OGF LINK_CTL  */
+static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
+{
+        struct hci_conn *conn;
+        struct hci_cp_create_conn *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
+
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+
+        BT_DBG("%s status 0x%x bdaddr %s conn %p", hdev->name,
+                        status, batostr(&cp->bdaddr), conn);
+
+        if (status) {
+                if (conn && conn->state == BT_CONNECT) {
+                        conn->state = BT_CLOSED;
+                        hci_proto_connect_cfm(conn, status);
+                        hci_conn_del(conn);
+                }
+        } else {
+                if (!conn) {
+                        conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
+                        if (conn) {
+                                conn->out = 1;
+                                conn->link_mode |= HCI_LM_MASTER;
+                        } else
+                                BT_ERR("No memmory for new connection");
+                }
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
+{
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        case OCF_CREATE_CONN:
+                hci_cs_create_conn(hdev, status);
+                break;
+
+        case OCF_ADD_SCO:
+                if (status) {
+                        struct hci_conn *acl, *sco;
+                        struct hci_cp_add_sco *cp = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_ADD_SCO);
+                        __u16 handle;
+
+                        if (!cp)
+                                break;
+
+                        handle = __le16_to_cpu(cp->handle);
+
+                        BT_DBG("%s Add SCO error: handle %d status 0x%x", hdev->name, handle, status);
+
+                        hci_dev_lock(hdev);
+
+                        acl = hci_conn_hash_lookup_handle(hdev, handle);
+                        if (acl && (sco = acl->link)) {
+                                sco->state = BT_CLOSED;
+
+                                hci_proto_connect_cfm(sco, status);
+                                hci_conn_del(sco);
+                        }
+
+                        hci_dev_unlock(hdev);
+                }
+                break;
+
+        case OCF_INQUIRY:
+                if (status) {
+                        BT_DBG("%s Inquiry error: status 0x%x", hdev->name, status);
+                        hci_req_complete(hdev, status);
+                } else {
+                        set_bit(HCI_INQUIRY, &hdev->flags);
+                }
+                break;
+
+        default:
+                BT_DBG("%s Command status: ogf LINK_CTL ocf %x status %d", 
+                        hdev->name, ocf, status);
+                break;
+        }
+}
+
+/* Command Status OGF LINK_POLICY */
+static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
+{
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        default:
+                BT_DBG("%s Command status: ogf HOST_POLICY ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Status OGF HOST_CTL */
+static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
+{
+        BT_DBG("%s ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        default:
+                BT_DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Command Status OGF INFO_PARAM  */
+static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
+{
+        BT_DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
+
+        switch (ocf) {
+        default:
+                BT_DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
+                break;
+        }
+}
+
+/* Inquiry Complete */
+static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status %d", hdev->name, status);
+
+        clear_bit(HCI_INQUIRY, &hdev->flags);
+        hci_req_complete(hdev, status);
+}
+
+/* Inquiry Result */
+static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct inquiry_info *info = (struct inquiry_info *) (skb->data + 1);
+        int num_rsp = *((__u8 *) skb->data);
+
+        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+        hci_dev_lock(hdev);
+        for (; num_rsp; num_rsp--) {
+                struct inquiry_data data;
+                bacpy(&data.bdaddr, &info->bdaddr);
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = info->pscan_mode;
+                memcpy(data.dev_class, info->dev_class, 3);
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = 0x00;
+                info++;
+                hci_inquiry_cache_update(hdev, &data);
+        }
+        hci_dev_unlock(hdev);
+}
+
+/* Inquiry Result With RSSI */
+static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct inquiry_info_with_rssi *info = (struct inquiry_info_with_rssi *) (skb->data + 1);
+        int num_rsp = *((__u8 *) skb->data);
+
+        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+
+        hci_dev_lock(hdev);
+        for (; num_rsp; num_rsp--) {
+                struct inquiry_data data;
+                bacpy(&data.bdaddr, &info->bdaddr);
+                data.pscan_rep_mode     = info->pscan_rep_mode;
+                data.pscan_period_mode  = info->pscan_period_mode;
+                data.pscan_mode         = 0x00;
+                memcpy(data.dev_class, info->dev_class, 3);
+                data.clock_offset       = info->clock_offset;
+                data.rssi               = info->rssi;
+                info++;
+                hci_inquiry_cache_update(hdev, &data);
+        }
+        hci_dev_unlock(hdev);
+}
+
+/* Connect Request */
+static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_conn_request *ev = (struct hci_ev_conn_request *) skb->data;
+        int mask = hdev->link_mode;
+
+        BT_DBG("%s Connection request: %s type 0x%x", hdev->name,
+                        batostr(&ev->bdaddr), ev->link_type);
+
+        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
+
+        if (mask & HCI_LM_ACCEPT) {
+                /* Connection accepted */
+                struct hci_conn *conn;
+                struct hci_cp_accept_conn_req cp;
+
+                hci_dev_lock(hdev);
+                conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
+                if (!conn) {
+                        if (!(conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr))) {
+                                BT_ERR("No memmory for new connection");
+                                hci_dev_unlock(hdev);
+                                return;
+                        }
+                }
+                memcpy(conn->dev_class, ev->dev_class, 3);
+                conn->state = BT_CONNECT;
+                hci_dev_unlock(hdev);
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+
+                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                        cp.role = 0x00; /* Become master */
+                else
+                        cp.role = 0x01; /* Remain slave */
+
+                hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ, sizeof(cp), &cp);
+        } else {
+                /* Connection rejected */
+                struct hci_cp_reject_conn_req cp;
+
+                bacpy(&cp.bdaddr, &ev->bdaddr);
+                cp.reason = 0x0f;
+                hci_send_cmd(hdev, OGF_LINK_CTL, OCF_REJECT_CONN_REQ, sizeof(cp), &cp);
+        }
+}
+
+/* Connect Complete */
+static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
+        struct hci_conn *conn = NULL;
+
+        BT_DBG("%s", hdev->name);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
+        if (!conn) {
+                hci_dev_unlock(hdev);
+                return;
+        }
+
+        if (!ev->status) {
+                conn->handle = __le16_to_cpu(ev->handle);
+                conn->state  = BT_CONNECTED;
+
+                if (test_bit(HCI_AUTH, &hdev->flags))
+                        conn->link_mode |= HCI_LM_AUTH;
+
+                if (test_bit(HCI_ENCRYPT, &hdev->flags))
+                        conn->link_mode |= HCI_LM_ENCRYPT;
+
+                /* Set link policy */
+                if (conn->type == ACL_LINK && hdev->link_policy) {
+                        struct hci_cp_write_link_policy cp;
+                        cp.handle = ev->handle;
+                        cp.policy = __cpu_to_le16(hdev->link_policy);
+                        hci_send_cmd(hdev, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY, sizeof(cp), &cp);
+                }
+
+                /* Set packet type for incoming connection */
+                if (!conn->out) {
+                        struct hci_cp_change_conn_ptype cp;
+                        cp.handle = ev->handle;
+                        cp.pkt_type = (conn->type == ACL_LINK) ? 
+                                __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK):
+                                __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
+
+                        hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
+                }
+        } else
+                conn->state = BT_CLOSED;
+
+        if (conn->type == ACL_LINK) {
+                struct hci_conn *sco = conn->link;
+                if (sco) {
+                        if (!ev->status)
+                                hci_add_sco(sco, conn->handle);
+                        else {
+                                hci_proto_connect_cfm(sco, ev->status);
+                                hci_conn_del(sco);
+                        }
+                }
+        }
+
+        hci_proto_connect_cfm(conn, ev->status);
+        if (ev->status)
+                hci_conn_del(conn);
+
+        hci_dev_unlock(hdev);
+}
+
+/* Disconnect Complete */
+static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_disconn_complete *ev = (struct hci_ev_disconn_complete *) skb->data;
+        struct hci_conn *conn = NULL;
+        __u16 handle = __le16_to_cpu(ev->handle);
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        if (ev->status)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (conn) {
+                conn->state = BT_CLOSED;
+                hci_proto_disconn_ind(conn, ev->reason);
+                hci_conn_del(conn);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+/* Number of completed packets */
+static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_num_comp_pkts *ev = (struct hci_ev_num_comp_pkts *) skb->data;
+        __u16 *ptr;
+        int i;
+
+        skb_pull(skb, sizeof(*ev));
+
+        BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
+
+        if (skb->len < ev->num_hndl * 4) {
+                BT_DBG("%s bad parameters", hdev->name);
+                return;
+        }
+
+        tasklet_disable(&hdev->tx_task);
+
+        for (i = 0, ptr = (__u16 *) skb->data; i < ev->num_hndl; i++) {
+                struct hci_conn *conn;
+                __u16  handle, count;
+
+                handle = __le16_to_cpu(get_unaligned(ptr++));
+                count  = __le16_to_cpu(get_unaligned(ptr++));
+
+                conn = hci_conn_hash_lookup_handle(hdev, handle);
+                if (conn) {
+                        conn->sent -= count;
+
+                        if (conn->type == SCO_LINK) {
+                                if ((hdev->sco_cnt += count) > hdev->sco_pkts)
+                                        hdev->sco_cnt = hdev->sco_pkts;
+                        } else {
+                                if ((hdev->acl_cnt += count) > hdev->acl_pkts)
+                                        hdev->acl_cnt = hdev->acl_pkts;
+                        }
+                }
+        }
+        hci_sched_tx(hdev);
+
+        tasklet_enable(&hdev->tx_task);
+}
+
+/* Role Change */
+static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_role_change *ev = (struct hci_ev_role_change *) skb->data;
+        struct hci_conn *conn = NULL;
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+        if (conn) {
+                if (!ev->status) {
+                        if (ev->role)
+                                conn->link_mode &= ~HCI_LM_MASTER;
+                        else
+                                conn->link_mode |= HCI_LM_MASTER;
+                }
+
+                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
+
+                hci_role_switch_cfm(conn, ev->status, ev->role);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+/* Authentication Complete */
+static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_auth_complete *ev = (struct hci_ev_auth_complete *) skb->data;
+        struct hci_conn *conn = NULL;
+        __u16 handle = __le16_to_cpu(ev->handle);
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (conn) {
+                if (!ev->status)
+                        conn->link_mode |= HCI_LM_AUTH;
+
+                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+
+                hci_auth_cfm(conn, ev->status);
+
+                if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+                        if (!ev->status) {
+                                struct hci_cp_set_conn_encrypt cp;
+                                cp.handle  = __cpu_to_le16(conn->handle);
+                                cp.encrypt = 1;
+                                hci_send_cmd(conn->hdev, OGF_LINK_CTL,
+                                                OCF_SET_CONN_ENCRYPT,
+                                                sizeof(cp), &cp);
+                        } else {
+                                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                                hci_encrypt_cfm(conn, ev->status, 0x00);
+                        }
+                }
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+/* Encryption Change */
+static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_encrypt_change *ev = (struct hci_ev_encrypt_change *) skb->data;
+        struct hci_conn *conn = NULL;
+        __u16 handle = __le16_to_cpu(ev->handle);
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (conn) {
+                if (!ev->status) {
+                        if (ev->encrypt)
+                                conn->link_mode |= HCI_LM_ENCRYPT;
+                        else
+                                conn->link_mode &= ~HCI_LM_ENCRYPT;
+                }
+
+                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
+                hci_encrypt_cfm(conn, ev->status, ev->encrypt);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+/* Change Connection Link Key Complete */
+static inline void hci_change_conn_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_change_conn_link_key_complete *ev = (struct hci_ev_change_conn_link_key_complete *) skb->data;
+        struct hci_conn *conn = NULL;
+        __u16 handle = __le16_to_cpu(ev->handle);
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (conn) {
+                if (!ev->status)
+                        conn->link_mode |= HCI_LM_SECURE;
+
+                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+
+                hci_key_change_cfm(conn, ev->status);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+/* Pin Code Request*/
+static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+}
+
+/* Link Key Request */
+static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+}
+
+/* Link Key Notification */
+static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+}
+
+/* Clock Offset */
+static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_ev_clock_offset *ev = (struct hci_ev_clock_offset *) skb->data;
+        struct hci_conn *conn = NULL;
+        __u16 handle = __le16_to_cpu(ev->handle);
+
+        BT_DBG("%s status %d", hdev->name, ev->status);
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (conn && !ev->status) {
+                struct inquiry_entry *ie;
+
+                if ((ie = hci_inquiry_cache_lookup(hdev, &conn->dst))) {
+                        ie->data.clock_offset = ev->clock_offset;
+                        ie->timestamp = jiffies;
+                }
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_event_hdr *hdr = (struct hci_event_hdr *) skb->data;
+        struct hci_ev_cmd_complete *ec;
+        struct hci_ev_cmd_status *cs;
+        u16 opcode, ocf, ogf;
+
+        skb_pull(skb, HCI_EVENT_HDR_SIZE);
+
+        BT_DBG("%s evt 0x%x", hdev->name, hdr->evt);
+
+        switch (hdr->evt) {
+        case HCI_EV_NUM_COMP_PKTS:
+                hci_num_comp_pkts_evt(hdev, skb);
+                break;
+
+        case HCI_EV_INQUIRY_COMPLETE:
+                hci_inquiry_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_INQUIRY_RESULT:
+                hci_inquiry_result_evt(hdev, skb);
+                break;
+
+        case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
+                hci_inquiry_result_with_rssi_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CONN_REQUEST:
+                hci_conn_request_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CONN_COMPLETE:
+                hci_conn_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_DISCONN_COMPLETE:
+                hci_disconn_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_ROLE_CHANGE:
+                hci_role_change_evt(hdev, skb);
+                break;
+
+        case HCI_EV_AUTH_COMPLETE:
+                hci_auth_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_ENCRYPT_CHANGE:
+                hci_encrypt_change_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CHANGE_CONN_LINK_KEY_COMPLETE:
+                hci_change_conn_link_key_complete_evt(hdev, skb);
+                break;
+
+        case HCI_EV_PIN_CODE_REQ:
+                hci_pin_code_request_evt(hdev, skb);
+                break;
+
+        case HCI_EV_LINK_KEY_REQ:
+                hci_link_key_request_evt(hdev, skb);
+                break;
+
+        case HCI_EV_LINK_KEY_NOTIFY:
+                hci_link_key_notify_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CLOCK_OFFSET:
+                hci_clock_offset_evt(hdev, skb);
+                break;
+
+        case HCI_EV_CMD_STATUS:
+                cs = (struct hci_ev_cmd_status *) skb->data;
+                skb_pull(skb, sizeof(cs));
+
+                opcode = __le16_to_cpu(cs->opcode);
+                ogf = hci_opcode_ogf(opcode);
+                ocf = hci_opcode_ocf(opcode);
+
+                switch (ogf) {
+                case OGF_INFO_PARAM:
+                        hci_cs_info_param(hdev, ocf, cs->status);
+                        break;
+
+                case OGF_HOST_CTL:
+                        hci_cs_host_ctl(hdev, ocf, cs->status);
+                        break;
+
+                case OGF_LINK_CTL:
+                        hci_cs_link_ctl(hdev, ocf, cs->status);
+                        break;
+
+                case OGF_LINK_POLICY:
+                        hci_cs_link_policy(hdev, ocf, cs->status);
+                        break;
+
+                default:
+                        BT_DBG("%s Command Status OGF %x", hdev->name, ogf);
+                        break;
+                }
+
+                if (cs->ncmd) {
+                        atomic_set(&hdev->cmd_cnt, 1);
+                        if (!skb_queue_empty(&hdev->cmd_q))
+                                hci_sched_cmd(hdev);
+                }
+                break;
+
+        case HCI_EV_CMD_COMPLETE:
+                ec = (struct hci_ev_cmd_complete *) skb->data;
+                skb_pull(skb, sizeof(*ec));
+
+                opcode = __le16_to_cpu(ec->opcode);
+                ogf = hci_opcode_ogf(opcode);
+                ocf = hci_opcode_ocf(opcode);
+
+                switch (ogf) {
+                case OGF_INFO_PARAM:
+                        hci_cc_info_param(hdev, ocf, skb);
+                        break;
+
+                case OGF_HOST_CTL:
+                        hci_cc_host_ctl(hdev, ocf, skb);
+                        break;
+
+                case OGF_LINK_CTL:
+                        hci_cc_link_ctl(hdev, ocf, skb);
+                        break;
+
+                case OGF_LINK_POLICY:
+                        hci_cc_link_policy(hdev, ocf, skb);
+                        break;
+
+                default:
+                        BT_DBG("%s Command Completed OGF %x", hdev->name, ogf);
+                        break;
+                }
+
+                if (ec->ncmd) {
+                        atomic_set(&hdev->cmd_cnt, 1);
+                        if (!skb_queue_empty(&hdev->cmd_q))
+                                hci_sched_cmd(hdev);
+                }
+                break;
+        }
+
+        kfree_skb(skb);
+        hdev->stat.evt_rx++;
+}
+
+/* Generate internal stack event */
+void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
+{
+        struct hci_event_hdr *hdr;
+        struct hci_ev_stack_internal *ev;
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
+        hdr->evt  = HCI_EV_STACK_INTERNAL;
+        hdr->plen = sizeof(*ev) + dlen;
+
+        ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
+        ev->type = type;
+        memcpy(ev->data, data, dlen);
+
+        skb->pkt_type = HCI_EVENT_PKT;
+        skb->dev = (void *) hdev;
+        hci_send_to_sock(hdev, skb);
+        kfree_skb(skb);
+}
+EXPORT_SYMBOL(hci_si_event);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
new file mode 100644
index 000000000000..c9792ba75122
--- /dev/null
+++ b/net/bluetooth/hci_sock.c
@@ -0,0 +1,707 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth HCI sockets. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/skbuff.h>
+#include <linux/workqueue.h>
+#include <linux/interrupt.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifndef CONFIG_BT_HCI_SOCK_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+/* ----- HCI socket interface ----- */
+
+static inline int hci_test_bit(int nr, void *addr)
+{
+        return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
+}
+
+/* Security filter */
+static struct hci_sec_filter hci_sec_filter = {
+        /* Packet types */
+        0x10,
+        /* Events */
+        { 0x1000d9fe, 0x0000300c },
+        /* Commands */
+        {
+                { 0x0 },
+                /* OGF_LINK_CTL */
+                { 0xbe000006, 0x00000001, 0x0000, 0x00 },
+                /* OGF_LINK_POLICY */
+                { 0x00005200, 0x00000000, 0x0000, 0x00 },
+                /* OGF_HOST_CTL */
+                { 0xaab00200, 0x2b402aaa, 0x0154, 0x00 },
+                /* OGF_INFO_PARAM */
+                { 0x000002be, 0x00000000, 0x0000, 0x00 },
+                /* OGF_STATUS_PARAM */
+                { 0x000000ea, 0x00000000, 0x0000, 0x00 }
+        }
+};
+
+static struct bt_sock_list hci_sk_list = {
+        .lock = RW_LOCK_UNLOCKED
+};
+
+/* Send frame to RAW socket */
+void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+
+        BT_DBG("hdev %p len %d", hdev, skb->len);
+
+        read_lock(&hci_sk_list.lock);
+        sk_for_each(sk, node, &hci_sk_list.head) {
+                struct hci_filter *flt;
+                struct sk_buff *nskb;
+
+                if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
+                        continue;
+
+                /* Don't send frame to the socket it came from */
+                if (skb->sk == sk)
+                        continue;
+
+                /* Apply filter */
+                flt = &hci_pi(sk)->filter;
+
+                if (!test_bit((skb->pkt_type == HCI_VENDOR_PKT) ?
+                                0 : (skb->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
+                        continue;
+
+                if (skb->pkt_type == HCI_EVENT_PKT) {
+                        register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
+
+                        if (!hci_test_bit(evt, &flt->event_mask))
+                                continue;
+
+                        if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
+                                        flt->opcode != *(__u16 *)(skb->data + 3)) ||
+                                        (evt == HCI_EV_CMD_STATUS && 
+                                        flt->opcode != *(__u16 *)(skb->data + 4))))
+                                continue;
+                }
+
+                if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
+                        continue;
+
+                /* Put type byte before the data */
+                memcpy(skb_push(nskb, 1), &nskb->pkt_type, 1);
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+        read_unlock(&hci_sk_list.lock);
+}
+
+static int hci_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        struct hci_dev *hdev = hci_pi(sk)->hdev;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        bt_sock_unlink(&hci_sk_list, sk);
+
+        if (hdev) {
+                atomic_dec(&hdev->promisc);
+                hci_dev_put(hdev);
+        }
+
+        sock_orphan(sk);
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+
+        sock_put(sk);
+        return 0;
+}
+
+/* Ioctls that require bound socket */ 
+static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        struct hci_dev *hdev = hci_pi(sk)->hdev;
+
+        if (!hdev)
+                return -EBADFD;
+
+        switch (cmd) {
+        case HCISETRAW:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+                        return -EPERM;
+
+                if (arg)
+                        set_bit(HCI_RAW, &hdev->flags);
+                else
+                        clear_bit(HCI_RAW, &hdev->flags);
+
+                return 0;
+
+        case HCISETSECMGR:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (arg)
+                        set_bit(HCI_SECMGR, &hdev->flags);
+                else
+                        clear_bit(HCI_SECMGR, &hdev->flags);
+
+                return 0;
+
+        case HCIGETCONNINFO:
+                return hci_get_conn_info(hdev, (void __user *)arg);
+
+        default:
+                if (hdev->ioctl)
+                        return hdev->ioctl(hdev, cmd, arg);
+                return -EINVAL;
+        }
+}
+
+static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        void __user *argp = (void __user *)arg;
+        int err;
+
+        BT_DBG("cmd %x arg %lx", cmd, arg);
+
+        switch (cmd) {
+        case HCIGETDEVLIST:
+                return hci_get_dev_list(argp);
+
+        case HCIGETDEVINFO:
+                return hci_get_dev_info(argp);
+
+        case HCIGETCONNLIST:
+                return hci_get_conn_list(argp);
+
+        case HCIDEVUP:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                return hci_dev_open(arg);
+
+        case HCIDEVDOWN:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                return hci_dev_close(arg);
+
+        case HCIDEVRESET:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                return hci_dev_reset(arg);
+
+        case HCIDEVRESTAT:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                return hci_dev_reset_stat(arg);
+
+        case HCISETSCAN:
+        case HCISETAUTH:
+        case HCISETENCRYPT:
+        case HCISETPTYPE:
+        case HCISETLINKPOL:
+        case HCISETLINKMODE:
+        case HCISETACLMTU:
+        case HCISETSCOMTU:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+                return hci_dev_cmd(cmd, argp);
+
+        case HCIINQUIRY:
+                return hci_inquiry(argp);
+
+        default:
+                lock_sock(sk);
+                err = hci_sock_bound_ioctl(sk, cmd, arg);
+                release_sock(sk);
+                return err;
+        }
+}
+
+static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+{
+        struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
+        struct sock *sk = sock->sk;
+        struct hci_dev *hdev = NULL;
+        int err = 0;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (!haddr || haddr->hci_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (hci_pi(sk)->hdev) {
+                err = -EALREADY;
+                goto done;
+        }
+
+        if (haddr->hci_dev != HCI_DEV_NONE) {
+                if (!(hdev = hci_dev_get(haddr->hci_dev))) {
+                        err = -ENODEV;
+                        goto done;
+                }
+
+                atomic_inc(&hdev->promisc);
+        }
+
+        hci_pi(sk)->hdev = hdev;
+        sk->sk_state = BT_BOUND;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
+{
+        struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        lock_sock(sk);
+
+        *addr_len = sizeof(*haddr);
+        haddr->hci_family = AF_BLUETOOTH;
+        haddr->hci_dev    = hci_pi(sk)->hdev->id;
+
+        release_sock(sk);
+        return 0;
+}
+
+static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
+{
+        __u32 mask = hci_pi(sk)->cmsg_mask;
+
+        if (mask & HCI_CMSG_DIR)
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(int), &bt_cb(skb)->incoming);
+
+        if (mask & HCI_CMSG_TSTAMP)
+                put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
+}
+ 
+static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
+                                struct msghdr *msg, size_t len, int flags)
+{
+        int noblock = flags & MSG_DONTWAIT;
+        struct sock *sk = sock->sk;
+        struct sk_buff *skb;
+        int copied, err;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (flags & (MSG_OOB))
+                return -EOPNOTSUPP;
+
+        if (sk->sk_state == BT_CLOSED)
+                return 0;
+
+        if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
+                return err;
+
+        msg->msg_namelen = 0;
+
+        copied = skb->len;
+        if (len < copied) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+
+        skb->h.raw = skb->data;
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+
+        hci_sock_cmsg(sk, msg, skb);
+
+        skb_free_datagram(sk, skb);
+
+        return err ? : copied;
+}
+
+static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 
+                            struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct hci_dev *hdev;
+        struct sk_buff *skb;
+        int err;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
+                return -EINVAL;
+
+        if (len < 4 || len > HCI_MAX_FRAME_SIZE)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (!(hdev = hci_pi(sk)->hdev)) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
+                goto done;
+
+        if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
+                err = -EFAULT;
+                goto drop;
+        }
+
+        skb->pkt_type = *((unsigned char *) skb->data);
+        skb_pull(skb, 1);
+        skb->dev = (void *) hdev;
+
+        if (skb->pkt_type == HCI_COMMAND_PKT) {
+                u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
+                u16 ogf = hci_opcode_ogf(opcode);
+                u16 ocf = hci_opcode_ocf(opcode);
+
+                if (((ogf > HCI_SFLT_MAX_OGF) ||
+                                !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
+                                        !capable(CAP_NET_RAW)) {
+                        err = -EPERM;
+                        goto drop;
+                }
+
+                if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {
+                        skb_queue_tail(&hdev->raw_q, skb);
+                        hci_sched_tx(hdev);
+                } else {
+                        skb_queue_tail(&hdev->cmd_q, skb);
+                        hci_sched_cmd(hdev);
+                }
+        } else {
+                if (!capable(CAP_NET_RAW)) {
+                        err = -EPERM;
+                        goto drop;
+                }
+
+                skb_queue_tail(&hdev->raw_q, skb);
+                hci_sched_tx(hdev);
+        }
+
+        err = len;
+
+done:
+        release_sock(sk);
+        return err;
+
+drop:
+        kfree_skb(skb);
+        goto done;
+}
+
+static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int len)
+{
+        struct hci_ufilter uf = { .opcode = 0 };
+        struct sock *sk = sock->sk;
+        int err = 0, opt = 0;
+
+        BT_DBG("sk %p, opt %d", sk, optname);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case HCI_DATA_DIR:
+                if (get_user(opt, (int __user *)optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt)
+                        hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
+                else
+                        hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
+                break;
+
+        case HCI_TIME_STAMP:
+                if (get_user(opt, (int __user *)optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt)
+                        hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
+                else
+                        hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
+                break;
+
+        case HCI_FILTER:
+                len = min_t(unsigned int, len, sizeof(uf));
+                if (copy_from_user(&uf, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (!capable(CAP_NET_RAW)) {
+                        uf.type_mask &= hci_sec_filter.type_mask;
+                        uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
+                        uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
+                }
+
+                {
+                        struct hci_filter *f = &hci_pi(sk)->filter;
+
+                        f->type_mask = uf.type_mask;
+                        f->opcode    = uf.opcode;
+                        *((u32 *) f->event_mask + 0) = uf.event_mask[0];
+                        *((u32 *) f->event_mask + 1) = uf.event_mask[1];
+                }
+                break; 
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+{
+        struct hci_ufilter uf;
+        struct sock *sk = sock->sk;
+        int len, opt; 
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        switch (optname) {
+        case HCI_DATA_DIR:
+                if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
+                        opt = 1;
+                else 
+                        opt = 0;
+
+                if (put_user(opt, optval))
+                        return -EFAULT;
+                break;
+
+        case HCI_TIME_STAMP:
+                if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
+                        opt = 1;
+                else 
+                        opt = 0;
+
+                if (put_user(opt, optval))
+                        return -EFAULT;
+                break;
+
+        case HCI_FILTER:
+                {
+                        struct hci_filter *f = &hci_pi(sk)->filter;
+
+                        uf.type_mask = f->type_mask;
+                        uf.opcode    = f->opcode;
+                        uf.event_mask[0] = *((u32 *) f->event_mask + 0);
+                        uf.event_mask[1] = *((u32 *) f->event_mask + 1);
+                }
+
+                len = min_t(unsigned int, len, sizeof(uf));
+                if (copy_to_user(optval, &uf, len))
+                        return -EFAULT;
+                break;
+
+        default:
+                return -ENOPROTOOPT;
+                break;
+        }
+
+        return 0;
+}
+
+static struct proto_ops hci_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = hci_sock_release,
+        .bind           = hci_sock_bind,
+        .getname        = hci_sock_getname,
+        .sendmsg        = hci_sock_sendmsg,
+        .recvmsg        = hci_sock_recvmsg,
+        .ioctl          = hci_sock_ioctl,
+        .poll           = datagram_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = hci_sock_setsockopt,
+        .getsockopt     = hci_sock_getsockopt,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .mmap           = sock_no_mmap
+};
+
+static struct proto hci_sk_proto = {
+        .name           = "HCI",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct hci_pinfo)
+};
+
+static int hci_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        if (sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        sock->ops = &hci_sock_ops;
+
+        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
+        if (!sk)
+                return -ENOMEM;
+
+        sock_init_data(sock, sk);
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = protocol;
+
+        sock->state = SS_UNCONNECTED;
+        sk->sk_state = BT_OPEN;
+
+        bt_sock_link(&hci_sk_list, sk);
+        return 0;
+}
+
+static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
+{
+        struct hci_dev *hdev = (struct hci_dev *) ptr;
+        struct hci_ev_si_device ev;
+
+        BT_DBG("hdev %s event %ld", hdev->name, event);
+
+        /* Send event to sockets */
+        ev.event  = event;
+        ev.dev_id = hdev->id;
+        hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
+
+        if (event == HCI_DEV_UNREG) {
+                struct sock *sk;
+                struct hlist_node *node;
+
+                /* Detach sockets from device */
+                read_lock(&hci_sk_list.lock);
+                sk_for_each(sk, node, &hci_sk_list.head) {
+                        bh_lock_sock(sk);
+                        if (hci_pi(sk)->hdev == hdev) {
+                                hci_pi(sk)->hdev = NULL;
+                                sk->sk_err = EPIPE;
+                                sk->sk_state = BT_OPEN;
+                                sk->sk_state_change(sk);
+
+                                hci_dev_put(hdev);
+                        }
+                        bh_unlock_sock(sk);
+                }
+                read_unlock(&hci_sk_list.lock);
+        }
+
+        return NOTIFY_DONE;
+}
+
+static struct net_proto_family hci_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = hci_sock_create,
+};
+
+static struct notifier_block hci_sock_nblock = {
+        .notifier_call = hci_sock_dev_event
+};
+
+int __init hci_sock_init(void)
+{
+        int err;
+
+        err = proto_register(&hci_sk_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        hci_register_notifier(&hci_sock_nblock);
+
+        BT_INFO("HCI socket layer initialized");
+
+        return 0;
+
+error:
+        BT_ERR("HCI socket registration failed");
+        proto_unregister(&hci_sk_proto);
+        return err;
+}
+
+int __exit hci_sock_cleanup(void)
+{
+        if (bt_sock_unregister(BTPROTO_HCI) < 0)
+                BT_ERR("HCI socket unregistration failed");
+
+        hci_unregister_notifier(&hci_sock_nblock);
+
+        proto_unregister(&hci_sk_proto);
+
+        return 0;
+}
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
new file mode 100644
index 000000000000..7856bc26accb
--- /dev/null
+++ b/net/bluetooth/hci_sysfs.c
@@ -0,0 +1,153 @@
+/* Bluetooth HCI driver model support. */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+
+#ifndef CONFIG_BT_HCI_CORE_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static ssize_t show_name(struct class_device *cdev, char *buf)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        return sprintf(buf, "%s\n", hdev->name);
+}
+
+static ssize_t show_type(struct class_device *cdev, char *buf)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        return sprintf(buf, "%d\n", hdev->type);
+}
+
+static ssize_t show_address(struct class_device *cdev, char *buf)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        bdaddr_t bdaddr;
+        baswap(&bdaddr, &hdev->bdaddr);
+        return sprintf(buf, "%s\n", batostr(&bdaddr));
+}
+
+static ssize_t show_flags(struct class_device *cdev, char *buf)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        return sprintf(buf, "0x%lx\n", hdev->flags);
+}
+
+static ssize_t show_inquiry_cache(struct class_device *cdev, char *buf)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        struct inquiry_cache *cache = &hdev->inq_cache;
+        struct inquiry_entry *e;
+        int n = 0;
+
+        hci_dev_lock_bh(hdev);
+
+        for (e = cache->list; e; e = e->next) {
+                struct inquiry_data *data = &e->data;
+                bdaddr_t bdaddr;
+                baswap(&bdaddr, &data->bdaddr);
+                n += sprintf(buf + n, "%s %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %u\n",
+                                batostr(&bdaddr),
+                                data->pscan_rep_mode, data->pscan_period_mode, data->pscan_mode,
+                                data->dev_class[2], data->dev_class[1], data->dev_class[0],
+                                __le16_to_cpu(data->clock_offset), data->rssi, e->timestamp);
+        }
+
+        hci_dev_unlock_bh(hdev);
+        return n;
+}
+
+static CLASS_DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+static CLASS_DEVICE_ATTR(type, S_IRUGO, show_type, NULL);
+static CLASS_DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
+static CLASS_DEVICE_ATTR(flags, S_IRUGO, show_flags, NULL);
+static CLASS_DEVICE_ATTR(inquiry_cache, S_IRUGO, show_inquiry_cache, NULL);
+
+static struct class_device_attribute *bt_attrs[] = {
+        &class_device_attr_name,
+        &class_device_attr_type,
+        &class_device_attr_address,
+        &class_device_attr_flags,
+        &class_device_attr_inquiry_cache,
+        NULL
+};
+
+#ifdef CONFIG_HOTPLUG
+static int bt_hotplug(struct class_device *cdev, char **envp, int num_envp, char *buf, int size)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+        int n, i = 0;
+
+        envp[i++] = buf;
+        n = snprintf(buf, size, "INTERFACE=%s", hdev->name) + 1;
+        buf += n;
+        size -= n;
+
+        if ((size <= 0) || (i >= num_envp))
+                return -ENOMEM;
+
+        envp[i] = NULL;
+        return 0;
+}
+#endif
+
+static void bt_release(struct class_device *cdev)
+{
+        struct hci_dev *hdev = class_get_devdata(cdev);
+
+        kfree(hdev);
+}
+
+static struct class bt_class = {
+        .name           = "bluetooth",
+        .release        = bt_release,
+#ifdef CONFIG_HOTPLUG
+        .hotplug        = bt_hotplug,
+#endif
+};
+
+int hci_register_sysfs(struct hci_dev *hdev)
+{
+        struct class_device *cdev = &hdev->class_dev;
+        unsigned int i;
+        int err;
+
+        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+
+        cdev->class = &bt_class;
+        class_set_devdata(cdev, hdev);
+
+        strlcpy(cdev->class_id, hdev->name, BUS_ID_SIZE);
+        err = class_device_register(cdev);
+        if (err < 0)
+                return err;
+
+        for (i = 0; bt_attrs[i]; i++)
+                class_device_create_file(cdev, bt_attrs[i]);
+
+        return 0;
+}
+
+void hci_unregister_sysfs(struct hci_dev *hdev)
+{
+        struct class_device * cdev = &hdev->class_dev;
+
+        BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
+
+        class_device_del(cdev);
+}
+
+int __init bt_sysfs_init(void)
+{
+        return class_register(&bt_class);
+}
+
+void __exit bt_sysfs_cleanup(void)
+{
+        class_unregister(&bt_class);
+}
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
new file mode 100644
index 000000000000..4e958f7d9418
--- /dev/null
+++ b/net/bluetooth/hidp/Kconfig
@@ -0,0 +1,12 @@
+config BT_HIDP
+        tristate "HIDP protocol support"
+        depends on BT && BT_L2CAP
+        select INPUT
+        help
+          HIDP (Human Interface Device Protocol) is a transport layer
+          for HID reports.  HIDP is required for the Bluetooth Human
+          Interface Device Profile.
+
+          Say Y here to compile HIDP support into the kernel or say M to
+          compile it as module (hidp).
+
diff --git a/net/bluetooth/hidp/Makefile b/net/bluetooth/hidp/Makefile
new file mode 100644
index 000000000000..a9ee115696ae
--- /dev/null
+++ b/net/bluetooth/hidp/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for the Linux Bluetooth HIDP layer
+#
+
+obj-$(CONFIG_BT_HIDP) += hidp.o
+
+hidp-objs := core.o sock.o
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
new file mode 100644
index 000000000000..2cf98ceabcc7
--- /dev/null
+++ b/net/bluetooth/hidp/core.c
@@ -0,0 +1,772 @@
+/* 
+   HIDP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <net/sock.h>
+
+#include <linux/input.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/l2cap.h>
+
+#include "hidp.h"
+
+#ifndef CONFIG_BT_HIDP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "1.1"
+
+static DECLARE_RWSEM(hidp_session_sem);
+static LIST_HEAD(hidp_session_list);
+
+static unsigned char hidp_keycode[256] = {
+          0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
+         50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
+          4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
+         27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
+         65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
+        105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
+         72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
+        191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
+        115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
+        122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+          0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
+         29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
+        150,158,159,128,136,177,178,176,142,152,173,140
+};
+
+static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
+
+static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
+{
+        struct hidp_session *session;
+        struct list_head *p;
+
+        BT_DBG("");
+
+        list_for_each(p, &hidp_session_list) {
+                session = list_entry(p, struct hidp_session, list);
+                if (!bacmp(bdaddr, &session->bdaddr))
+                        return session;
+        }
+        return NULL;
+}
+
+static void __hidp_link_session(struct hidp_session *session)
+{
+        __module_get(THIS_MODULE);
+        list_add(&session->list, &hidp_session_list);
+}
+
+static void __hidp_unlink_session(struct hidp_session *session)
+{
+        list_del(&session->list);
+        module_put(THIS_MODULE);
+}
+
+static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
+{
+        bacpy(&ci->bdaddr, &session->bdaddr);
+
+        ci->flags = session->flags;
+        ci->state = session->state;
+
+        ci->vendor  = 0x0000;
+        ci->product = 0x0000;
+        ci->version = 0x0000;
+        memset(ci->name, 0, 128);
+
+        if (session->input) {
+                ci->vendor  = session->input->id.vendor;
+                ci->product = session->input->id.product;
+                ci->version = session->input->id.version;
+                if (session->input->name)
+                        strncpy(ci->name, session->input->name, 128);
+                else
+                        strncpy(ci->name, "HID Boot Device", 128);
+        }
+}
+
+static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
+{
+        struct hidp_session *session = dev->private;
+        struct sk_buff *skb;
+        unsigned char newleds;
+
+        BT_DBG("input %p type %d code %d value %d", dev, type, code, value);
+
+        if (type != EV_LED)
+                return -1;
+
+        newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
+                  (!!test_bit(LED_COMPOSE, dev->led) << 3) |
+                  (!!test_bit(LED_SCROLLL, dev->led) << 2) |
+                  (!!test_bit(LED_CAPSL,   dev->led) << 1) |
+                  (!!test_bit(LED_NUML,    dev->led));
+
+        if (session->leds == newleds)
+                return 0;
+
+        session->leds = newleds;
+
+        if (!(skb = alloc_skb(3, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
+        *skb_put(skb, 1) = 0x01;
+        *skb_put(skb, 1) = newleds;
+
+        skb_queue_tail(&session->intr_transmit, skb);
+
+        hidp_schedule(session);
+
+        return 0;
+}
+
+static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
+{
+        struct input_dev *dev = session->input;
+        unsigned char *keys = session->keys;
+        unsigned char *udata = skb->data + 1;
+        signed char *sdata = skb->data + 1;
+        int i, size = skb->len - 1;
+
+        switch (skb->data[0]) {
+        case 0x01:      /* Keyboard report */
+                for (i = 0; i < 8; i++)
+                        input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
+
+                /* If all the key codes have been set to 0x01, it means
+                 * too many keys were pressed at the same time. */
+                if (!memcmp(udata + 2, hidp_mkeyspat, 6))
+                        break;
+
+                for (i = 2; i < 8; i++) {
+                        if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
+                                if (hidp_keycode[keys[i]])
+                                        input_report_key(dev, hidp_keycode[keys[i]], 0);
+                                else
+                                        BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
+                        }
+
+                        if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
+                                if (hidp_keycode[udata[i]])
+                                        input_report_key(dev, hidp_keycode[udata[i]], 1);
+                                else
+                                        BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
+                        }
+                }
+
+                memcpy(keys, udata, 8);
+                break;
+
+        case 0x02:      /* Mouse report */
+                input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
+                input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
+                input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
+                input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
+                input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
+
+                input_report_rel(dev, REL_X, sdata[1]);
+                input_report_rel(dev, REL_Y, sdata[2]);
+
+                if (size > 3)
+                        input_report_rel(dev, REL_WHEEL, sdata[3]);
+                break;
+        }
+
+        input_sync(dev);
+}
+
+static void hidp_idle_timeout(unsigned long arg)
+{
+        struct hidp_session *session = (struct hidp_session *) arg;
+
+        atomic_inc(&session->terminate);
+        hidp_schedule(session);
+}
+
+static inline void hidp_set_timer(struct hidp_session *session)
+{
+        if (session->idle_to > 0)
+                mod_timer(&session->timer, jiffies + HZ * session->idle_to);
+}
+
+static inline void hidp_del_timer(struct hidp_session *session)
+{
+        if (session->idle_to > 0)
+                del_timer(&session->timer);
+}
+
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p data %p size %d", session, data, size);
+
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+
+        skb_queue_tail(&session->ctrl_transmit, skb);
+
+        return 0;
+}
+
+static int inline hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+
+        hidp_schedule(session);
+
+        return err;
+}
+
+static inline void hidp_process_handshake(struct hidp_session *session, unsigned char param)
+{
+        BT_DBG("session %p param 0x%02x", session, param);
+
+        switch (param) {
+        case HIDP_HSHK_SUCCESSFUL:
+                /* FIXME: Call into SET_ GET_ handlers here */
+                break;
+
+        case HIDP_HSHK_NOT_READY:
+        case HIDP_HSHK_ERR_INVALID_REPORT_ID:
+        case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
+        case HIDP_HSHK_ERR_INVALID_PARAMETER:
+                /* FIXME: Call into SET_ GET_ handlers here */
+                break;
+
+        case HIDP_HSHK_ERR_UNKNOWN:
+                break;
+
+        case HIDP_HSHK_ERR_FATAL:
+                /* Device requests a reboot, as this is the only way this error
+                 * can be recovered. */
+                __hidp_send_ctrl_message(session,
+                        HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
+                break;
+
+        default:
+                __hidp_send_ctrl_message(session,
+                        HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
+                break;
+        }
+}
+
+static inline void hidp_process_hid_control(struct hidp_session *session, unsigned char param)
+{
+        BT_DBG("session %p param 0x%02x", session, param);
+
+        switch (param) {
+        case HIDP_CTRL_NOP:
+                break;
+
+        case HIDP_CTRL_VIRTUAL_CABLE_UNPLUG:
+                /* Flush the transmit queues */
+                skb_queue_purge(&session->ctrl_transmit);
+                skb_queue_purge(&session->intr_transmit);
+
+                /* Kill session thread */
+                atomic_inc(&session->terminate);
+                break;
+
+        case HIDP_CTRL_HARD_RESET:
+        case HIDP_CTRL_SOFT_RESET:
+        case HIDP_CTRL_SUSPEND:
+        case HIDP_CTRL_EXIT_SUSPEND:
+                /* FIXME: We have to parse these and return no error */
+                break;
+
+        default:
+                __hidp_send_ctrl_message(session,
+                        HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
+                break;
+        }
+}
+
+static inline void hidp_process_data(struct hidp_session *session, struct sk_buff *skb, unsigned char param)
+{
+        BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
+
+        switch (param) {
+        case HIDP_DATA_RTYPE_INPUT:
+                hidp_set_timer(session);
+
+                if (session->input)
+                        hidp_input_report(session, skb);
+                break;
+
+        case HIDP_DATA_RTYPE_OTHER:
+        case HIDP_DATA_RTYPE_OUPUT:
+        case HIDP_DATA_RTYPE_FEATURE:
+                break;
+
+        default:
+                __hidp_send_ctrl_message(session,
+                        HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
+        }
+}
+
+static inline void hidp_recv_ctrl_frame(struct hidp_session *session, struct sk_buff *skb)
+{
+        unsigned char hdr, type, param;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        hdr = skb->data[0];
+        skb_pull(skb, 1);
+
+        type = hdr & HIDP_HEADER_TRANS_MASK;
+        param = hdr & HIDP_HEADER_PARAM_MASK;
+
+        switch (type) {
+        case HIDP_TRANS_HANDSHAKE:
+                hidp_process_handshake(session, param);
+                break;
+
+        case HIDP_TRANS_HID_CONTROL:
+                hidp_process_hid_control(session, param);
+                break;
+
+        case HIDP_TRANS_DATA:
+                hidp_process_data(session, skb, param);
+                break;
+
+        default:
+                __hidp_send_ctrl_message(session,
+                        HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
+                break;
+        }
+
+        kfree_skb(skb);
+}
+
+static inline void hidp_recv_intr_frame(struct hidp_session *session, struct sk_buff *skb)
+{
+        unsigned char hdr;
+
+        BT_DBG("session %p skb %p len %d", session, skb, skb->len);
+
+        hdr = skb->data[0];
+        skb_pull(skb, 1);
+
+        if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
+                hidp_set_timer(session);
+                if (session->input)
+                        hidp_input_report(session, skb);
+        } else {
+                BT_DBG("Unsupported protocol header 0x%02x", hdr);
+        }
+
+        kfree_skb(skb);
+}
+
+static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
+{
+        struct kvec iv = { data, len };
+        struct msghdr msg;
+
+        BT_DBG("sock %p data %p len %d", sock, data, len);
+
+        if (!len)
+                return 0;
+
+        memset(&msg, 0, sizeof(msg));
+
+        return kernel_sendmsg(sock, &msg, &iv, 1, len);
+}
+
+static int hidp_process_transmit(struct hidp_session *session)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p", session);
+
+        while ((skb = skb_dequeue(&session->ctrl_transmit))) {
+                if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
+                        skb_queue_head(&session->ctrl_transmit, skb);
+                        break;
+                }
+
+                hidp_set_timer(session);
+                kfree_skb(skb);
+        }
+
+        while ((skb = skb_dequeue(&session->intr_transmit))) {
+                if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
+                        skb_queue_head(&session->intr_transmit, skb);
+                        break;
+                }
+
+                hidp_set_timer(session);
+                kfree_skb(skb);
+        }
+
+        return skb_queue_len(&session->ctrl_transmit) +
+                                skb_queue_len(&session->intr_transmit);
+}
+
+static int hidp_session(void *arg)
+{
+        struct hidp_session *session = arg;
+        struct sock *ctrl_sk = session->ctrl_sock->sk;
+        struct sock *intr_sk = session->intr_sock->sk;
+        struct sk_buff *skb;
+        int vendor = 0x0000, product = 0x0000;
+        wait_queue_t ctrl_wait, intr_wait;
+
+        BT_DBG("session %p", session);
+
+        if (session->input) {
+                vendor  = session->input->id.vendor;
+                product = session->input->id.product;
+        }
+
+        daemonize("khidpd_%04x%04x", vendor, product);
+        set_user_nice(current, -15);
+        current->flags |= PF_NOFREEZE;
+
+        init_waitqueue_entry(&ctrl_wait, current);
+        init_waitqueue_entry(&intr_wait, current);
+        add_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
+        add_wait_queue(intr_sk->sk_sleep, &intr_wait);
+        while (!atomic_read(&session->terminate)) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
+                        break;
+
+                while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
+                        skb_orphan(skb);
+                        hidp_recv_ctrl_frame(session, skb);
+                }
+
+                while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
+                        skb_orphan(skb);
+                        hidp_recv_intr_frame(session, skb);
+                }
+
+                hidp_process_transmit(session);
+
+                schedule();
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(intr_sk->sk_sleep, &intr_wait);
+        remove_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
+
+        down_write(&hidp_session_sem);
+
+        hidp_del_timer(session);
+
+        if (intr_sk->sk_state != BT_CONNECTED)
+                wait_event_timeout(*(ctrl_sk->sk_sleep), (ctrl_sk->sk_state == BT_CLOSED), HZ);
+
+        fput(session->ctrl_sock->file);
+
+        wait_event_timeout(*(intr_sk->sk_sleep), (intr_sk->sk_state == BT_CLOSED), HZ);
+
+        fput(session->intr_sock->file);
+
+        __hidp_unlink_session(session);
+
+        if (session->input) {
+                input_unregister_device(session->input);
+                kfree(session->input);
+        }
+
+        up_write(&hidp_session_sem);
+
+        kfree(session);
+        return 0;
+}
+
+static inline void hidp_setup_input(struct hidp_session *session, struct hidp_connadd_req *req)
+{
+        struct input_dev *input = session->input;
+        int i;
+
+        input->private = session;
+
+        input->id.bustype = BUS_BLUETOOTH;
+        input->id.vendor  = req->vendor;
+        input->id.product = req->product;
+        input->id.version = req->version;
+
+        if (req->subclass & 0x40) {
+                set_bit(EV_KEY, input->evbit);
+                set_bit(EV_LED, input->evbit);
+                set_bit(EV_REP, input->evbit);
+
+                set_bit(LED_NUML,    input->ledbit);
+                set_bit(LED_CAPSL,   input->ledbit);
+                set_bit(LED_SCROLLL, input->ledbit);
+                set_bit(LED_COMPOSE, input->ledbit);
+                set_bit(LED_KANA,    input->ledbit);
+
+                for (i = 0; i < sizeof(hidp_keycode); i++)
+                        set_bit(hidp_keycode[i], input->keybit);
+                clear_bit(0, input->keybit);
+        }
+
+        if (req->subclass & 0x80) {
+                input->evbit[0] = BIT(EV_KEY) | BIT(EV_REL);
+                input->keybit[LONG(BTN_MOUSE)] = BIT(BTN_LEFT) | BIT(BTN_RIGHT) | BIT(BTN_MIDDLE);
+                input->relbit[0] = BIT(REL_X) | BIT(REL_Y);
+                input->keybit[LONG(BTN_MOUSE)] |= BIT(BTN_SIDE) | BIT(BTN_EXTRA);
+                input->relbit[0] |= BIT(REL_WHEEL);
+        }
+
+        input->event = hidp_input_event;
+
+        input_register_device(input);
+}
+
+int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
+{
+        struct hidp_session *session, *s;
+        int err;
+
+        BT_DBG("");
+
+        if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
+                        bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
+                return -ENOTUNIQ;
+
+        session = kmalloc(sizeof(struct hidp_session), GFP_KERNEL);
+        if (!session) 
+                return -ENOMEM;
+        memset(session, 0, sizeof(struct hidp_session));
+
+        session->input = kmalloc(sizeof(struct input_dev), GFP_KERNEL);
+        if (!session->input) {
+                kfree(session);
+                return -ENOMEM;
+        }
+        memset(session->input, 0, sizeof(struct input_dev));
+
+        down_write(&hidp_session_sem);
+
+        s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
+        if (s && s->state == BT_CONNECTED) {
+                err = -EEXIST;
+                goto failed;
+        }
+
+        bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
+
+        session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
+        session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
+
+        BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
+
+        session->ctrl_sock = ctrl_sock;
+        session->intr_sock = intr_sock;
+        session->state     = BT_CONNECTED;
+
+        init_timer(&session->timer);
+
+        session->timer.function = hidp_idle_timeout;
+        session->timer.data     = (unsigned long) session;
+
+        skb_queue_head_init(&session->ctrl_transmit);
+        skb_queue_head_init(&session->intr_transmit);
+
+        session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
+        session->idle_to = req->idle_to;
+
+        if (session->input)
+                hidp_setup_input(session, req);
+
+        __hidp_link_session(session);
+
+        hidp_set_timer(session);
+
+        err = kernel_thread(hidp_session, session, CLONE_KERNEL);
+        if (err < 0)
+                goto unlink;
+
+        if (session->input) {
+                hidp_send_ctrl_message(session,
+                        HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
+                session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
+
+                session->leds = 0xff;
+                hidp_input_event(session->input, EV_LED, 0, 0);
+        }
+
+        up_write(&hidp_session_sem);
+        return 0;
+
+unlink:
+        hidp_del_timer(session);
+
+        __hidp_unlink_session(session);
+
+        if (session->input)
+                input_unregister_device(session->input);
+
+failed:
+        up_write(&hidp_session_sem);
+
+        if (session->input)
+                kfree(session->input);
+
+        kfree(session);
+        return err;
+}
+
+int hidp_del_connection(struct hidp_conndel_req *req)
+{
+        struct hidp_session *session;
+        int err = 0;
+
+        BT_DBG("");
+
+        down_read(&hidp_session_sem);
+
+        session = __hidp_get_session(&req->bdaddr);
+        if (session) {
+                if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
+                        hidp_send_ctrl_message(session,
+                                HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
+                } else {
+                        /* Flush the transmit queues */
+                        skb_queue_purge(&session->ctrl_transmit);
+                        skb_queue_purge(&session->intr_transmit);
+
+                        /* Kill session thread */
+                        atomic_inc(&session->terminate);
+                        hidp_schedule(session);
+                }
+        } else
+                err = -ENOENT;
+
+        up_read(&hidp_session_sem);
+        return err;
+}
+
+int hidp_get_connlist(struct hidp_connlist_req *req)
+{
+        struct list_head *p;
+        int err = 0, n = 0;
+
+        BT_DBG("");
+
+        down_read(&hidp_session_sem);
+
+        list_for_each(p, &hidp_session_list) {
+                struct hidp_session *session;
+                struct hidp_conninfo ci;
+
+                session = list_entry(p, struct hidp_session, list);
+
+                __hidp_copy_session(session, &ci);
+
+                if (copy_to_user(req->ci, &ci, sizeof(ci))) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (++n >= req->cnum)
+                        break;
+
+                req->ci++;
+        }
+        req->cnum = n;
+
+        up_read(&hidp_session_sem);
+        return err;
+}
+
+int hidp_get_conninfo(struct hidp_conninfo *ci)
+{
+        struct hidp_session *session;
+        int err = 0;
+
+        down_read(&hidp_session_sem);
+
+        session = __hidp_get_session(&ci->bdaddr);
+        if (session)
+                __hidp_copy_session(session, ci);
+        else
+                err = -ENOENT;
+
+        up_read(&hidp_session_sem);
+        return err;
+}
+
+static int __init hidp_init(void)
+{
+        l2cap_load();
+
+        BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
+
+        return hidp_init_sockets();
+}
+
+static void __exit hidp_exit(void)
+{
+        hidp_cleanup_sockets();
+}
+
+module_init(hidp_init);
+module_exit(hidp_exit);
+
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-6");
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
new file mode 100644
index 000000000000..c2775f587d2e
--- /dev/null
+++ b/net/bluetooth/hidp/hidp.h
@@ -0,0 +1,167 @@
+/* 
+   HIDP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#ifndef __HIDP_H
+#define __HIDP_H
+
+#include <linux/types.h>
+#include <net/bluetooth/bluetooth.h>
+
+/* HIDP header masks */
+#define HIDP_HEADER_TRANS_MASK                  0xf0
+#define HIDP_HEADER_PARAM_MASK                  0x0f
+
+/* HIDP transaction types */
+#define HIDP_TRANS_HANDSHAKE                    0x00
+#define HIDP_TRANS_HID_CONTROL                  0x10
+#define HIDP_TRANS_GET_REPORT                   0x40
+#define HIDP_TRANS_SET_REPORT                   0x50
+#define HIDP_TRANS_GET_PROTOCOL                 0x60
+#define HIDP_TRANS_SET_PROTOCOL                 0x70
+#define HIDP_TRANS_GET_IDLE                     0x80
+#define HIDP_TRANS_SET_IDLE                     0x90
+#define HIDP_TRANS_DATA                         0xa0
+#define HIDP_TRANS_DATC                         0xb0
+
+/* HIDP handshake results */
+#define HIDP_HSHK_SUCCESSFUL                    0x00
+#define HIDP_HSHK_NOT_READY                     0x01
+#define HIDP_HSHK_ERR_INVALID_REPORT_ID         0x02
+#define HIDP_HSHK_ERR_UNSUPPORTED_REQUEST       0x03
+#define HIDP_HSHK_ERR_INVALID_PARAMETER         0x04
+#define HIDP_HSHK_ERR_UNKNOWN                   0x0e
+#define HIDP_HSHK_ERR_FATAL                     0x0f
+
+/* HIDP control operation parameters */
+#define HIDP_CTRL_NOP                           0x00
+#define HIDP_CTRL_HARD_RESET                    0x01
+#define HIDP_CTRL_SOFT_RESET                    0x02
+#define HIDP_CTRL_SUSPEND                       0x03
+#define HIDP_CTRL_EXIT_SUSPEND                  0x04
+#define HIDP_CTRL_VIRTUAL_CABLE_UNPLUG          0x05
+
+/* HIDP data transaction headers */
+#define HIDP_DATA_RTYPE_MASK                    0x03
+#define HIDP_DATA_RSRVD_MASK                    0x0c
+#define HIDP_DATA_RTYPE_OTHER                   0x00
+#define HIDP_DATA_RTYPE_INPUT                   0x01
+#define HIDP_DATA_RTYPE_OUPUT                   0x02
+#define HIDP_DATA_RTYPE_FEATURE                 0x03
+
+/* HIDP protocol header parameters */
+#define HIDP_PROTO_BOOT                         0x00
+#define HIDP_PROTO_REPORT                       0x01
+
+/* HIDP ioctl defines */
+#define HIDPCONNADD     _IOW('H', 200, int)
+#define HIDPCONNDEL     _IOW('H', 201, int)
+#define HIDPGETCONNLIST _IOR('H', 210, int)
+#define HIDPGETCONNINFO _IOR('H', 211, int)
+
+#define HIDP_VIRTUAL_CABLE_UNPLUG       0
+#define HIDP_BOOT_PROTOCOL_MODE         1
+#define HIDP_BLUETOOTH_VENDOR_ID        9
+
+struct hidp_connadd_req {
+        int   ctrl_sock;        // Connected control socket
+        int   intr_sock;        // Connteted interrupt socket
+        __u16 parser;
+        __u16 rd_size;
+        __u8 *rd_data;
+        __u8  country;
+        __u8  subclass;
+        __u16 vendor;
+        __u16 product;
+        __u16 version;
+        __u32 flags;
+        __u32 idle_to;
+        char  name[128];
+};
+
+struct hidp_conndel_req {
+        bdaddr_t bdaddr;
+        __u32    flags;
+};
+
+struct hidp_conninfo {
+        bdaddr_t bdaddr;
+        __u32    flags;
+        __u16    state;
+        __u16    vendor;
+        __u16    product;
+        __u16    version;
+        char     name[128];
+};
+
+struct hidp_connlist_req {
+        __u32  cnum;
+        struct hidp_conninfo __user *ci;
+};
+
+int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock);
+int hidp_del_connection(struct hidp_conndel_req *req);
+int hidp_get_connlist(struct hidp_connlist_req *req);
+int hidp_get_conninfo(struct hidp_conninfo *ci);
+
+/* HIDP session defines */
+struct hidp_session {
+        struct list_head list;
+
+        struct socket *ctrl_sock;
+        struct socket *intr_sock;
+
+        bdaddr_t bdaddr;
+
+        unsigned long state;
+        unsigned long flags;
+        unsigned long idle_to;
+
+        uint ctrl_mtu;
+        uint intr_mtu;
+
+        atomic_t terminate;
+
+        unsigned char keys[8];
+        unsigned char leds;
+
+        struct input_dev *input;
+
+        struct timer_list timer;
+
+        struct sk_buff_head ctrl_transmit;
+        struct sk_buff_head intr_transmit;
+};
+
+static inline void hidp_schedule(struct hidp_session *session)
+{
+        struct sock *ctrl_sk = session->ctrl_sock->sk;
+        struct sock *intr_sk = session->intr_sock->sk;
+
+        wake_up_interruptible(ctrl_sk->sk_sleep);
+        wake_up_interruptible(intr_sk->sk_sleep);
+}
+
+/* HIDP init defines */
+extern int __init hidp_init_sockets(void);
+extern void __exit hidp_cleanup_sockets(void);
+
+#endif /* __HIDP_H */
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
new file mode 100644
index 000000000000..fabb36d4666b
--- /dev/null
+++ b/net/bluetooth/hidp/sock.c
@@ -0,0 +1,232 @@
+/* 
+   HIDP implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/skbuff.h>
+#include <linux/socket.h>
+#include <linux/ioctl.h>
+#include <linux/file.h>
+#include <linux/init.h>
+#include <net/sock.h>
+
+#include "hidp.h"
+
+#ifndef CONFIG_BT_HIDP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static int hidp_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        sock_orphan(sk);
+        sock_put(sk);
+
+        return 0;
+}
+
+static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = (void __user *) arg;
+        struct hidp_connadd_req ca;
+        struct hidp_conndel_req cd;
+        struct hidp_connlist_req cl;
+        struct hidp_conninfo ci;
+        struct socket *csock;
+        struct socket *isock;
+        int err;
+
+        BT_DBG("cmd %x arg %lx", cmd, arg);
+
+        switch (cmd) {
+        case HIDPCONNADD:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&ca, argp, sizeof(ca)))
+                        return -EFAULT;
+
+                csock = sockfd_lookup(ca.ctrl_sock, &err);
+                if (!csock)
+                        return err;
+
+                isock = sockfd_lookup(ca.intr_sock, &err);
+                if (!isock) {
+                        fput(csock->file);
+                        return err;
+                }
+
+                if (csock->sk->sk_state != BT_CONNECTED || isock->sk->sk_state != BT_CONNECTED) {
+                        fput(csock->file);
+                        fput(isock->file);
+                        return -EBADFD;
+                }
+
+                err = hidp_add_connection(&ca, csock, isock);
+                if (!err) {
+                        if (copy_to_user(argp, &ca, sizeof(ca)))
+                                err = -EFAULT;
+                } else {
+                        fput(csock->file);
+                        fput(isock->file);
+                }
+
+                return err;
+
+        case HIDPCONNDEL:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EACCES;
+
+                if (copy_from_user(&cd, argp, sizeof(cd)))
+                        return -EFAULT;
+
+                return hidp_del_connection(&cd);
+
+        case HIDPGETCONNLIST:
+                if (copy_from_user(&cl, argp, sizeof(cl)))
+                        return -EFAULT;
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+
+                err = hidp_get_connlist(&cl);
+                if (!err && copy_to_user(argp, &cl, sizeof(cl)))
+                        return -EFAULT;
+
+                return err;
+
+        case HIDPGETCONNINFO:
+                if (copy_from_user(&ci, argp, sizeof(ci)))
+                        return -EFAULT;
+
+                err = hidp_get_conninfo(&ci);
+                if (!err && copy_to_user(argp, &ci, sizeof(ci)))
+                        return -EFAULT;
+
+                return err;
+        }
+
+        return -EINVAL;
+}
+
+static struct proto_ops hidp_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = hidp_sock_release,
+        .ioctl          = hidp_sock_ioctl,
+        .bind           = sock_no_bind,
+        .getname        = sock_no_getname,
+        .sendmsg        = sock_no_sendmsg,
+        .recvmsg        = sock_no_recvmsg,
+        .poll           = sock_no_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .mmap           = sock_no_mmap
+};
+
+static struct proto hidp_proto = {
+        .name           = "HIDP",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct bt_sock)
+};
+
+static int hidp_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        if (sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hidp_proto, 1);
+        if (!sk)
+                return -ENOMEM;
+
+        sock_init_data(sock, sk);
+
+        sock->ops = &hidp_sock_ops;
+
+        sock->state = SS_UNCONNECTED;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = protocol;
+        sk->sk_state    = BT_OPEN;
+
+        return 0;
+}
+
+static struct net_proto_family hidp_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = hidp_sock_create
+};
+
+int __init hidp_init_sockets(void)
+{
+        int err;
+
+        err = proto_register(&hidp_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_HIDP, &hidp_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        return 0;
+
+error:
+        BT_ERR("Can't register HIDP socket");
+        proto_unregister(&hidp_proto);
+        return err;
+}
+
+void __exit hidp_cleanup_sockets(void)
+{
+        if (bt_sock_unregister(BTPROTO_HIDP) < 0)
+                BT_ERR("Can't unregister HIDP socket");
+
+        proto_unregister(&hidp_proto);
+}
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
new file mode 100644
index 000000000000..c12babcf0b3c
--- /dev/null
+++ b/net/bluetooth/l2cap.c
@@ -0,0 +1,2329 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth L2CAP core and sockets. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/list.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+
+#ifndef CONFIG_BT_L2CAP_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "2.7"
+
+static struct proto_ops l2cap_sock_ops;
+
+static struct bt_sock_list l2cap_sk_list = {
+        .lock = RW_LOCK_UNLOCKED
+};
+
+static int l2cap_conn_del(struct hci_conn *conn, int err);
+
+static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent);
+static void l2cap_chan_del(struct sock *sk, int err);
+
+static void __l2cap_sock_close(struct sock *sk, int reason);
+static void l2cap_sock_close(struct sock *sk);
+static void l2cap_sock_kill(struct sock *sk);
+
+static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
+                                u8 code, u8 ident, u16 dlen, void *data);
+
+/* ---- L2CAP timers ---- */
+static void l2cap_sock_timeout(unsigned long arg)
+{
+        struct sock *sk = (struct sock *) arg;
+
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+
+        bh_lock_sock(sk);
+        __l2cap_sock_close(sk, ETIMEDOUT);
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        sock_put(sk);
+}
+
+static void l2cap_sock_set_timer(struct sock *sk, long timeout)
+{
+        BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
+}
+
+static void l2cap_sock_clear_timer(struct sock *sk)
+{
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+        sk_stop_timer(sk, &sk->sk_timer);
+}
+
+static void l2cap_sock_init_timer(struct sock *sk)
+{
+        init_timer(&sk->sk_timer);
+        sk->sk_timer.function = l2cap_sock_timeout;
+        sk->sk_timer.data = (unsigned long)sk;
+}
+
+/* ---- L2CAP connections ---- */
+static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
+{
+        struct l2cap_conn *conn;
+
+        if ((conn = hcon->l2cap_data))
+                return conn;
+
+        if (status)
+                return conn;
+
+        if (!(conn = kmalloc(sizeof(struct l2cap_conn), GFP_ATOMIC)))
+                return NULL;
+        memset(conn, 0, sizeof(struct l2cap_conn));
+
+        hcon->l2cap_data = conn;
+        conn->hcon = hcon;
+
+        conn->mtu = hcon->hdev->acl_mtu;
+        conn->src = &hcon->hdev->bdaddr;
+        conn->dst = &hcon->dst;
+
+        spin_lock_init(&conn->lock);
+        rwlock_init(&conn->chan_list.lock);
+
+        BT_DBG("hcon %p conn %p", hcon, conn);
+        return conn;
+}
+
+static int l2cap_conn_del(struct hci_conn *hcon, int err)
+{
+        struct l2cap_conn *conn;
+        struct sock *sk;
+
+        if (!(conn = hcon->l2cap_data)) 
+                return 0;
+
+        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+
+        if (conn->rx_skb)
+                kfree_skb(conn->rx_skb);
+
+        /* Kill channels */
+        while ((sk = conn->chan_list.head)) {
+                bh_lock_sock(sk);
+                l2cap_chan_del(sk, err);
+                bh_unlock_sock(sk);
+                l2cap_sock_kill(sk);
+        }
+
+        hcon->l2cap_data = NULL;
+        kfree(conn);
+        return 0;
+}
+
+static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        write_lock(&l->lock);
+        __l2cap_chan_add(conn, sk, parent);
+        write_unlock(&l->lock);
+}
+
+static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
+{
+        u8 id;
+
+        /* Get next available identificator.
+         *    1 - 128 are used by kernel.
+         *  129 - 199 are reserved.
+         *  200 - 254 are used by utilities like l2ping, etc.
+         */
+
+        spin_lock(&conn->lock);
+
+        if (++conn->tx_ident > 128)
+                conn->tx_ident = 1;
+
+        id = conn->tx_ident;
+
+        spin_unlock(&conn->lock);
+
+        return id;
+}
+
+static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
+{
+        struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
+
+        BT_DBG("code 0x%2.2x", code);
+
+        if (!skb)
+                return -ENOMEM;
+
+        return hci_send_acl(conn->hcon, skb, 0);
+}
+
+/* ---- Socket interface ---- */
+static struct sock *__l2cap_get_sock_by_addr(u16 psm, bdaddr_t *src)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        sk_for_each(sk, node, &l2cap_sk_list.head)
+                if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
+                        goto found;
+        sk = NULL;
+found:
+        return sk;
+}
+
+/* Find socket with psm and source bdaddr.
+ * Returns closest match.
+ */
+static struct sock *__l2cap_get_sock_by_psm(int state, u16 psm, bdaddr_t *src)
+{
+        struct sock *sk = NULL, *sk1 = NULL;
+        struct hlist_node *node;
+
+        sk_for_each(sk, node, &l2cap_sk_list.head) {
+                if (state && sk->sk_state != state)
+                        continue;
+
+                if (l2cap_pi(sk)->psm == psm) {
+                        /* Exact match. */
+                        if (!bacmp(&bt_sk(sk)->src, src))
+                                break;
+
+                        /* Closest match */
+                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                                sk1 = sk;
+                }
+        }
+        return node ? sk : sk1;
+}
+
+/* Find socket with given address (psm, src).
+ * Returns locked socket */
+static inline struct sock *l2cap_get_sock_by_psm(int state, u16 psm, bdaddr_t *src)
+{
+        struct sock *s;
+        read_lock(&l2cap_sk_list.lock);
+        s = __l2cap_get_sock_by_psm(state, psm, src);
+        if (s) bh_lock_sock(s);
+        read_unlock(&l2cap_sk_list.lock);
+        return s;
+}
+
+static void l2cap_sock_destruct(struct sock *sk)
+{
+        BT_DBG("sk %p", sk);
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+}
+
+static void l2cap_sock_cleanup_listen(struct sock *parent)
+{
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL)))
+                l2cap_sock_close(sk);
+
+        parent->sk_state  = BT_CLOSED;
+        sock_set_flag(parent, SOCK_ZAPPED);
+}
+
+/* Kill socket (only if zapped and orphan)
+ * Must be called on unlocked socket.
+ */
+static void l2cap_sock_kill(struct sock *sk)
+{
+        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+                return;
+
+        BT_DBG("sk %p state %d", sk, sk->sk_state);
+
+        /* Kill poor orphan */
+        bt_sock_unlink(&l2cap_sk_list, sk);
+        sock_set_flag(sk, SOCK_DEAD);
+        sock_put(sk);
+}
+
+static void __l2cap_sock_close(struct sock *sk, int reason)
+{
+        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
+
+        switch (sk->sk_state) {
+        case BT_LISTEN:
+                l2cap_sock_cleanup_listen(sk);
+                break;
+
+        case BT_CONNECTED:
+        case BT_CONFIG:
+        case BT_CONNECT2:
+                if (sk->sk_type == SOCK_SEQPACKET) {
+                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+                        struct l2cap_disconn_req req;
+
+                        sk->sk_state = BT_DISCONN;
+                        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+                        req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
+                        req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                        L2CAP_DISCONN_REQ, sizeof(req), &req);
+                } else {
+                        l2cap_chan_del(sk, reason);
+                }
+                break;
+
+        case BT_CONNECT:
+        case BT_DISCONN:
+                l2cap_chan_del(sk, reason);
+                break;
+
+        default:
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+        }
+}
+
+/* Must be called on unlocked socket. */
+static void l2cap_sock_close(struct sock *sk)
+{
+        l2cap_sock_clear_timer(sk);
+        lock_sock(sk);
+        __l2cap_sock_close(sk, ECONNRESET);
+        release_sock(sk);
+        l2cap_sock_kill(sk);
+}
+
+static void l2cap_sock_init(struct sock *sk, struct sock *parent)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+
+        BT_DBG("sk %p", sk);
+
+        if (parent) {
+                sk->sk_type = parent->sk_type;
+                pi->imtu = l2cap_pi(parent)->imtu;
+                pi->omtu = l2cap_pi(parent)->omtu;
+                pi->link_mode = l2cap_pi(parent)->link_mode;
+        } else {
+                pi->imtu = L2CAP_DEFAULT_MTU;
+                pi->omtu = 0;
+                pi->link_mode = 0;
+        }
+
+        /* Default config options */
+        pi->conf_mtu = L2CAP_DEFAULT_MTU;
+        pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+}
+
+static struct proto l2cap_proto = {
+        .name           = "L2CAP",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct l2cap_pinfo)
+};
+
+static struct sock *l2cap_sock_alloc(struct socket *sock, int proto, int prio)
+{
+        struct sock *sk;
+
+        sk = sk_alloc(PF_BLUETOOTH, prio, &l2cap_proto, 1);
+        if (!sk)
+                return NULL;
+
+        sock_init_data(sock, sk);
+        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
+
+        sk->sk_destruct = l2cap_sock_destruct;
+        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = proto;
+        sk->sk_state    = BT_OPEN;
+
+        l2cap_sock_init_timer(sk);
+
+        bt_sock_link(&l2cap_sk_list, sk);
+        return sk;
+}
+
+static int l2cap_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        sock->state = SS_UNCONNECTED;
+
+        if (sock->type != SOCK_SEQPACKET &&
+                        sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
+                return -EPERM;
+
+        sock->ops = &l2cap_sock_ops;
+
+        sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL);
+        if (!sk)
+                return -ENOMEM;
+
+        l2cap_sock_init(sk, NULL);
+        return 0;
+}
+
+static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+{
+        struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p, %s %d", sk, batostr(&la->l2_bdaddr), la->l2_psm);
+
+        if (!addr || addr->sa_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_OPEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        write_lock_bh(&l2cap_sk_list.lock);
+
+        if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
+                err = -EADDRINUSE;
+        } else {
+                /* Save source address */
+                bacpy(&bt_sk(sk)->src, &la->l2_bdaddr);
+                l2cap_pi(sk)->psm   = la->l2_psm;
+                l2cap_pi(sk)->sport = la->l2_psm;
+                sk->sk_state = BT_BOUND;
+        }
+
+        write_unlock_bh(&l2cap_sk_list.lock);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_do_connect(struct sock *sk)
+{
+        bdaddr_t *src = &bt_sk(sk)->src;
+        bdaddr_t *dst = &bt_sk(sk)->dst;
+        struct l2cap_conn *conn;
+        struct hci_conn *hcon;
+        struct hci_dev *hdev;
+        int err = 0;
+
+        BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
+
+        if (!(hdev = hci_get_route(dst, src)))
+                return -EHOSTUNREACH;
+
+        hci_dev_lock_bh(hdev);
+
+        err = -ENOMEM;
+
+        hcon = hci_connect(hdev, ACL_LINK, dst);
+        if (!hcon)
+                goto done;
+
+        conn = l2cap_conn_add(hcon, 0);
+        if (!conn) {
+                hci_conn_put(hcon);
+                goto done;
+        }
+
+        err = 0;
+
+        /* Update source addr of the socket */
+        bacpy(src, conn->src);
+
+        l2cap_chan_add(conn, sk, NULL);
+
+        sk->sk_state = BT_CONNECT;
+        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+        if (hcon->state == BT_CONNECTED) {
+                if (sk->sk_type == SOCK_SEQPACKET) {
+                        struct l2cap_conn_req req;
+                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                        req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
+                        req.psm  = l2cap_pi(sk)->psm;
+                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
+                                        L2CAP_CONN_REQ, sizeof(req), &req);
+                } else {
+                        l2cap_sock_clear_timer(sk);
+                        sk->sk_state = BT_CONNECTED;
+                }
+        }
+
+done:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
+{
+        struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        lock_sock(sk);
+
+        BT_DBG("sk %p", sk);
+
+        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_l2)) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        if (sk->sk_type == SOCK_SEQPACKET && !la->l2_psm) {
+                err = -EINVAL;
+                goto done;
+        }
+
+        switch(sk->sk_state) {
+        case BT_CONNECT:
+        case BT_CONNECT2:
+        case BT_CONFIG:
+                /* Already connecting */
+                goto wait;
+
+        case BT_CONNECTED:
+                /* Already connected */
+                goto done;
+
+        case BT_OPEN:
+        case BT_BOUND:
+                /* Can connect */
+                break;
+
+        default:
+                err = -EBADFD;
+                goto done;
+        }
+
+        /* Set destination address and psm */
+        bacpy(&bt_sk(sk)->dst, &la->l2_bdaddr);
+        l2cap_pi(sk)->psm = la->l2_psm;
+
+        if ((err = l2cap_do_connect(sk)))
+                goto done;
+
+wait:
+        err = bt_sock_wait_state(sk, BT_CONNECTED,
+                        sock_sndtimeo(sk, flags & O_NONBLOCK));
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_listen(struct socket *sock, int backlog)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p backlog %d", sk, backlog);
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        if (!l2cap_pi(sk)->psm) {
+                bdaddr_t *src = &bt_sk(sk)->src;
+                u16 psm;
+
+                err = -EINVAL;
+
+                write_lock_bh(&l2cap_sk_list.lock);
+
+                for (psm = 0x1001; psm < 0x1100; psm += 2)
+                        if (!__l2cap_get_sock_by_addr(psm, src)) {
+                                l2cap_pi(sk)->psm   = htobs(psm);
+                                l2cap_pi(sk)->sport = htobs(psm);
+                                err = 0;
+                                break;
+                        }
+
+                write_unlock_bh(&l2cap_sk_list.lock);
+
+                if (err < 0)
+                        goto done;
+        }
+
+        sk->sk_max_ack_backlog = backlog;
+        sk->sk_ack_backlog = 0;
+        sk->sk_state = BT_LISTEN;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct sock *sk = sock->sk, *nsk;
+        long timeo;
+        int err = 0;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_LISTEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+
+        BT_DBG("sk %p timeo %ld", sk, timeo);
+
+        /* Wait for an incoming connection. (wake-one). */
+        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+
+        if (err)
+                goto done;
+
+        newsock->state = SS_CONNECTED;
+
+        BT_DBG("new socket %p", nsk);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
+{
+        struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        addr->sa_family = AF_BLUETOOTH;
+        *len = sizeof(struct sockaddr_l2);
+
+        if (peer)
+                bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
+        else
+                bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
+
+        la->l2_psm = l2cap_pi(sk)->psm;
+        return 0;
+}
+
+static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sk_buff *skb, **frag;
+        int err, hlen, count, sent=0;
+        struct l2cap_hdr *lh;
+
+        BT_DBG("sk %p len %d", sk, len);
+
+        /* First fragment (with L2CAP header) */
+        if (sk->sk_type == SOCK_DGRAM)
+                hlen = L2CAP_HDR_SIZE + 2;
+        else
+                hlen = L2CAP_HDR_SIZE;
+
+        count = min_t(unsigned int, (conn->mtu - hlen), len);
+
+        skb = bt_skb_send_alloc(sk, hlen + count,
+                        msg->msg_flags & MSG_DONTWAIT, &err);
+        if (!skb)
+                return err;
+
+        /* Create L2CAP header */
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->cid = __cpu_to_le16(l2cap_pi(sk)->dcid);
+        lh->len = __cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
+
+        if (sk->sk_type == SOCK_DGRAM)
+                put_unaligned(l2cap_pi(sk)->psm, (u16 *) skb_put(skb, 2));
+
+        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
+                err = -EFAULT;
+                goto fail;
+        }
+
+        sent += count;
+        len  -= count;
+
+        /* Continuation fragments (no L2CAP header) */
+        frag = &skb_shinfo(skb)->frag_list;
+        while (len) {
+                count = min_t(unsigned int, conn->mtu, len);
+
+                *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
+                if (!*frag)
+                        goto fail;
+                
+                if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
+                        err = -EFAULT;
+                        goto fail;
+                }
+
+                sent += count;
+                len  -= count;
+
+                frag = &(*frag)->next;
+        }
+
+        if ((err = hci_send_acl(conn->hcon, skb, 0)) < 0)
+                goto fail;
+
+        return sent;
+
+fail:
+        kfree_skb(skb);
+        return err;
+}
+
+static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (sk->sk_err)
+                return sock_error(sk);
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        /* Check outgoing MTU */
+        if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (sk->sk_state == BT_CONNECTED)
+                err = l2cap_do_send(sk, msg, len);
+        else
+                err = -ENOTCONN;
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_options opts;
+        int err = 0, len;
+        u32 opt;
+
+        BT_DBG("sk %p", sk);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case L2CAP_OPTIONS:
+                len = min_t(unsigned int, sizeof(opts), optlen);
+                if (copy_from_user((char *) &opts, optval, len)) {
+                        err = -EFAULT;
+                        break;
+                }
+                l2cap_pi(sk)->imtu  = opts.imtu;
+                l2cap_pi(sk)->omtu  = opts.omtu;
+                break;
+
+        case L2CAP_LM:
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                l2cap_pi(sk)->link_mode = opt;
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct l2cap_options opts;
+        struct l2cap_conninfo cinfo;
+        int len, err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case L2CAP_OPTIONS:
+                opts.imtu     = l2cap_pi(sk)->imtu;
+                opts.omtu     = l2cap_pi(sk)->omtu;
+                opts.flush_to = l2cap_pi(sk)->flush_to;
+                opts.mode     = 0x00;
+
+                len = min_t(unsigned int, len, sizeof(opts));
+                if (copy_to_user(optval, (char *) &opts, len))
+                        err = -EFAULT;
+
+                break;
+
+        case L2CAP_LM:
+                if (put_user(l2cap_pi(sk)->link_mode, (u32 __user *) optval))
+                        err = -EFAULT;
+                break;
+
+        case L2CAP_CONNINFO:
+                if (sk->sk_state != BT_CONNECTED) {
+                        err = -ENOTCONN;
+                        break;
+                }
+
+                cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
+                memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
+
+                len = min_t(unsigned int, len, sizeof(cinfo));
+                if (copy_to_user(optval, (char *) &cinfo, len))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_shutdown(struct socket *sock, int how)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        lock_sock(sk);
+        if (!sk->sk_shutdown) {
+                sk->sk_shutdown = SHUTDOWN_MASK;
+                l2cap_sock_clear_timer(sk);
+                __l2cap_sock_close(sk, 0);
+
+                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+                        err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
+        }
+        release_sock(sk);
+        return err;
+}
+
+static int l2cap_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        int err;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        err = l2cap_sock_shutdown(sock, 2);
+
+        sock_orphan(sk);
+        l2cap_sock_kill(sk);
+        return err;
+}
+
+/* ---- L2CAP channels ---- */
+static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
+{
+        struct sock *s;
+        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
+                if (l2cap_pi(s)->dcid == cid)
+                        break;
+        }
+        return s;
+}
+
+static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
+{
+        struct sock *s;
+        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
+                if (l2cap_pi(s)->scid == cid)
+                        break;
+        }
+        return s;
+}
+
+/* Find channel with given SCID.
+ * Returns locked socket */
+static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
+{
+        struct sock *s;
+        read_lock(&l->lock);
+        s = __l2cap_get_chan_by_scid(l, cid);
+        if (s) bh_lock_sock(s);
+        read_unlock(&l->lock);
+        return s;
+}
+
+static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
+{
+        struct sock *s;
+        for (s = l->head; s; s = l2cap_pi(s)->next_c) {
+                if (l2cap_pi(s)->ident == ident)
+                        break;
+        }
+        return s;
+}
+
+static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
+{
+        struct sock *s;
+        read_lock(&l->lock);
+        s = __l2cap_get_chan_by_ident(l, ident);
+        if (s) bh_lock_sock(s);
+        read_unlock(&l->lock);
+        return s;
+}
+
+static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
+{
+        u16 cid = 0x0040;
+
+        for (; cid < 0xffff; cid++) {
+                if(!__l2cap_get_chan_by_scid(l, cid))
+                        return cid;
+        }
+
+        return 0;
+}
+
+static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
+{
+        sock_hold(sk);
+
+        if (l->head)
+                l2cap_pi(l->head)->prev_c = sk;
+
+        l2cap_pi(sk)->next_c = l->head;
+        l2cap_pi(sk)->prev_c = NULL;
+        l->head = sk;
+}
+
+static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
+{
+        struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
+
+        write_lock(&l->lock);
+        if (sk == l->head)
+                l->head = next;
+
+        if (next)
+                l2cap_pi(next)->prev_c = prev;
+        if (prev)
+                l2cap_pi(prev)->next_c = next;
+        write_unlock(&l->lock);
+
+        __sock_put(sk);
+}
+
+static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+
+        BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
+
+        l2cap_pi(sk)->conn = conn;
+
+        if (sk->sk_type == SOCK_SEQPACKET) {
+                /* Alloc CID for connection-oriented socket */
+                l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
+        } else if (sk->sk_type == SOCK_DGRAM) {
+                /* Connectionless socket */
+                l2cap_pi(sk)->scid = 0x0002;
+                l2cap_pi(sk)->dcid = 0x0002;
+                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
+        } else {
+                /* Raw socket can send/recv signalling messages only */
+                l2cap_pi(sk)->scid = 0x0001;
+                l2cap_pi(sk)->dcid = 0x0001;
+                l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
+        }
+
+        __l2cap_chan_link(l, sk);
+
+        if (parent)
+                bt_accept_enqueue(parent, sk);
+}
+
+/* Delete channel. 
+ * Must be called on the locked socket. */
+static void l2cap_chan_del(struct sock *sk, int err)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        struct sock *parent = bt_sk(sk)->parent;
+
+        l2cap_sock_clear_timer(sk);
+
+        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
+
+        if (conn) { 
+                /* Unlink from channel list */
+                l2cap_chan_unlink(&conn->chan_list, sk);
+                l2cap_pi(sk)->conn = NULL;
+                hci_conn_put(conn->hcon);
+        }
+
+        sk->sk_state  = BT_CLOSED;
+        sock_set_flag(sk, SOCK_ZAPPED);
+
+        if (err)
+                sk->sk_err = err;
+
+        if (parent) {
+                bt_accept_unlink(sk);
+                parent->sk_data_ready(parent, 0);
+        } else
+                sk->sk_state_change(sk);
+}
+
+static void l2cap_conn_ready(struct l2cap_conn *conn)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sock *sk;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                bh_lock_sock(sk);
+
+                if (sk->sk_type != SOCK_SEQPACKET) {
+                        l2cap_sock_clear_timer(sk);
+                        sk->sk_state = BT_CONNECTED;
+                        sk->sk_state_change(sk);
+                } else if (sk->sk_state == BT_CONNECT) {
+                        struct l2cap_conn_req req;
+                        l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                        req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
+                        req.psm  = l2cap_pi(sk)->psm;
+                        l2cap_send_cmd(conn, l2cap_pi(sk)->ident, L2CAP_CONN_REQ, sizeof(req), &req);
+                }
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&l->lock);
+}
+
+/* Notify sockets that we cannot guaranty reliability anymore */
+static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sock *sk;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                if (l2cap_pi(sk)->link_mode & L2CAP_LM_RELIABLE)
+                        sk->sk_err = err;
+        }
+        read_unlock(&l->lock);
+}
+
+static void l2cap_chan_ready(struct sock *sk)
+{
+        struct sock *parent = bt_sk(sk)->parent;
+
+        BT_DBG("sk %p, parent %p", sk, parent);
+
+        l2cap_pi(sk)->conf_state = 0;
+        l2cap_sock_clear_timer(sk);
+
+        if (!parent) {
+                /* Outgoing channel.
+                 * Wake up socket sleeping on connect.
+                 */
+                sk->sk_state = BT_CONNECTED;
+                sk->sk_state_change(sk);
+        } else {
+                /* Incoming channel.
+                 * Wake up socket sleeping on accept.
+                 */
+                parent->sk_data_ready(parent, 0);
+        }
+}
+
+/* Copy frame to all raw sockets on that connection */
+static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct l2cap_chan_list *l = &conn->chan_list;
+        struct sk_buff *nskb;
+        struct sock * sk;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                if (sk->sk_type != SOCK_RAW)
+                        continue;
+
+                /* Don't send frame to the socket it came from */
+                if (skb->sk == sk)
+                        continue;
+
+                if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
+                        continue;
+
+                if (sock_queue_rcv_skb(sk, nskb))
+                        kfree_skb(nskb);
+        }
+        read_unlock(&l->lock);
+}
+
+/* ---- L2CAP signalling commands ---- */
+static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
+                                u8 code, u8 ident, u16 dlen, void *data)
+{
+        struct sk_buff *skb, **frag;
+        struct l2cap_cmd_hdr *cmd;
+        struct l2cap_hdr *lh;
+        int len, count;
+
+        BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen);
+
+        len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
+        count = min_t(unsigned int, conn->mtu, len);
+
+        skb = bt_skb_alloc(count, GFP_ATOMIC);
+        if (!skb)
+                return NULL;
+
+        lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
+        lh->len = __cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
+        lh->cid = __cpu_to_le16(0x0001);
+
+        cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
+        cmd->code  = code;
+        cmd->ident = ident;
+        cmd->len   = __cpu_to_le16(dlen);
+
+        if (dlen) {
+                count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
+                memcpy(skb_put(skb, count), data, count);
+                data += count;
+        }
+
+        len -= skb->len;
+
+        /* Continuation fragments (no L2CAP header) */
+        frag = &skb_shinfo(skb)->frag_list;
+        while (len) {
+                count = min_t(unsigned int, conn->mtu, len);
+
+                *frag = bt_skb_alloc(count, GFP_ATOMIC);
+                if (!*frag)
+                        goto fail;
+
+                memcpy(skb_put(*frag, count), data, count);
+
+                len  -= count;
+                data += count;
+
+                frag = &(*frag)->next;
+        }
+
+        return skb;
+
+fail:
+        kfree_skb(skb);
+        return NULL;
+}
+
+static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
+{
+        struct l2cap_conf_opt *opt = *ptr;
+        int len;
+
+        len = L2CAP_CONF_OPT_SIZE + opt->len;
+        *ptr += len;
+
+        *type = opt->type;
+        *olen = opt->len;
+
+        switch (opt->len) {
+        case 1:
+                *val = *((u8 *) opt->val);
+                break;
+
+        case 2:
+                *val = __le16_to_cpu(*((u16 *)opt->val));
+                break;
+
+        case 4:
+                *val = __le32_to_cpu(*((u32 *)opt->val));
+                break;
+
+        default:
+                *val = (unsigned long) opt->val;
+                break;
+        }
+
+        BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
+        return len;
+}
+
+static inline void l2cap_parse_conf_req(struct sock *sk, void *data, int len)
+{
+        int type, hint, olen; 
+        unsigned long val;
+        void *ptr = data;
+
+        BT_DBG("sk %p len %d", sk, len);
+
+        while (len >= L2CAP_CONF_OPT_SIZE) {
+                len -= l2cap_get_conf_opt(&ptr, &type, &olen, &val);
+
+                hint  = type & 0x80;
+                type &= 0x7f;
+
+                switch (type) {
+                case L2CAP_CONF_MTU:
+                        l2cap_pi(sk)->conf_mtu = val;
+                        break;
+
+                case L2CAP_CONF_FLUSH_TO:
+                        l2cap_pi(sk)->flush_to = val;
+                        break;
+
+                case L2CAP_CONF_QOS:
+                        break;
+
+                default:
+                        if (hint)
+                                break;
+
+                        /* FIXME: Reject unknown option */
+                        break;
+                }
+        }
+}
+
+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
+{
+        struct l2cap_conf_opt *opt = *ptr;
+
+        BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
+
+        opt->type = type;
+        opt->len  = len;
+
+        switch (len) {
+        case 1:
+                *((u8 *) opt->val)  = val;
+                break;
+
+        case 2:
+                *((u16 *) opt->val) = __cpu_to_le16(val);
+                break;
+
+        case 4:
+                *((u32 *) opt->val) = __cpu_to_le32(val);
+                break;
+
+        default:
+                memcpy(opt->val, (void *) val, len);
+                break;
+        }
+
+        *ptr += L2CAP_CONF_OPT_SIZE + len;
+}
+
+static int l2cap_build_conf_req(struct sock *sk, void *data)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        struct l2cap_conf_req *req = data;
+        void *ptr = req->data;
+
+        BT_DBG("sk %p", sk);
+
+        if (pi->imtu != L2CAP_DEFAULT_MTU)
+                l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
+
+        /* FIXME: Need actual value of the flush timeout */
+        //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
+        //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
+
+        req->dcid  = __cpu_to_le16(pi->dcid);
+        req->flags = __cpu_to_le16(0);
+
+        return ptr - data;
+}
+
+static inline int l2cap_conf_output(struct sock *sk, void **ptr)
+{
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+        int result = 0;
+
+        /* Configure output options and let the other side know
+         * which ones we don't like. */
+        if (pi->conf_mtu < pi->omtu) {
+                l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                result = L2CAP_CONF_UNACCEPT;
+        } else {
+                pi->omtu = pi->conf_mtu;
+        }
+
+        BT_DBG("sk %p result %d", sk, result);
+        return result;
+}
+
+static int l2cap_build_conf_rsp(struct sock *sk, void *data, int *result)
+{
+        struct l2cap_conf_rsp *rsp = data;
+        void *ptr = rsp->data;
+        u16 flags = 0;
+
+        BT_DBG("sk %p complete %d", sk, result ? 1 : 0);
+
+        if (result)
+                *result = l2cap_conf_output(sk, &ptr);
+        else
+                flags = 0x0001;
+
+        rsp->scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
+        rsp->result = __cpu_to_le16(result ? *result : 0);
+        rsp->flags  = __cpu_to_le16(flags);
+
+        return ptr - data;
+}
+
+static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_chan_list *list = &conn->chan_list;
+        struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
+        struct l2cap_conn_rsp rsp;
+        struct sock *sk, *parent;
+        int result = 0, status = 0;
+
+        u16 dcid = 0, scid = __le16_to_cpu(req->scid);
+        u16 psm  = req->psm;
+
+        BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
+
+        /* Check if we have socket listening on psm */
+        parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
+        if (!parent) {
+                result = L2CAP_CR_BAD_PSM;
+                goto sendresp;
+        }
+
+        result = L2CAP_CR_NO_MEM;
+
+        /* Check for backlog size */
+        if (sk_acceptq_is_full(parent)) {
+                BT_DBG("backlog full %d", parent->sk_ack_backlog); 
+                goto response;
+        }
+
+        sk = l2cap_sock_alloc(NULL, BTPROTO_L2CAP, GFP_ATOMIC);
+        if (!sk)
+                goto response;
+
+        write_lock(&list->lock);
+
+        /* Check if we already have channel with that dcid */
+        if (__l2cap_get_chan_by_dcid(list, scid)) {
+                write_unlock(&list->lock);
+                sock_set_flag(sk, SOCK_ZAPPED);
+                l2cap_sock_kill(sk);
+                goto response;
+        }
+
+        hci_conn_hold(conn->hcon);
+
+        l2cap_sock_init(sk, parent);
+        bacpy(&bt_sk(sk)->src, conn->src);
+        bacpy(&bt_sk(sk)->dst, conn->dst);
+        l2cap_pi(sk)->psm  = psm;
+        l2cap_pi(sk)->dcid = scid;
+
+        __l2cap_chan_add(conn, sk, parent);
+        dcid = l2cap_pi(sk)->scid;
+
+        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
+
+        /* Service level security */
+        result = L2CAP_CR_PEND;
+        status = L2CAP_CS_AUTHEN_PEND;
+        sk->sk_state = BT_CONNECT2;
+        l2cap_pi(sk)->ident = cmd->ident;
+
+        if ((l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT) ||
+                        (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)) {
+                if (!hci_conn_encrypt(conn->hcon))
+                        goto done;
+        } else if (l2cap_pi(sk)->link_mode & L2CAP_LM_AUTH) {
+                if (!hci_conn_auth(conn->hcon))
+                        goto done;
+        }
+
+        sk->sk_state = BT_CONFIG;
+        result = status = 0;
+
+done:
+        write_unlock(&list->lock);
+
+response:
+        bh_unlock_sock(parent);
+
+sendresp:
+        rsp.scid   = __cpu_to_le16(scid);
+        rsp.dcid   = __cpu_to_le16(dcid);
+        rsp.result = __cpu_to_le16(result);
+        rsp.status = __cpu_to_le16(status);
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+        return 0;
+}
+
+static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
+        u16 scid, dcid, result, status;
+        struct sock *sk;
+        u8 req[128];
+
+        scid   = __le16_to_cpu(rsp->scid);
+        dcid   = __le16_to_cpu(rsp->dcid);
+        result = __le16_to_cpu(rsp->result);
+        status = __le16_to_cpu(rsp->status);
+
+        BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
+
+        if (scid) {
+                if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
+                        return 0;
+        } else {
+                if (!(sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident)))
+                        return 0;
+        }
+
+        switch (result) {
+        case L2CAP_CR_SUCCESS:
+                sk->sk_state = BT_CONFIG;
+                l2cap_pi(sk)->ident = 0;
+                l2cap_pi(sk)->dcid = dcid;
+                l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
+
+                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                        l2cap_build_conf_req(sk, req), req);
+                break;
+
+        case L2CAP_CR_PEND:
+                break;
+
+        default:
+                l2cap_chan_del(sk, ECONNREFUSED);
+                break;
+        }
+
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
+        u16 dcid, flags;
+        u8 rsp[64];
+        struct sock *sk;
+        int result;
+
+        dcid  = __le16_to_cpu(req->dcid);
+        flags = __le16_to_cpu(req->flags);
+
+        BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
+
+        if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
+                return -ENOENT;
+
+        l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
+
+        if (flags & 0x0001) {
+                /* Incomplete config. Send empty response. */
+                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+                                l2cap_build_conf_rsp(sk, rsp, NULL), rsp);
+                goto unlock;
+        }
+
+        /* Complete config. */
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
+                        l2cap_build_conf_rsp(sk, rsp, &result), rsp);
+
+        if (result)
+                goto unlock;
+
+        /* Output config done */
+        l2cap_pi(sk)->conf_state |= L2CAP_CONF_OUTPUT_DONE;
+
+        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
+                sk->sk_state = BT_CONNECTED;
+                l2cap_chan_ready(sk);
+        } else if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
+                u8 req[64];
+                l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                        l2cap_build_conf_req(sk, req), req);
+        }
+
+unlock:
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
+        u16 scid, flags, result;
+        struct sock *sk;
+
+        scid   = __le16_to_cpu(rsp->scid);
+        flags  = __le16_to_cpu(rsp->flags);
+        result = __le16_to_cpu(rsp->result);
+
+        BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
+
+        if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
+                return 0;
+
+        switch (result) {
+        case L2CAP_CONF_SUCCESS:
+                break;
+
+        case L2CAP_CONF_UNACCEPT:
+                if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
+                        char req[128];
+                        /* It does not make sense to adjust L2CAP parameters
+                         * that are currently defined in the spec. We simply
+                         * resend config request that we sent earlier. It is
+                         * stupid, but it helps qualification testing which
+                         * expects at least some response from us. */
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+                                                l2cap_build_conf_req(sk, req), req);
+                        goto done;
+                }
+
+        default: 
+                sk->sk_state = BT_DISCONN;
+                sk->sk_err   = ECONNRESET;
+                l2cap_sock_set_timer(sk, HZ * 5);
+                {
+                        struct l2cap_disconn_req req;
+                        req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
+                        req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
+                        l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                        L2CAP_DISCONN_REQ, sizeof(req), &req);
+                }
+                goto done;
+        }
+
+        if (flags & 0x01)
+                goto done;
+
+        /* Input config done */
+        l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
+
+        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
+                sk->sk_state = BT_CONNECTED;
+                l2cap_chan_ready(sk);
+        }
+
+done:
+        bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
+        struct l2cap_disconn_rsp rsp;
+        u16 dcid, scid;
+        struct sock *sk;
+
+        scid = __le16_to_cpu(req->scid);
+        dcid = __le16_to_cpu(req->dcid);
+
+        BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
+
+        if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
+                return 0;
+
+        rsp.dcid = __cpu_to_le16(l2cap_pi(sk)->scid);
+        rsp.scid = __cpu_to_le16(l2cap_pi(sk)->dcid);
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
+
+        sk->sk_shutdown = SHUTDOWN_MASK;
+
+        l2cap_chan_del(sk, ECONNRESET);
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        return 0;
+}
+
+static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
+        u16 dcid, scid;
+        struct sock *sk;
+
+        scid = __le16_to_cpu(rsp->scid);
+        dcid = __le16_to_cpu(rsp->dcid);
+
+        BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
+
+        if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
+                return 0;
+
+        l2cap_chan_del(sk, 0);
+        bh_unlock_sock(sk);
+
+        l2cap_sock_kill(sk);
+        return 0;
+}
+
+static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_info_req *req = (struct l2cap_info_req *) data;
+        struct l2cap_info_rsp rsp;
+        u16 type;
+
+        type = __le16_to_cpu(req->type);
+
+        BT_DBG("type 0x%4.4x", type);
+
+        rsp.type   = __cpu_to_le16(type);
+        rsp.result = __cpu_to_le16(L2CAP_IR_NOTSUPP);
+        l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), &rsp);
+
+        return 0;
+}
+
+static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
+{
+        struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
+        u16 type, result;
+
+        type   = __le16_to_cpu(rsp->type);
+        result = __le16_to_cpu(rsp->result);
+
+        BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
+
+        return 0;
+}
+
+static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        u8 *data = skb->data;
+        int len = skb->len;
+        struct l2cap_cmd_hdr cmd;
+        int err = 0;
+
+        l2cap_raw_recv(conn, skb);
+
+        while (len >= L2CAP_CMD_HDR_SIZE) {
+                memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
+                data += L2CAP_CMD_HDR_SIZE;
+                len  -= L2CAP_CMD_HDR_SIZE;
+
+                cmd.len = __le16_to_cpu(cmd.len);
+
+                BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd.len, cmd.ident);
+
+                if (cmd.len > len || !cmd.ident) {
+                        BT_DBG("corrupted command");
+                        break;
+                }
+
+                switch (cmd.code) {
+                case L2CAP_COMMAND_REJ:
+                        /* FIXME: We should process this */
+                        break;
+
+                case L2CAP_CONN_REQ:
+                        err = l2cap_connect_req(conn, &cmd, data);
+                        break;
+
+                case L2CAP_CONN_RSP:
+                        err = l2cap_connect_rsp(conn, &cmd, data);
+                        break;
+
+                case L2CAP_CONF_REQ:
+                        err = l2cap_config_req(conn, &cmd, data);
+                        break;
+
+                case L2CAP_CONF_RSP:
+                        err = l2cap_config_rsp(conn, &cmd, data);
+                        break;
+
+                case L2CAP_DISCONN_REQ:
+                        err = l2cap_disconnect_req(conn, &cmd, data);
+                        break;
+
+                case L2CAP_DISCONN_RSP:
+                        err = l2cap_disconnect_rsp(conn, &cmd, data);
+                        break;
+
+                case L2CAP_ECHO_REQ:
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd.len, data);
+                        break;
+
+                case L2CAP_ECHO_RSP:
+                        break;
+
+                case L2CAP_INFO_REQ:
+                        err = l2cap_information_req(conn, &cmd, data);
+                        break;
+
+                case L2CAP_INFO_RSP:
+                        err = l2cap_information_rsp(conn, &cmd, data);
+                        break;
+
+                default:
+                        BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (err) {
+                        struct l2cap_cmd_rej rej;
+                        BT_DBG("error %d", err);
+
+                        /* FIXME: Map err to a valid reason */
+                        rej.reason = __cpu_to_le16(0);
+                        l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
+                }
+
+                data += cmd.len;
+                len  -= cmd.len;
+        }
+
+        kfree_skb(skb);
+}
+
+static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
+{
+        struct sock *sk;
+
+        sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
+        if (!sk) {
+                BT_DBG("unknown cid 0x%4.4x", cid);
+                goto drop;
+        }
+
+        BT_DBG("sk %p, len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (l2cap_pi(sk)->imtu < skb->len)
+                goto drop;
+
+        /* If socket recv buffers overflows we drop data here
+         * which is *bad* because L2CAP has to be reliable.
+         * But we don't have any other choice. L2CAP doesn't
+         * provide flow control mechanism. */
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                goto done;
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk) bh_unlock_sock(sk);
+        return 0;
+}
+
+static inline int l2cap_conless_channel(struct l2cap_conn *conn, u16 psm, struct sk_buff *skb)
+{
+        struct sock *sk;
+
+        sk = l2cap_get_sock_by_psm(0, psm, conn->src);
+        if (!sk)
+                goto drop;
+
+        BT_DBG("sk %p, len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (l2cap_pi(sk)->imtu < skb->len)
+                goto drop;
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                goto done;
+
+drop:
+        kfree_skb(skb);
+
+done:
+        if (sk) bh_unlock_sock(sk);
+        return 0;
+}
+
+static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
+{
+        struct l2cap_hdr *lh = (void *) skb->data;
+        u16 cid, psm, len;
+
+        skb_pull(skb, L2CAP_HDR_SIZE);
+        cid = __le16_to_cpu(lh->cid);
+        len = __le16_to_cpu(lh->len);
+
+        BT_DBG("len %d, cid 0x%4.4x", len, cid);
+
+        switch (cid) {
+        case 0x0001:
+                l2cap_sig_channel(conn, skb);
+                break;
+
+        case 0x0002:
+                psm = get_unaligned((u16 *) skb->data);
+                skb_pull(skb, 2);
+                l2cap_conless_channel(conn, psm, skb);
+                break;
+
+        default:
+                l2cap_data_channel(conn, cid, skb);
+                break;
+        }
+}
+
+/* ---- L2CAP interface with lower layer (HCI) ---- */
+
+static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+{
+        int exact = 0, lm1 = 0, lm2 = 0;
+        register struct sock *sk;
+        struct hlist_node *node;
+
+        if (type != ACL_LINK)
+                return 0;
+
+        BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
+
+        /* Find listening sockets and check their link_mode */
+        read_lock(&l2cap_sk_list.lock);
+        sk_for_each(sk, node, &l2cap_sk_list.head) {
+                if (sk->sk_state != BT_LISTEN)
+                        continue;
+
+                if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
+                        lm1 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
+                        exact++;
+                } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                        lm2 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
+        }
+        read_unlock(&l2cap_sk_list.lock);
+
+        return exact ? lm1 : lm2;
+}
+
+static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
+{
+        BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
+
+        if (hcon->type != ACL_LINK)
+                return 0;
+
+        if (!status) {
+                struct l2cap_conn *conn;
+
+                conn = l2cap_conn_add(hcon, status);
+                if (conn)
+                        l2cap_conn_ready(conn);
+        } else 
+                l2cap_conn_del(hcon, bt_err(status));
+
+        return 0;
+}
+
+static int l2cap_disconn_ind(struct hci_conn *hcon, u8 reason)
+{
+        BT_DBG("hcon %p reason %d", hcon, reason);
+
+        if (hcon->type != ACL_LINK)
+                return 0;
+
+        l2cap_conn_del(hcon, bt_err(reason));
+        return 0;
+}
+
+static int l2cap_auth_cfm(struct hci_conn *hcon, u8 status)
+{
+        struct l2cap_chan_list *l;
+        struct l2cap_conn *conn;
+        struct l2cap_conn_rsp rsp;
+        struct sock *sk;
+        int result;
+
+        if (!(conn = hcon->l2cap_data))
+                return 0;
+        l = &conn->chan_list;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                bh_lock_sock(sk);
+
+                if (sk->sk_state != BT_CONNECT2 ||
+                                (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT) ||
+                                (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)) {
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (!status) {
+                        sk->sk_state = BT_CONFIG;
+                        result = 0;
+                } else {
+                        sk->sk_state = BT_DISCONN;
+                        l2cap_sock_set_timer(sk, HZ/10);
+                        result = L2CAP_CR_SEC_BLOCK;
+                }
+
+                rsp.scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
+                rsp.dcid   = __cpu_to_le16(l2cap_pi(sk)->scid);
+                rsp.result = __cpu_to_le16(result);
+                rsp.status = __cpu_to_le16(0);
+                l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
+                                L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&l->lock);
+        return 0;
+}
+
+static int l2cap_encrypt_cfm(struct hci_conn *hcon, u8 status)
+{
+        struct l2cap_chan_list *l;
+        struct l2cap_conn *conn;
+        struct l2cap_conn_rsp rsp;
+        struct sock *sk;
+        int result;
+
+        if (!(conn = hcon->l2cap_data))
+                return 0;
+        l = &conn->chan_list;
+
+        BT_DBG("conn %p", conn);
+
+        read_lock(&l->lock);
+
+        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
+                bh_lock_sock(sk);
+
+                if (sk->sk_state != BT_CONNECT2) {
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+
+                if (!status) {
+                        sk->sk_state = BT_CONFIG;
+                        result = 0;
+                } else {
+                        sk->sk_state = BT_DISCONN;
+                        l2cap_sock_set_timer(sk, HZ/10);
+                        result = L2CAP_CR_SEC_BLOCK;
+                }
+
+                rsp.scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
+                rsp.dcid   = __cpu_to_le16(l2cap_pi(sk)->scid);
+                rsp.result = __cpu_to_le16(result);
+                rsp.status = __cpu_to_le16(0);
+                l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
+                                L2CAP_CONN_RSP, sizeof(rsp), &rsp);
+
+                if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
+                        hci_conn_change_link_key(hcon);
+
+                bh_unlock_sock(sk);
+        }
+
+        read_unlock(&l->lock);
+        return 0;
+}
+
+static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
+{
+        struct l2cap_conn *conn = hcon->l2cap_data;
+
+        if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
+                goto drop;
+
+        BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
+
+        if (flags & ACL_START) {
+                struct l2cap_hdr *hdr;
+                int len;
+
+                if (conn->rx_len) {
+                        BT_ERR("Unexpected start frame (len %d)", skb->len);
+                        kfree_skb(conn->rx_skb);
+                        conn->rx_skb = NULL;
+                        conn->rx_len = 0;
+                        l2cap_conn_unreliable(conn, ECOMM);
+                }
+
+                if (skb->len < 2) {
+                        BT_ERR("Frame is too short (len %d)", skb->len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                hdr = (struct l2cap_hdr *) skb->data;
+                len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
+
+                if (len == skb->len) {
+                        /* Complete frame received */
+                        l2cap_recv_frame(conn, skb);
+                        return 0;
+                }
+
+                BT_DBG("Start: total len %d, frag len %d", len, skb->len);
+
+                if (skb->len > len) {
+                        BT_ERR("Frame is too long (len %d, expected len %d)",
+                                skb->len, len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                /* Allocate skb for the complete frame (with header) */
+                if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
+                        goto drop;
+
+                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                conn->rx_len = len - skb->len;
+        } else {
+                BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
+
+                if (!conn->rx_len) {
+                        BT_ERR("Unexpected continuation frame (len %d)", skb->len);
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                if (skb->len > conn->rx_len) {
+                        BT_ERR("Fragment is too long (len %d, expected %d)",
+                                        skb->len, conn->rx_len);
+                        kfree_skb(conn->rx_skb);
+                        conn->rx_skb = NULL;
+                        conn->rx_len = 0;
+                        l2cap_conn_unreliable(conn, ECOMM);
+                        goto drop;
+                }
+
+                memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
+                conn->rx_len -= skb->len;
+
+                if (!conn->rx_len) {
+                        /* Complete frame received */
+                        l2cap_recv_frame(conn, conn->rx_skb);
+                        conn->rx_skb = NULL;
+                }
+        }
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+/* ---- Proc fs support ---- */
+#ifdef CONFIG_PROC_FS
+static void *l2cap_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        loff_t l = *pos;
+
+        read_lock_bh(&l2cap_sk_list.lock);
+
+        sk_for_each(sk, node, &l2cap_sk_list.head)
+                if (!l--)
+                        goto found;
+        sk = NULL;
+found:
+        return sk;
+}
+
+static void *l2cap_seq_next(struct seq_file *seq, void *e, loff_t *pos)
+{
+        (*pos)++;
+        return sk_next(e);
+}
+
+static void l2cap_seq_stop(struct seq_file *seq, void *e)
+{
+        read_unlock_bh(&l2cap_sk_list.lock);
+}
+
+static int  l2cap_seq_show(struct seq_file *seq, void *e)
+{
+        struct sock *sk = e;
+        struct l2cap_pinfo *pi = l2cap_pi(sk);
+
+        seq_printf(seq, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
+                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst), 
+                        sk->sk_state, pi->psm, pi->scid, pi->dcid, pi->imtu,
+                        pi->omtu, pi->link_mode);
+        return 0;
+}
+
+static struct seq_operations l2cap_seq_ops = {
+        .start  = l2cap_seq_start,
+        .next   = l2cap_seq_next,
+        .stop   = l2cap_seq_stop,
+        .show   = l2cap_seq_show 
+};
+
+static int l2cap_seq_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &l2cap_seq_ops);
+}
+
+static struct file_operations l2cap_seq_fops = {
+        .owner          = THIS_MODULE,
+        .open           = l2cap_seq_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
+
+static int __init l2cap_proc_init(void)
+{
+        struct proc_dir_entry *p = create_proc_entry("l2cap", S_IRUGO, proc_bt);
+        if (!p)
+                return -ENOMEM;
+        p->owner     = THIS_MODULE;
+        p->proc_fops = &l2cap_seq_fops;
+        return 0;
+}
+
+static void __exit l2cap_proc_cleanup(void)
+{
+        remove_proc_entry("l2cap", proc_bt);
+}
+
+#else /* CONFIG_PROC_FS */
+
+static int __init l2cap_proc_init(void)
+{
+        return 0;
+}
+
+static void __exit l2cap_proc_cleanup(void)
+{
+        return;
+}
+#endif /* CONFIG_PROC_FS */
+
+static struct proto_ops l2cap_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = l2cap_sock_release,
+        .bind           = l2cap_sock_bind,
+        .connect        = l2cap_sock_connect,
+        .listen         = l2cap_sock_listen,
+        .accept         = l2cap_sock_accept,
+        .getname        = l2cap_sock_getname,
+        .sendmsg        = l2cap_sock_sendmsg,
+        .recvmsg        = bt_sock_recvmsg,
+        .poll           = bt_sock_poll,
+        .mmap           = sock_no_mmap,
+        .socketpair     = sock_no_socketpair,
+        .ioctl          = sock_no_ioctl,
+        .shutdown       = l2cap_sock_shutdown,
+        .setsockopt     = l2cap_sock_setsockopt,
+        .getsockopt     = l2cap_sock_getsockopt
+};
+
+static struct net_proto_family l2cap_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = l2cap_sock_create,
+};
+
+static struct hci_proto l2cap_hci_proto = {
+        .name           = "L2CAP",
+        .id             = HCI_PROTO_L2CAP,
+        .connect_ind    = l2cap_connect_ind,
+        .connect_cfm    = l2cap_connect_cfm,
+        .disconn_ind    = l2cap_disconn_ind,
+        .auth_cfm       = l2cap_auth_cfm,
+        .encrypt_cfm    = l2cap_encrypt_cfm,
+        .recv_acldata   = l2cap_recv_acldata
+};
+
+static int __init l2cap_init(void)
+{
+        int err;
+        
+        err = proto_register(&l2cap_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
+        if (err < 0) {
+                BT_ERR("L2CAP socket registration failed");
+                goto error;
+        }
+
+        err = hci_register_proto(&l2cap_hci_proto);
+        if (err < 0) {
+                BT_ERR("L2CAP protocol registration failed");
+                bt_sock_unregister(BTPROTO_L2CAP);
+                goto error;
+        }
+
+        l2cap_proc_init();
+
+        BT_INFO("L2CAP ver %s", VERSION);
+        BT_INFO("L2CAP socket layer initialized");
+
+        return 0;
+
+error:
+        proto_unregister(&l2cap_proto);
+        return err;
+}
+
+static void __exit l2cap_exit(void)
+{
+        l2cap_proc_cleanup();
+
+        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
+                BT_ERR("L2CAP socket unregistration failed");
+
+        if (hci_unregister_proto(&l2cap_hci_proto) < 0)
+                BT_ERR("L2CAP protocol unregistration failed");
+
+        proto_unregister(&l2cap_proto);
+}
+
+void l2cap_load(void)
+{
+        /* Dummy function to trigger automatic L2CAP module loading by
+         * other modules that use L2CAP sockets but don't use any other
+         * symbols from it. */
+        return;
+}
+EXPORT_SYMBOL(l2cap_load);
+
+module_init(l2cap_init);
+module_exit(l2cap_exit);
+
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-0");
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
new file mode 100644
index 000000000000..9efb0a093612
--- /dev/null
+++ b/net/bluetooth/lib.c
@@ -0,0 +1,178 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth kernel library. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/kernel.h>
+#include <linux/stddef.h>
+#include <linux/string.h>
+#include <asm/errno.h>
+
+#include <net/bluetooth/bluetooth.h>
+
+void bt_dump(char *pref, __u8 *buf, int count)
+{
+        char *ptr;
+        char line[100];
+        unsigned int i;
+
+        printk(KERN_INFO "%s: dump, len %d\n", pref, count);
+
+        ptr = line;
+        *ptr = 0;
+        for (i = 0; i < count; i++) {
+                ptr += sprintf(ptr, " %2.2X", buf[i]);
+
+                if (i && !((i + 1) % 20)) {
+                        printk(KERN_INFO "%s:%s\n", pref, line);
+                        ptr = line;
+                        *ptr = 0;
+                }
+        }
+
+        if (line[0])
+                printk(KERN_INFO "%s:%s\n", pref, line);
+}
+EXPORT_SYMBOL(bt_dump);
+
+void baswap(bdaddr_t *dst, bdaddr_t *src)
+{
+        unsigned char *d = (unsigned char *) dst;
+        unsigned char *s = (unsigned char *) src;
+        unsigned int i;
+
+        for (i = 0; i < 6; i++)
+                d[i] = s[5 - i];
+}
+EXPORT_SYMBOL(baswap);
+
+char *batostr(bdaddr_t *ba)
+{
+        static char str[2][18];
+        static int i = 1;
+
+        i ^= 1;
+        sprintf(str[i], "%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X",
+                ba->b[0], ba->b[1], ba->b[2],
+                ba->b[3], ba->b[4], ba->b[5]);
+
+        return str[i];
+}
+EXPORT_SYMBOL(batostr);
+
+/* Bluetooth error codes to Unix errno mapping */
+int bt_err(__u16 code)
+{
+        switch (code) {
+        case 0:
+                return 0;
+
+        case 0x01:
+                return EBADRQC;
+
+        case 0x02:
+                return ENOTCONN;
+
+        case 0x03:
+                return EIO;
+
+        case 0x04:
+                return EHOSTDOWN;
+
+        case 0x05:
+                return EACCES;
+
+        case 0x06:
+                return EBADE;
+
+        case 0x07:
+                return ENOMEM;
+
+        case 0x08:
+                return ETIMEDOUT;
+
+        case 0x09:
+                return EMLINK;
+
+        case 0x0a:
+                return EMLINK;
+
+        case 0x0b:
+                return EALREADY;
+
+        case 0x0c:
+                return EBUSY;
+
+        case 0x0d:
+        case 0x0e:
+        case 0x0f:
+                return ECONNREFUSED;
+
+        case 0x10:
+                return ETIMEDOUT;
+
+        case 0x11:
+        case 0x27:
+        case 0x29:
+        case 0x20:
+                return EOPNOTSUPP;
+
+        case 0x12:
+                return EINVAL;
+
+        case 0x13:
+        case 0x14:
+        case 0x15:
+                return ECONNRESET;
+
+        case 0x16:
+                return ECONNABORTED;
+
+        case 0x17:
+                return ELOOP;
+
+        case 0x18:
+                return EACCES;
+
+        case 0x1a:
+                return EPROTONOSUPPORT;
+
+        case 0x1b:
+                return ECONNREFUSED;
+
+        case 0x19:
+        case 0x1e:
+        case 0x23:
+        case 0x24:
+        case 0x25:
+                return EPROTO;
+
+        default:
+                return ENOSYS;
+        }
+}
+EXPORT_SYMBOL(bt_err);
diff --git a/net/bluetooth/rfcomm/Kconfig b/net/bluetooth/rfcomm/Kconfig
new file mode 100644
index 000000000000..405a0e61e7dc
--- /dev/null
+++ b/net/bluetooth/rfcomm/Kconfig
@@ -0,0 +1,17 @@
+config BT_RFCOMM
+        tristate "RFCOMM protocol support"
+        depends on BT && BT_L2CAP
+        help
+          RFCOMM provides connection oriented stream transport.  RFCOMM
+          support is required for Dialup Networking, OBEX and other Bluetooth
+          applications.
+
+          Say Y here to compile RFCOMM support into the kernel or say M to
+          compile it as module (rfcomm).
+
+config BT_RFCOMM_TTY
+        bool "RFCOMM TTY support"
+        depends on BT_RFCOMM
+        help
+          This option enables TTY emulation support for RFCOMM channels.
+
diff --git a/net/bluetooth/rfcomm/Makefile b/net/bluetooth/rfcomm/Makefile
new file mode 100644
index 000000000000..aecec45ec68d
--- /dev/null
+++ b/net/bluetooth/rfcomm/Makefile
@@ -0,0 +1,8 @@
+#
+# Makefile for the Linux Bluetooth RFCOMM layer.
+#
+
+obj-$(CONFIG_BT_RFCOMM) += rfcomm.o
+
+rfcomm-y                        := core.o sock.o crc.o
+rfcomm-$(CONFIG_BT_RFCOMM_TTY)  += tty.o
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
new file mode 100644
index 000000000000..e9e6fda66f1a
--- /dev/null
+++ b/net/bluetooth/rfcomm/core.c
@@ -0,0 +1,2127 @@
+/* 
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* 
+   RPN support    -    Dirk Husemann <hud@zurich.ibm.com>
+*/
+
+/*
+ * Bluetooth RFCOMM core.
+ *
+ * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/signal.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <linux/net.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <net/sock.h>
+#include <asm/uaccess.h>
+#include <asm/unaligned.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/rfcomm.h>
+
+#define VERSION "1.5"
+
+#ifndef CONFIG_BT_RFCOMM_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#ifdef CONFIG_PROC_FS
+struct proc_dir_entry *proc_bt_rfcomm;
+#endif
+
+static struct task_struct *rfcomm_thread;
+
+static DECLARE_MUTEX(rfcomm_sem);
+#define rfcomm_lock()   down(&rfcomm_sem);
+#define rfcomm_unlock() up(&rfcomm_sem);
+
+static unsigned long rfcomm_event;
+
+static LIST_HEAD(session_list);
+static atomic_t terminate, running;
+
+static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
+static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
+static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
+static int rfcomm_queue_disc(struct rfcomm_dlc *d);
+static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
+static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
+static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
+static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
+static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
+static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
+
+static void rfcomm_process_connect(struct rfcomm_session *s);
+
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
+static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
+static void rfcomm_session_del(struct rfcomm_session *s);
+
+/* ---- RFCOMM frame parsing macros ---- */
+#define __get_dlci(b)     ((b & 0xfc) >> 2)
+#define __get_channel(b)  ((b & 0xf8) >> 3)
+#define __get_dir(b)      ((b & 0x04) >> 2)
+#define __get_type(b)     ((b & 0xef))
+
+#define __test_ea(b)      ((b & 0x01))
+#define __test_cr(b)      ((b & 0x02))
+#define __test_pf(b)      ((b & 0x10))
+
+#define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
+#define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
+#define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
+#define __srv_channel(dlci)    (dlci >> 1)
+#define __dir(dlci)            (dlci & 0x01)
+
+#define __len8(len)       (((len) << 1) | 1)
+#define __len16(len)      ((len) << 1)
+
+/* MCC macros */
+#define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
+#define __get_mcc_type(b) ((b & 0xfc) >> 2)
+#define __get_mcc_len(b)  ((b & 0xfe) >> 1)
+
+/* RPN macros */
+#define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x3) << 3))
+#define __get_rpn_data_bits(line) ((line) & 0x3)
+#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
+#define __get_rpn_parity(line)    (((line) >> 3) & 0x3)
+
+static inline void rfcomm_schedule(uint event)
+{
+        if (!rfcomm_thread)
+                return;
+        //set_bit(event, &rfcomm_event);
+        set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
+        wake_up_process(rfcomm_thread);
+}
+
+static inline void rfcomm_session_put(struct rfcomm_session *s)
+{
+        if (atomic_dec_and_test(&s->refcnt))
+                rfcomm_session_del(s);
+}
+
+/* ---- RFCOMM FCS computation ---- */
+
+/* CRC on 2 bytes */
+#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
+
+/* FCS on 2 bytes */ 
+static inline u8 __fcs(u8 *data)
+{
+        return (0xff - __crc(data));
+}
+
+/* FCS on 3 bytes */ 
+static inline u8 __fcs2(u8 *data)
+{
+        return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
+}
+
+/* Check FCS */
+static inline int __check_fcs(u8 *data, int type, u8 fcs)
+{
+        u8 f = __crc(data);
+
+        if (type != RFCOMM_UIH)
+                f = rfcomm_crc_table[f ^ data[2]];
+
+        return rfcomm_crc_table[f ^ fcs] != 0xcf;
+}
+
+/* ---- L2CAP callbacks ---- */
+static void rfcomm_l2state_change(struct sock *sk)
+{
+        BT_DBG("%p state %d", sk, sk->sk_state);
+        rfcomm_schedule(RFCOMM_SCHED_STATE);
+}
+
+static void rfcomm_l2data_ready(struct sock *sk, int bytes)
+{
+        BT_DBG("%p bytes %d", sk, bytes);
+        rfcomm_schedule(RFCOMM_SCHED_RX);
+}
+
+static int rfcomm_l2sock_create(struct socket **sock)
+{
+        int err;
+
+        BT_DBG("");
+
+        err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
+        if (!err) {
+                struct sock *sk = (*sock)->sk;
+                sk->sk_data_ready   = rfcomm_l2data_ready;
+                sk->sk_state_change = rfcomm_l2state_change;
+        }
+        return err;
+}
+
+/* ---- RFCOMM DLCs ---- */
+static void rfcomm_dlc_timeout(unsigned long arg)
+{
+        struct rfcomm_dlc *d = (void *) arg;
+
+        BT_DBG("dlc %p state %ld", d, d->state);
+
+        set_bit(RFCOMM_TIMED_OUT, &d->flags);
+        rfcomm_dlc_put(d);
+        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
+}
+
+static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
+{
+        BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
+
+        if (!mod_timer(&d->timer, jiffies + timeout))
+                rfcomm_dlc_hold(d);
+}
+
+static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
+{
+        BT_DBG("dlc %p state %ld", d, d->state);
+
+        if (timer_pending(&d->timer) && del_timer(&d->timer))
+                rfcomm_dlc_put(d);
+}
+
+static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
+{
+        BT_DBG("%p", d);
+
+        d->state      = BT_OPEN;
+        d->flags      = 0;
+        d->mscex      = 0;
+        d->mtu        = RFCOMM_DEFAULT_MTU;
+        d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
+
+        d->cfc        = RFCOMM_CFC_DISABLED;
+        d->rx_credits = RFCOMM_DEFAULT_CREDITS;
+}
+
+struct rfcomm_dlc *rfcomm_dlc_alloc(int prio)
+{
+        struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
+        if (!d)
+                return NULL;
+        memset(d, 0, sizeof(*d));
+
+        init_timer(&d->timer);
+        d->timer.function = rfcomm_dlc_timeout;
+        d->timer.data = (unsigned long) d;
+
+        skb_queue_head_init(&d->tx_queue);
+        spin_lock_init(&d->lock);
+        atomic_set(&d->refcnt, 1);
+
+        rfcomm_dlc_clear_state(d);
+        
+        BT_DBG("%p", d);
+        return d;
+}
+
+void rfcomm_dlc_free(struct rfcomm_dlc *d)
+{
+        BT_DBG("%p", d);
+
+        skb_queue_purge(&d->tx_queue);
+        kfree(d);
+}
+
+static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
+{
+        BT_DBG("dlc %p session %p", d, s);
+
+        rfcomm_session_hold(s);
+
+        rfcomm_dlc_hold(d);
+        list_add(&d->list, &s->dlcs);
+        d->session = s;
+}
+
+static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
+{
+        struct rfcomm_session *s = d->session;
+
+        BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
+
+        list_del(&d->list);
+        d->session = NULL;
+        rfcomm_dlc_put(d);
+
+        rfcomm_session_put(s);
+}
+
+static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_dlc *d;
+        struct list_head *p;
+
+        list_for_each(p, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+                if (d->dlci == dlci)
+                        return d;
+        }
+        return NULL;
+}
+
+static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
+{
+        struct rfcomm_session *s;
+        int err = 0;
+        u8 dlci;
+
+        BT_DBG("dlc %p state %ld %s %s channel %d", 
+                        d, d->state, batostr(src), batostr(dst), channel);
+
+        if (channel < 1 || channel > 30)
+                return -EINVAL;
+
+        if (d->state != BT_OPEN && d->state != BT_CLOSED)
+                return 0;
+
+        s = rfcomm_session_get(src, dst);
+        if (!s) {
+                s = rfcomm_session_create(src, dst, &err);
+                if (!s)
+                        return err;
+        }
+
+        dlci = __dlci(!s->initiator, channel);
+
+        /* Check if DLCI already exists */
+        if (rfcomm_dlc_get(s, dlci))
+                return -EBUSY;
+
+        rfcomm_dlc_clear_state(d);
+
+        d->dlci     = dlci;
+        d->addr     = __addr(s->initiator, dlci);
+        d->priority = 7;
+
+        d->state    = BT_CONFIG;
+        rfcomm_dlc_link(s, d);
+
+        d->mtu = s->mtu;
+        d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
+
+        if (s->state == BT_CONNECTED)
+                rfcomm_send_pn(s, 1, d);
+        rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
+        return 0;
+}
+
+int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
+{
+        int r;
+
+        rfcomm_lock();
+
+        r = __rfcomm_dlc_open(d, src, dst, channel);
+
+        rfcomm_unlock();
+        return r;
+}
+
+static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
+{
+        struct rfcomm_session *s = d->session;
+        if (!s)
+                return 0;
+
+        BT_DBG("dlc %p state %ld dlci %d err %d session %p",
+                        d, d->state, d->dlci, err, s);
+
+        switch (d->state) {
+        case BT_CONNECTED:
+        case BT_CONFIG:
+        case BT_CONNECT:
+                d->state = BT_DISCONN;
+                if (skb_queue_empty(&d->tx_queue)) {
+                        rfcomm_send_disc(s, d->dlci);
+                        rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
+                } else {
+                        rfcomm_queue_disc(d);
+                        rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
+                }
+                break;
+
+        default:
+                rfcomm_dlc_clear_timer(d);
+
+                rfcomm_dlc_lock(d);
+                d->state = BT_CLOSED;
+                d->state_change(d, err);
+                rfcomm_dlc_unlock(d);
+
+                skb_queue_purge(&d->tx_queue);
+                rfcomm_session_put(s);
+
+                rfcomm_dlc_unlink(d);
+        }
+
+        return 0;
+}
+
+int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
+{
+        int r;
+
+        rfcomm_lock();
+
+        r = __rfcomm_dlc_close(d, err);
+
+        rfcomm_unlock();
+        return r;
+}
+
+int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
+{
+        int len = skb->len;
+
+        if (d->state != BT_CONNECTED)
+                return -ENOTCONN;
+
+        BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
+
+        if (len > d->mtu)
+                return -EINVAL;
+
+        rfcomm_make_uih(skb, d->addr);
+        skb_queue_tail(&d->tx_queue, skb);
+
+        if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
+                rfcomm_schedule(RFCOMM_SCHED_TX);
+        return len;
+}
+
+void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
+{
+        BT_DBG("dlc %p state %ld", d, d->state);
+
+        if (!d->cfc) {
+                d->v24_sig |= RFCOMM_V24_FC;
+                set_bit(RFCOMM_MSC_PENDING, &d->flags);
+        }
+        rfcomm_schedule(RFCOMM_SCHED_TX);
+}
+
+void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
+{
+        BT_DBG("dlc %p state %ld", d, d->state);
+
+        if (!d->cfc) {
+                d->v24_sig &= ~RFCOMM_V24_FC;
+                set_bit(RFCOMM_MSC_PENDING, &d->flags);
+        }
+        rfcomm_schedule(RFCOMM_SCHED_TX);
+}
+
+/* 
+   Set/get modem status functions use _local_ status i.e. what we report
+   to the other side.
+   Remote status is provided by dlc->modem_status() callback.
+ */
+int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
+{
+        BT_DBG("dlc %p state %ld v24_sig 0x%x", 
+                        d, d->state, v24_sig);
+
+        if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
+                v24_sig |= RFCOMM_V24_FC;
+        else
+                v24_sig &= ~RFCOMM_V24_FC;
+        
+        d->v24_sig = v24_sig;
+
+        if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
+                rfcomm_schedule(RFCOMM_SCHED_TX);
+
+        return 0;
+}
+
+int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
+{
+        BT_DBG("dlc %p state %ld v24_sig 0x%x", 
+                        d, d->state, d->v24_sig);
+
+        *v24_sig = d->v24_sig;
+        return 0;
+}
+
+/* ---- RFCOMM sessions ---- */
+static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
+{
+        struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        if (!s)
+                return NULL;
+        memset(s, 0, sizeof(*s));
+
+        BT_DBG("session %p sock %p", s, sock);
+
+        INIT_LIST_HEAD(&s->dlcs);
+        s->state = state;
+        s->sock  = sock;
+
+        s->mtu = RFCOMM_DEFAULT_MTU;
+        s->cfc = RFCOMM_CFC_UNKNOWN;
+
+        /* Do not increment module usage count for listening sessions.
+         * Otherwise we won't be able to unload the module. */
+        if (state != BT_LISTEN)
+                if (!try_module_get(THIS_MODULE)) {
+                        kfree(s);
+                        return NULL;
+                }
+
+        list_add(&s->list, &session_list);
+
+        return s;
+}
+
+static void rfcomm_session_del(struct rfcomm_session *s)
+{
+        int state = s->state;
+
+        BT_DBG("session %p state %ld", s, s->state);
+
+        list_del(&s->list);
+
+        if (state == BT_CONNECTED)
+                rfcomm_send_disc(s, 0);
+
+        sock_release(s->sock);
+        kfree(s);
+
+        if (state != BT_LISTEN)
+                module_put(THIS_MODULE);
+}
+
+static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
+{
+        struct rfcomm_session *s;
+        struct list_head *p, *n;
+        struct bt_sock *sk;
+        list_for_each_safe(p, n, &session_list) {
+                s = list_entry(p, struct rfcomm_session, list);
+                sk = bt_sk(s->sock->sk); 
+
+                if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
+                                !bacmp(&sk->dst, dst))
+                        return s;
+        }
+        return NULL;
+}
+
+static void rfcomm_session_close(struct rfcomm_session *s, int err)
+{
+        struct rfcomm_dlc *d;
+        struct list_head *p, *n;
+
+        BT_DBG("session %p state %ld err %d", s, s->state, err);
+
+        rfcomm_session_hold(s);
+
+        s->state = BT_CLOSED;
+
+        /* Close all dlcs */
+        list_for_each_safe(p, n, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+                d->state = BT_CLOSED;
+                __rfcomm_dlc_close(d, err);
+        }
+
+        rfcomm_session_put(s);
+}
+
+static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
+{
+        struct rfcomm_session *s = NULL;
+        struct sockaddr_l2 addr;
+        struct socket *sock;
+        struct sock *sk;
+
+        BT_DBG("%s %s", batostr(src), batostr(dst));
+
+        *err = rfcomm_l2sock_create(&sock);
+        if (*err < 0)
+                return NULL;
+
+        bacpy(&addr.l2_bdaddr, src);
+        addr.l2_family = AF_BLUETOOTH;
+        addr.l2_psm    = 0;
+        *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+        if (*err < 0)
+                goto failed;
+
+        /* Set L2CAP options */
+        sk = sock->sk;
+        lock_sock(sk);
+        l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+        release_sock(sk);
+
+        s = rfcomm_session_add(sock, BT_BOUND);
+        if (!s) {
+                *err = -ENOMEM;
+                goto failed;
+        }
+
+        rfcomm_session_hold(s);
+
+        s->initiator = 1;
+
+        bacpy(&addr.l2_bdaddr, dst);
+        addr.l2_family = AF_BLUETOOTH;
+        addr.l2_psm    = htobs(RFCOMM_PSM);
+        *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
+        if (*err == 0 || *err == -EAGAIN)
+                return s;
+
+        rfcomm_session_del(s);
+        return NULL;
+
+failed:
+        sock_release(sock);
+        return NULL;
+}
+
+void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
+{
+        struct sock *sk = s->sock->sk;
+        if (src)
+                bacpy(src, &bt_sk(sk)->src);
+        if (dst)
+                bacpy(dst, &bt_sk(sk)->dst);
+}
+
+/* ---- RFCOMM frame sending ---- */
+static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
+{
+        struct socket *sock = s->sock;
+        struct kvec iv = { data, len };
+        struct msghdr msg;
+
+        BT_DBG("session %p len %d", s, len);
+
+        memset(&msg, 0, sizeof(msg));
+
+        return kernel_sendmsg(sock, &msg, &iv, 1, len);
+}
+
+static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_cmd cmd;
+
+        BT_DBG("%p dlci %d", s, dlci);
+
+        cmd.addr = __addr(s->initiator, dlci);
+        cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
+        cmd.len  = __len8(0);
+        cmd.fcs  = __fcs2((u8 *) &cmd);
+
+        return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
+}
+
+static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_cmd cmd;
+
+        BT_DBG("%p dlci %d", s, dlci);
+
+        cmd.addr = __addr(!s->initiator, dlci);
+        cmd.ctrl = __ctrl(RFCOMM_UA, 1);
+        cmd.len  = __len8(0);
+        cmd.fcs  = __fcs2((u8 *) &cmd);
+
+        return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
+}
+
+static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_cmd cmd;
+
+        BT_DBG("%p dlci %d", s, dlci);
+
+        cmd.addr = __addr(s->initiator, dlci);
+        cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
+        cmd.len  = __len8(0);
+        cmd.fcs  = __fcs2((u8 *) &cmd);
+
+        return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
+}
+
+static int rfcomm_queue_disc(struct rfcomm_dlc *d)
+{
+        struct rfcomm_cmd *cmd;
+        struct sk_buff *skb;
+
+        BT_DBG("dlc %p dlci %d", d, d->dlci);
+
+        skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (void *) __skb_put(skb, sizeof(*cmd));
+        cmd->addr = d->addr;
+        cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
+        cmd->len  = __len8(0);
+        cmd->fcs  = __fcs2((u8 *) cmd);
+
+        skb_queue_tail(&d->tx_queue, skb);
+        rfcomm_schedule(RFCOMM_SCHED_TX);
+        return 0;
+}
+
+static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_cmd cmd;
+
+        BT_DBG("%p dlci %d", s, dlci);
+
+        cmd.addr = __addr(!s->initiator, dlci);
+        cmd.ctrl = __ctrl(RFCOMM_DM, 1);
+        cmd.len  = __len8(0);
+        cmd.fcs  = __fcs2((u8 *) &cmd);
+
+        return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
+}
+
+static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d type %d", s, cr, type);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc) + 1);
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_NSC);
+        mcc->len  = __len8(1);
+
+        /* Type that we didn't like */
+        *ptr = __mcc_type(cr, type); ptr++;
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        struct rfcomm_pn  *pn;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_PN);
+        mcc->len  = __len8(sizeof(*pn));
+
+        pn = (void *) ptr; ptr += sizeof(*pn);
+        pn->dlci        = d->dlci;
+        pn->priority    = d->priority;
+        pn->ack_timer   = 0;
+        pn->max_retrans = 0;
+
+        if (s->cfc) {
+                pn->flow_ctrl = cr ? 0xf0 : 0xe0;
+                pn->credits = RFCOMM_DEFAULT_CREDITS;
+        } else {
+                pn->flow_ctrl = 0;
+                pn->credits   = 0;
+        }
+
+        pn->mtu = htobs(d->mtu);
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
+                           u8 bit_rate, u8 data_bits, u8 stop_bits,
+                           u8 parity, u8 flow_ctrl_settings, 
+                           u8 xon_char, u8 xoff_char, u16 param_mask)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        struct rfcomm_rpn *rpn;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
+               "flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 
+                        s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 
+                        flow_ctrl_settings, xon_char, xoff_char, param_mask);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_RPN);
+        mcc->len  = __len8(sizeof(*rpn));
+
+        rpn = (void *) ptr; ptr += sizeof(*rpn);
+        rpn->dlci          = __addr(1, dlci);
+        rpn->bit_rate      = bit_rate;
+        rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
+        rpn->flow_ctrl     = flow_ctrl_settings;
+        rpn->xon_char      = xon_char;
+        rpn->xoff_char     = xoff_char;
+        rpn->param_mask    = param_mask;
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        struct rfcomm_rls *rls;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d status 0x%x", s, cr, status);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_RLS);
+        mcc->len  = __len8(sizeof(*rls));
+
+        rls = (void *) ptr; ptr += sizeof(*rls);
+        rls->dlci   = __addr(1, dlci);
+        rls->status = status;
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        struct rfcomm_msc *msc;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_MSC);
+        mcc->len  = __len8(sizeof(*msc));
+
+        msc = (void *) ptr; ptr += sizeof(*msc);
+        msc->dlci    = __addr(1, dlci);
+        msc->v24_sig = v24_sig | 0x01;
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d", s, cr);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
+        mcc->len  = __len8(0);
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
+{
+        struct rfcomm_hdr *hdr;
+        struct rfcomm_mcc *mcc;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p cr %d", s, cr);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = __addr(s->initiator, 0);
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+        hdr->len  = __len8(sizeof(*mcc));
+
+        mcc = (void *) ptr; ptr += sizeof(*mcc);
+        mcc->type = __mcc_type(cr, RFCOMM_FCON);
+        mcc->len  = __len8(0);
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
+{
+        struct socket *sock = s->sock;
+        struct kvec iv[3];
+        struct msghdr msg;
+        unsigned char hdr[5], crc[1];
+
+        if (len > 125)
+                return -EINVAL;
+
+        BT_DBG("%p cr %d", s, cr);
+
+        hdr[0] = __addr(s->initiator, 0);
+        hdr[1] = __ctrl(RFCOMM_UIH, 0);
+        hdr[2] = 0x01 | ((len + 2) << 1);
+        hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
+        hdr[4] = 0x01 | (len << 1);
+
+        crc[0] = __fcs(hdr);
+
+        iv[0].iov_base = hdr;
+        iv[0].iov_len  = 5;
+        iv[1].iov_base = pattern;
+        iv[1].iov_len  = len;
+        iv[2].iov_base = crc;
+        iv[2].iov_len  = 1;
+
+        memset(&msg, 0, sizeof(msg));
+
+        return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
+}
+
+static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
+{
+        struct rfcomm_hdr *hdr;
+        u8 buf[16], *ptr = buf;
+
+        BT_DBG("%p addr %d credits %d", s, addr, credits);
+
+        hdr = (void *) ptr; ptr += sizeof(*hdr);
+        hdr->addr = addr;
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
+        hdr->len  = __len8(0);
+
+        *ptr = credits; ptr++;
+
+        *ptr = __fcs(buf); ptr++;
+
+        return rfcomm_send_frame(s, buf, ptr - buf);
+}
+
+static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
+{
+        struct rfcomm_hdr *hdr;
+        int len = skb->len;
+        u8 *crc;
+
+        if (len > 127) {
+                hdr = (void *) skb_push(skb, 4);
+                put_unaligned(htobs(__len16(len)), (u16 *) &hdr->len);
+        } else {
+                hdr = (void *) skb_push(skb, 3);
+                hdr->len = __len8(len);
+        }
+        hdr->addr = addr;
+        hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
+
+        crc = skb_put(skb, 1);
+        *crc = __fcs((void *) hdr);
+}
+
+/* ---- RFCOMM frame reception ---- */
+static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
+{
+        BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
+
+        if (dlci) {
+                /* Data channel */
+                struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
+                if (!d) {
+                        rfcomm_send_dm(s, dlci);
+                        return 0;
+                }
+
+                switch (d->state) {
+                case BT_CONNECT:
+                        rfcomm_dlc_clear_timer(d);
+
+                        rfcomm_dlc_lock(d);
+                        d->state = BT_CONNECTED;
+                        d->state_change(d, 0);
+                        rfcomm_dlc_unlock(d);
+
+                        rfcomm_send_msc(s, 1, dlci, d->v24_sig);
+                        break;
+
+                case BT_DISCONN:
+                        d->state = BT_CLOSED;
+                        __rfcomm_dlc_close(d, 0);
+                        break;
+                }
+        } else {
+                /* Control channel */
+                switch (s->state) {
+                case BT_CONNECT:
+                        s->state = BT_CONNECTED;
+                        rfcomm_process_connect(s);
+                        break;
+                }
+        }
+        return 0;
+}
+
+static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
+{
+        int err = 0;
+
+        BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
+
+        if (dlci) {
+                /* Data DLC */
+                struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
+                if (d) {
+                        if (d->state == BT_CONNECT || d->state == BT_CONFIG)
+                                err = ECONNREFUSED;
+                        else
+                                err = ECONNRESET;
+
+                        d->state = BT_CLOSED;
+                        __rfcomm_dlc_close(d, err);
+                }
+        } else {
+                if (s->state == BT_CONNECT)
+                        err = ECONNREFUSED;
+                else
+                        err = ECONNRESET;
+
+                s->state = BT_CLOSED;
+                rfcomm_session_close(s, err);
+        }
+        return 0;
+}
+
+static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
+{
+        int err = 0;
+
+        BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
+
+        if (dlci) {
+                struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
+                if (d) {
+                        rfcomm_send_ua(s, dlci);
+
+                        if (d->state == BT_CONNECT || d->state == BT_CONFIG)
+                                err = ECONNREFUSED;
+                        else
+                                err = ECONNRESET;
+
+                        d->state = BT_CLOSED;
+                        __rfcomm_dlc_close(d, err);
+                } else 
+                        rfcomm_send_dm(s, dlci);
+                        
+        } else {
+                rfcomm_send_ua(s, 0);
+
+                if (s->state == BT_CONNECT)
+                        err = ECONNREFUSED;
+                else
+                        err = ECONNRESET;
+
+                s->state = BT_CLOSED;
+                rfcomm_session_close(s, err);
+        }
+
+        return 0;
+}
+
+static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
+{
+        struct sock *sk = d->session->sock->sk;
+
+        if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
+                if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
+                        return 1;
+        } else if (d->link_mode & RFCOMM_LM_AUTH) {
+                if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
+                        return 1;
+        }
+
+        return 0;
+}
+
+static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
+{
+        BT_DBG("dlc %p", d);
+
+        rfcomm_send_ua(d->session, d->dlci);
+
+        rfcomm_dlc_lock(d);
+        d->state = BT_CONNECTED;
+        d->state_change(d, 0);
+        rfcomm_dlc_unlock(d);
+
+        rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
+}
+
+static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
+{
+        struct rfcomm_dlc *d;
+        u8 channel;
+
+        BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
+
+        if (!dlci) {
+                rfcomm_send_ua(s, 0);
+
+                if (s->state == BT_OPEN) {
+                        s->state = BT_CONNECTED;
+                        rfcomm_process_connect(s);
+                }
+                return 0;
+        }
+
+        /* Check if DLC exists */
+        d = rfcomm_dlc_get(s, dlci);
+        if (d) {
+                if (d->state == BT_OPEN) {
+                        /* DLC was previously opened by PN request */
+                        if (rfcomm_check_link_mode(d)) {
+                                set_bit(RFCOMM_AUTH_PENDING, &d->flags);
+                                rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+                                return 0;
+                        }
+
+                        rfcomm_dlc_accept(d);
+                }
+                return 0;
+        }
+
+        /* Notify socket layer about incoming connection */
+        channel = __srv_channel(dlci);
+        if (rfcomm_connect_ind(s, channel, &d)) {
+                d->dlci = dlci;
+                d->addr = __addr(s->initiator, dlci);
+                rfcomm_dlc_link(s, d);
+
+                if (rfcomm_check_link_mode(d)) {
+                        set_bit(RFCOMM_AUTH_PENDING, &d->flags);
+                        rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+                        return 0;
+                }
+
+                rfcomm_dlc_accept(d);
+        } else {
+                rfcomm_send_dm(s, dlci);
+        }
+
+        return 0;
+}
+
+static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
+{
+        struct rfcomm_session *s = d->session;
+
+        BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 
+                        d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
+
+        if (pn->flow_ctrl == 0xf0 || pn->flow_ctrl == 0xe0) {
+                d->cfc = s->cfc = RFCOMM_CFC_ENABLED;
+                d->tx_credits = pn->credits;
+        } else {
+                d->cfc = s->cfc = RFCOMM_CFC_DISABLED;
+                set_bit(RFCOMM_TX_THROTTLED, &d->flags);
+        }
+
+        d->priority = pn->priority;
+
+        d->mtu = s->mtu = btohs(pn->mtu);
+
+        return 0;
+}
+
+static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
+{
+        struct rfcomm_pn *pn = (void *) skb->data;
+        struct rfcomm_dlc *d;
+        u8 dlci = pn->dlci;
+
+        BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
+
+        if (!dlci)
+                return 0;
+
+        d = rfcomm_dlc_get(s, dlci);
+        if (d) {
+                if (cr) {
+                        /* PN request */
+                        rfcomm_apply_pn(d, cr, pn);
+                        rfcomm_send_pn(s, 0, d);
+                } else {
+                        /* PN response */
+                        switch (d->state) {
+                        case BT_CONFIG:
+                                rfcomm_apply_pn(d, cr, pn);
+
+                                d->state = BT_CONNECT;
+                                rfcomm_send_sabm(s, d->dlci);
+                                break;
+                        }
+                }
+        } else {
+                u8 channel = __srv_channel(dlci);
+
+                if (!cr)
+                        return 0;
+
+                /* PN request for non existing DLC.
+                 * Assume incoming connection. */
+                if (rfcomm_connect_ind(s, channel, &d)) {
+                        d->dlci = dlci;
+                        d->addr = __addr(s->initiator, dlci);
+                        rfcomm_dlc_link(s, d);
+
+                        rfcomm_apply_pn(d, cr, pn);
+
+                        d->state = BT_OPEN;
+                        rfcomm_send_pn(s, 0, d);
+                } else {
+                        rfcomm_send_dm(s, dlci);
+                }
+        }
+        return 0;
+}
+
+static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
+{
+        struct rfcomm_rpn *rpn = (void *) skb->data;
+        u8 dlci = __get_dlci(rpn->dlci);
+
+        u8 bit_rate  = 0;
+        u8 data_bits = 0;
+        u8 stop_bits = 0;
+        u8 parity    = 0;
+        u8 flow_ctrl = 0;
+        u8 xon_char  = 0;
+        u8 xoff_char = 0;
+        u16 rpn_mask = RFCOMM_RPN_PM_ALL;
+        
+        BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 
+               dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
+               rpn->xon_char, rpn->xoff_char, rpn->param_mask);
+        
+        if (!cr) 
+                return 0;
+        
+        if (len == 1) {
+                /* request: return default setting */
+                bit_rate  = RFCOMM_RPN_BR_115200;
+                data_bits = RFCOMM_RPN_DATA_8;
+                stop_bits = RFCOMM_RPN_STOP_1;
+                parity    = RFCOMM_RPN_PARITY_NONE;
+                flow_ctrl = RFCOMM_RPN_FLOW_NONE;
+                xon_char  = RFCOMM_RPN_XON_CHAR;
+                xoff_char = RFCOMM_RPN_XOFF_CHAR;
+
+                goto rpn_out;
+        }
+        /* check for sane values: ignore/accept bit_rate, 8 bits, 1 stop bit, no parity,
+                                  no flow control lines, normal XON/XOFF chars */
+        if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
+                bit_rate = rpn->bit_rate;
+                if (bit_rate != RFCOMM_RPN_BR_115200) {
+                        BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
+                        bit_rate = RFCOMM_RPN_BR_115200;
+                        rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
+                data_bits = __get_rpn_data_bits(rpn->line_settings);
+                if (data_bits != RFCOMM_RPN_DATA_8) {
+                        BT_DBG("RPN data bits mismatch 0x%x", data_bits);
+                        data_bits = RFCOMM_RPN_DATA_8;
+                        rpn_mask ^= RFCOMM_RPN_PM_DATA;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
+                stop_bits = __get_rpn_stop_bits(rpn->line_settings);
+                if (stop_bits != RFCOMM_RPN_STOP_1) {
+                        BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
+                        stop_bits = RFCOMM_RPN_STOP_1;
+                        rpn_mask ^= RFCOMM_RPN_PM_STOP;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
+                parity = __get_rpn_parity(rpn->line_settings);
+                if (parity != RFCOMM_RPN_PARITY_NONE) {
+                        BT_DBG("RPN parity mismatch 0x%x", parity);
+                        parity = RFCOMM_RPN_PARITY_NONE;
+                        rpn_mask ^= RFCOMM_RPN_PM_PARITY;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
+                flow_ctrl = rpn->flow_ctrl;
+                if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
+                        BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
+                        flow_ctrl = RFCOMM_RPN_FLOW_NONE;
+                        rpn_mask ^= RFCOMM_RPN_PM_FLOW;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
+                xon_char = rpn->xon_char;
+                if (xon_char != RFCOMM_RPN_XON_CHAR) {
+                        BT_DBG("RPN XON char mismatch 0x%x", xon_char);
+                        xon_char = RFCOMM_RPN_XON_CHAR;
+                        rpn_mask ^= RFCOMM_RPN_PM_XON;
+                }
+        }
+        if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
+                xoff_char = rpn->xoff_char;
+                if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
+                        BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
+                        xoff_char = RFCOMM_RPN_XOFF_CHAR;
+                        rpn_mask ^= RFCOMM_RPN_PM_XOFF;
+                }
+        }
+
+rpn_out:
+        rfcomm_send_rpn(s, 0, dlci, 
+                        bit_rate, data_bits, stop_bits, parity, flow_ctrl,
+                        xon_char, xoff_char, rpn_mask);
+
+        return 0;
+}
+
+static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
+{
+        struct rfcomm_rls *rls = (void *) skb->data;
+        u8 dlci = __get_dlci(rls->dlci);
+
+        BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
+        
+        if (!cr)
+                return 0;
+
+        /* FIXME: We should probably do something with this
+           information here. But for now it's sufficient just
+           to reply -- Bluetooth 1.1 says it's mandatory to 
+           recognise and respond to RLS */
+
+        rfcomm_send_rls(s, 0, dlci, rls->status);
+
+        return 0;
+}
+
+static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
+{
+        struct rfcomm_msc *msc = (void *) skb->data;
+        struct rfcomm_dlc *d;
+        u8 dlci = __get_dlci(msc->dlci);
+
+        BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
+
+        d = rfcomm_dlc_get(s, dlci);
+        if (!d) 
+                return 0;
+
+        if (cr) {
+                if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
+                        set_bit(RFCOMM_TX_THROTTLED, &d->flags);
+                else
+                        clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
+                
+                rfcomm_dlc_lock(d);
+                if (d->modem_status)
+                        d->modem_status(d, msc->v24_sig);
+                rfcomm_dlc_unlock(d);
+                
+                rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
+
+                d->mscex |= RFCOMM_MSCEX_RX;
+        } else 
+                d->mscex |= RFCOMM_MSCEX_TX;
+
+        return 0;
+}
+
+static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
+{
+        struct rfcomm_mcc *mcc = (void *) skb->data;
+        u8 type, cr, len;
+
+        cr   = __test_cr(mcc->type);
+        type = __get_mcc_type(mcc->type);
+        len  = __get_mcc_len(mcc->len);
+
+        BT_DBG("%p type 0x%x cr %d", s, type, cr);
+
+        skb_pull(skb, 2);
+
+        switch (type) {
+        case RFCOMM_PN:
+                rfcomm_recv_pn(s, cr, skb);
+                break;
+
+        case RFCOMM_RPN:
+                rfcomm_recv_rpn(s, cr, len, skb);
+                break;
+
+        case RFCOMM_RLS:
+                rfcomm_recv_rls(s, cr, skb);
+                break;
+
+        case RFCOMM_MSC:
+                rfcomm_recv_msc(s, cr, skb);
+                break;
+
+        case RFCOMM_FCOFF:
+                if (cr) {
+                        set_bit(RFCOMM_TX_THROTTLED, &s->flags);
+                        rfcomm_send_fcoff(s, 0);
+                }
+                break;
+
+        case RFCOMM_FCON:
+                if (cr) {
+                        clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
+                        rfcomm_send_fcon(s, 0);
+                }
+                break;
+
+        case RFCOMM_TEST:
+                if (cr)
+                        rfcomm_send_test(s, 0, skb->data, skb->len);
+                break;
+
+        case RFCOMM_NSC:
+                break;
+
+        default:
+                BT_ERR("Unknown control type 0x%02x", type);
+                rfcomm_send_nsc(s, cr, type);
+                break;
+        }
+        return 0;
+}
+
+static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
+{
+        struct rfcomm_dlc *d;
+
+        BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
+
+        d = rfcomm_dlc_get(s, dlci);
+        if (!d) {
+                rfcomm_send_dm(s, dlci);
+                goto drop;
+        }
+
+        if (pf && d->cfc) {
+                u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
+
+                d->tx_credits += credits;
+                if (d->tx_credits)
+                        clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
+        }
+
+        if (skb->len && d->state == BT_CONNECTED) {
+                rfcomm_dlc_lock(d);
+                d->rx_credits--;
+                d->data_ready(d, skb);
+                rfcomm_dlc_unlock(d);
+                return 0;
+        }
+
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
+{
+        struct rfcomm_hdr *hdr = (void *) skb->data;
+        u8 type, dlci, fcs;
+
+        dlci = __get_dlci(hdr->addr);
+        type = __get_type(hdr->ctrl);
+
+        /* Trim FCS */
+        skb->len--; skb->tail--;
+        fcs = *(u8 *) skb->tail;
+
+        if (__check_fcs(skb->data, type, fcs)) {
+                BT_ERR("bad checksum in packet");
+                kfree_skb(skb);
+                return -EILSEQ;
+        }
+
+        if (__test_ea(hdr->len))
+                skb_pull(skb, 3);
+        else
+                skb_pull(skb, 4);
+
+        switch (type) {
+        case RFCOMM_SABM:
+                if (__test_pf(hdr->ctrl))
+                        rfcomm_recv_sabm(s, dlci);
+                break;
+
+        case RFCOMM_DISC:
+                if (__test_pf(hdr->ctrl))
+                        rfcomm_recv_disc(s, dlci);
+                break;
+
+        case RFCOMM_UA:
+                if (__test_pf(hdr->ctrl))
+                        rfcomm_recv_ua(s, dlci);
+                break;
+
+        case RFCOMM_DM:
+                rfcomm_recv_dm(s, dlci);
+                break;
+
+        case RFCOMM_UIH:
+                if (dlci)
+                        return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
+
+                rfcomm_recv_mcc(s, skb);
+                break;
+
+        default:
+                BT_ERR("Unknown packet type 0x%02x\n", type);
+                break;
+        }
+        kfree_skb(skb);
+        return 0;
+}
+
+/* ---- Connection and data processing ---- */
+
+static void rfcomm_process_connect(struct rfcomm_session *s)
+{
+        struct rfcomm_dlc *d;
+        struct list_head *p, *n;
+
+        BT_DBG("session %p state %ld", s, s->state);
+
+        list_for_each_safe(p, n, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+                if (d->state == BT_CONFIG) {
+                        d->mtu = s->mtu;
+                        rfcomm_send_pn(s, 1, d);
+                }
+        }
+}
+
+/* Send data queued for the DLC.
+ * Return number of frames left in the queue.
+ */
+static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
+{
+        struct sk_buff *skb;
+        int err;
+
+        BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 
+                        d, d->state, d->cfc, d->rx_credits, d->tx_credits);
+
+        /* Send pending MSC */
+        if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
+                rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 
+
+        if (d->cfc) {
+                /* CFC enabled. 
+                 * Give them some credits */
+                if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
+                                d->rx_credits <= (d->cfc >> 2)) {
+                        rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
+                        d->rx_credits = d->cfc;
+                }
+        } else {
+                /* CFC disabled.
+                 * Give ourselves some credits */
+                d->tx_credits = 5;
+        }
+
+        if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
+                return skb_queue_len(&d->tx_queue);
+
+        while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
+                err = rfcomm_send_frame(d->session, skb->data, skb->len);
+                if (err < 0) {
+                        skb_queue_head(&d->tx_queue, skb);
+                        break;
+                }
+                kfree_skb(skb);
+                d->tx_credits--;
+        }
+
+        if (d->cfc && !d->tx_credits) {
+                /* We're out of TX credits.
+                 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
+                set_bit(RFCOMM_TX_THROTTLED, &d->flags);
+        }
+
+        return skb_queue_len(&d->tx_queue);
+}
+
+static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
+{
+        struct rfcomm_dlc *d;
+        struct list_head *p, *n;
+
+        BT_DBG("session %p state %ld", s, s->state);
+
+        list_for_each_safe(p, n, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+
+                if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
+                        __rfcomm_dlc_close(d, ETIMEDOUT);
+                        continue;
+                }
+
+                if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
+                        rfcomm_dlc_clear_timer(d);
+                        rfcomm_dlc_accept(d);
+                        if (d->link_mode & RFCOMM_LM_SECURE) {
+                                struct sock *sk = s->sock->sk;
+                                hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
+                        }
+                        continue;
+                } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
+                        rfcomm_dlc_clear_timer(d);
+                        rfcomm_send_dm(s, d->dlci);
+                        __rfcomm_dlc_close(d, ECONNREFUSED);
+                        continue;
+                }
+
+                if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
+                        continue;
+
+                if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
+                                d->mscex == RFCOMM_MSCEX_OK)
+                        rfcomm_process_tx(d);
+        }
+}
+
+static inline void rfcomm_process_rx(struct rfcomm_session *s)
+{
+        struct socket *sock = s->sock;
+        struct sock *sk = sock->sk;
+        struct sk_buff *skb;
+
+        BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
+
+        /* Get data directly from socket receive queue without copying it. */
+        while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
+                skb_orphan(skb);
+                rfcomm_recv_frame(s, skb);
+        }
+
+        if (sk->sk_state == BT_CLOSED) {
+                if (!s->initiator)
+                        rfcomm_session_put(s);
+
+                rfcomm_session_close(s, sk->sk_err);
+        }
+}
+
+static inline void rfcomm_accept_connection(struct rfcomm_session *s)
+{
+        struct socket *sock = s->sock, *nsock;
+        int err;
+
+        /* Fast check for a new connection.
+         * Avoids unnesesary socket allocations. */
+        if (list_empty(&bt_sk(sock->sk)->accept_q))
+                return;
+
+        BT_DBG("session %p", s);
+
+        if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
+                return;
+
+        nsock->ops  = sock->ops;
+
+        __module_get(nsock->ops->owner);
+
+        err = sock->ops->accept(sock, nsock, O_NONBLOCK);
+        if (err < 0) {
+                sock_release(nsock);
+                return;
+        }
+
+        /* Set our callbacks */
+        nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
+        nsock->sk->sk_state_change = rfcomm_l2state_change;
+
+        s = rfcomm_session_add(nsock, BT_OPEN);
+        if (s) {
+                rfcomm_session_hold(s);
+                rfcomm_schedule(RFCOMM_SCHED_RX);
+        } else
+                sock_release(nsock);
+}
+
+static inline void rfcomm_check_connection(struct rfcomm_session *s)
+{
+        struct sock *sk = s->sock->sk;
+
+        BT_DBG("%p state %ld", s, s->state);
+
+        switch(sk->sk_state) {
+        case BT_CONNECTED:
+                s->state = BT_CONNECT;
+
+                /* We can adjust MTU on outgoing sessions.
+                 * L2CAP MTU minus UIH header and FCS. */
+                s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
+
+                rfcomm_send_sabm(s, 0);
+                break;
+
+        case BT_CLOSED:
+                s->state = BT_CLOSED;
+                rfcomm_session_close(s, sk->sk_err);
+                break;
+        }
+}
+
+static inline void rfcomm_process_sessions(void)
+{
+        struct list_head *p, *n;
+
+        rfcomm_lock();
+
+        list_for_each_safe(p, n, &session_list) {
+                struct rfcomm_session *s;
+                s = list_entry(p, struct rfcomm_session, list);
+
+                if (s->state == BT_LISTEN) {
+                        rfcomm_accept_connection(s);
+                        continue;
+                }
+
+                rfcomm_session_hold(s);
+
+                switch (s->state) {
+                case BT_BOUND:
+                        rfcomm_check_connection(s);
+                        break;
+
+                default:
+                        rfcomm_process_rx(s);
+                        break;
+                }
+
+                rfcomm_process_dlcs(s);
+
+                rfcomm_session_put(s);
+        }
+
+        rfcomm_unlock();
+}
+
+static void rfcomm_worker(void)
+{
+        BT_DBG("");
+
+        while (!atomic_read(&terminate)) {
+                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
+                        /* No pending events. Let's sleep.
+                         * Incoming connections and data will wake us up. */
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        schedule();
+                }
+
+                /* Process stuff */
+                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
+                rfcomm_process_sessions();
+        }
+        set_current_state(TASK_RUNNING);
+        return;
+}
+
+static int rfcomm_add_listener(bdaddr_t *ba)
+{
+        struct sockaddr_l2 addr;
+        struct socket *sock;
+        struct sock *sk;
+        struct rfcomm_session *s;
+        int    err = 0;
+
+        /* Create socket */
+        err = rfcomm_l2sock_create(&sock);
+        if (err < 0) { 
+                BT_ERR("Create socket failed %d", err);
+                return err;
+        }
+
+        /* Bind socket */
+        bacpy(&addr.l2_bdaddr, ba);
+        addr.l2_family = AF_BLUETOOTH;
+        addr.l2_psm    = htobs(RFCOMM_PSM);
+        err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+        if (err < 0) {
+                BT_ERR("Bind failed %d", err);
+                goto failed;
+        }
+
+        /* Set L2CAP options */
+        sk = sock->sk;
+        lock_sock(sk);
+        l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+        release_sock(sk);
+
+        /* Start listening on the socket */
+        err = sock->ops->listen(sock, 10);
+        if (err) {
+                BT_ERR("Listen failed %d", err);
+                goto failed;
+        }
+
+        /* Add listening session */
+        s = rfcomm_session_add(sock, BT_LISTEN);
+        if (!s)
+                goto failed;
+
+        rfcomm_session_hold(s);
+        return 0;
+failed:
+        sock_release(sock);
+        return err;
+}
+
+static void rfcomm_kill_listener(void)
+{
+        struct rfcomm_session *s;
+        struct list_head *p, *n;
+
+        BT_DBG("");
+
+        list_for_each_safe(p, n, &session_list) {
+                s = list_entry(p, struct rfcomm_session, list);
+                rfcomm_session_del(s);
+        }
+}
+
+static int rfcomm_run(void *unused)
+{
+        rfcomm_thread = current;
+
+        atomic_inc(&running);
+
+        daemonize("krfcommd");
+        set_user_nice(current, -10);
+        current->flags |= PF_NOFREEZE;
+
+        BT_DBG("");
+
+        rfcomm_add_listener(BDADDR_ANY);
+
+        rfcomm_worker();
+
+        rfcomm_kill_listener();
+
+        atomic_dec(&running);
+        return 0;
+}
+
+static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
+{
+        struct rfcomm_session *s;
+        struct rfcomm_dlc *d;
+        struct list_head *p, *n;
+
+        BT_DBG("conn %p status 0x%02x", conn, status);
+
+        s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
+        if (!s)
+                return;
+
+        rfcomm_session_hold(s);
+
+        list_for_each_safe(p, n, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+
+                if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
+                        continue;
+
+                if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
+                        continue;
+
+                if (!status)
+                        set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
+                else
+                        set_bit(RFCOMM_AUTH_REJECT, &d->flags);
+        }
+
+        rfcomm_session_put(s);
+
+        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+}
+
+static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
+{
+        struct rfcomm_session *s;
+        struct rfcomm_dlc *d;
+        struct list_head *p, *n;
+
+        BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
+
+        s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
+        if (!s)
+                return;
+
+        rfcomm_session_hold(s);
+
+        list_for_each_safe(p, n, &s->dlcs) {
+                d = list_entry(p, struct rfcomm_dlc, list);
+
+                if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
+                        continue;
+
+                if (!status && encrypt)
+                        set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
+                else
+                        set_bit(RFCOMM_AUTH_REJECT, &d->flags);
+        }
+
+        rfcomm_session_put(s);
+
+        rfcomm_schedule(RFCOMM_SCHED_AUTH);
+}
+
+static struct hci_cb rfcomm_cb = {
+        .name           = "RFCOMM",
+        .auth_cfm       = rfcomm_auth_cfm,
+        .encrypt_cfm    = rfcomm_encrypt_cfm
+};
+
+/* ---- Proc fs support ---- */
+#ifdef CONFIG_PROC_FS
+static void *rfcomm_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct rfcomm_session *s;
+        struct list_head *pp, *p;
+        loff_t l = *pos;
+
+        rfcomm_lock();
+
+        list_for_each(p, &session_list) {
+                s = list_entry(p, struct rfcomm_session, list);
+                list_for_each(pp, &s->dlcs)
+                        if (!l--) {
+                                seq->private = s;
+                                return pp;
+                        }
+        }
+        return NULL;
+}
+
+static void *rfcomm_seq_next(struct seq_file *seq, void *e, loff_t *pos)
+{
+        struct rfcomm_session *s = seq->private;
+        struct list_head *pp, *p = e;
+        (*pos)++;
+
+        if (p->next != &s->dlcs)
+                return p->next;
+
+        list_for_each(p, &session_list) {
+                s = list_entry(p, struct rfcomm_session, list);
+                __list_for_each(pp, &s->dlcs) {
+                        seq->private = s;
+                        return pp;
+                }
+        }
+        return NULL;
+}
+
+static void rfcomm_seq_stop(struct seq_file *seq, void *e)
+{
+        rfcomm_unlock();
+}
+
+static int  rfcomm_seq_show(struct seq_file *seq, void *e)
+{
+        struct rfcomm_session *s = seq->private;
+        struct sock *sk = s->sock->sk;
+        struct rfcomm_dlc *d = list_entry(e, struct rfcomm_dlc, list);
+
+        seq_printf(seq, "%s %s %ld %d %d %d %d\n",
+                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+                        d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
+        return 0;
+}
+
+static struct seq_operations rfcomm_seq_ops = {
+        .start  = rfcomm_seq_start,
+        .next   = rfcomm_seq_next,
+        .stop   = rfcomm_seq_stop,
+        .show   = rfcomm_seq_show 
+};
+
+static int rfcomm_seq_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &rfcomm_seq_ops);
+}
+
+static struct file_operations rfcomm_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = rfcomm_seq_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release,
+};
+
+static int  __init rfcomm_proc_init(void)
+{
+        struct proc_dir_entry *p;
+
+        proc_bt_rfcomm = proc_mkdir("rfcomm", proc_bt);
+        if (proc_bt_rfcomm) {
+                proc_bt_rfcomm->owner = THIS_MODULE;
+
+                p = create_proc_entry("dlc", S_IRUGO, proc_bt_rfcomm);
+                if (p)
+                        p->proc_fops = &rfcomm_seq_fops;
+        }
+        return 0;
+}
+
+static void __exit rfcomm_proc_cleanup(void)
+{
+        remove_proc_entry("dlc", proc_bt_rfcomm);
+
+        remove_proc_entry("rfcomm", proc_bt);
+}
+
+#else /* CONFIG_PROC_FS */
+
+static int  __init rfcomm_proc_init(void)
+{
+        return 0;
+}
+
+static void __exit rfcomm_proc_cleanup(void)
+{
+        return;
+}
+#endif /* CONFIG_PROC_FS */
+
+/* ---- Initialization ---- */
+static int __init rfcomm_init(void)
+{
+        l2cap_load();
+
+        hci_register_cb(&rfcomm_cb);
+
+        kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
+
+        BT_INFO("RFCOMM ver %s", VERSION);
+
+        rfcomm_proc_init();
+
+        rfcomm_init_sockets();
+
+#ifdef CONFIG_BT_RFCOMM_TTY
+        rfcomm_init_ttys();
+#endif
+
+        return 0;
+}
+
+static void __exit rfcomm_exit(void)
+{
+        hci_unregister_cb(&rfcomm_cb);
+
+        /* Terminate working thread.
+         * ie. Set terminate flag and wake it up */
+        atomic_inc(&terminate);
+        rfcomm_schedule(RFCOMM_SCHED_STATE);
+
+        /* Wait until thread is running */
+        while (atomic_read(&running))
+                schedule();
+
+#ifdef CONFIG_BT_RFCOMM_TTY
+        rfcomm_cleanup_ttys();
+#endif
+
+        rfcomm_cleanup_sockets();
+
+        rfcomm_proc_cleanup();
+}
+
+module_init(rfcomm_init);
+module_exit(rfcomm_exit);
+
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-3");
diff --git a/net/bluetooth/rfcomm/crc.c b/net/bluetooth/rfcomm/crc.c
new file mode 100644
index 000000000000..1011bc4a8692
--- /dev/null
+++ b/net/bluetooth/rfcomm/crc.c
@@ -0,0 +1,71 @@
+/* 
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * RFCOMM FCS calculation.
+ *
+ * $Id: crc.c,v 1.2 2002/09/21 09:54:32 holtmann Exp $
+ */
+
+/* reversed, 8-bit, poly=0x07 */
+unsigned char rfcomm_crc_table[256] = { 
+        0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
+        0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
+        0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
+        0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
+
+        0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
+        0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
+        0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
+        0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
+
+        0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
+        0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
+        0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
+        0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
+
+        0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
+        0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
+        0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
+        0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
+
+        0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
+        0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
+        0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
+        0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
+
+        0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
+        0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
+        0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
+        0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
+
+        0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
+        0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
+        0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
+        0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
+
+        0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
+        0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
+        0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
+        0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
+};
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
new file mode 100644
index 000000000000..640028a2183c
--- /dev/null
+++ b/net/bluetooth/rfcomm/sock.c
@@ -0,0 +1,1010 @@
+/* 
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * RFCOMM sockets.
+ *
+ * $Id: sock.c,v 1.24 2002/10/03 01:00:34 maxk Exp $
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
+#include <net/bluetooth/rfcomm.h>
+
+#ifndef CONFIG_BT_RFCOMM_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+static struct proto_ops rfcomm_sock_ops;
+
+static struct bt_sock_list rfcomm_sk_list = {
+        .lock = RW_LOCK_UNLOCKED
+};
+
+static void rfcomm_sock_close(struct sock *sk);
+static void rfcomm_sock_kill(struct sock *sk);
+
+/* ---- DLC callbacks ----
+ *
+ * called under rfcomm_dlc_lock()
+ */
+static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
+{
+        struct sock *sk = d->owner;
+        if (!sk)
+                return;
+
+        atomic_add(skb->len, &sk->sk_rmem_alloc);
+        skb_queue_tail(&sk->sk_receive_queue, skb);
+        sk->sk_data_ready(sk, skb->len);
+
+        if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
+                rfcomm_dlc_throttle(d);
+}
+
+static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
+{
+        struct sock *sk = d->owner, *parent;
+        if (!sk)
+                return;
+
+        BT_DBG("dlc %p state %ld err %d", d, d->state, err);
+
+        bh_lock_sock(sk);
+
+        if (err)
+                sk->sk_err = err;
+
+        sk->sk_state = d->state;
+
+        parent = bt_sk(sk)->parent;
+        if (parent) {
+                if (d->state == BT_CLOSED) {
+                        sock_set_flag(sk, SOCK_ZAPPED);
+                        bt_accept_unlink(sk);
+                }
+                parent->sk_data_ready(parent, 0);
+        } else {
+                if (d->state == BT_CONNECTED)
+                        rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
+                sk->sk_state_change(sk);
+        }
+
+        bh_unlock_sock(sk);
+
+        if (parent && sock_flag(sk, SOCK_ZAPPED)) {
+                /* We have to drop DLC lock here, otherwise
+                 * rfcomm_sock_destruct() will dead lock. */
+                rfcomm_dlc_unlock(d);
+                rfcomm_sock_kill(sk);
+                rfcomm_dlc_lock(d);
+        }
+}
+
+/* ---- Socket functions ---- */
+static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
+{
+        struct sock *sk = NULL;
+        struct hlist_node *node;
+
+        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+                if (rfcomm_pi(sk)->channel == channel && 
+                                !bacmp(&bt_sk(sk)->src, src))
+                        break;
+        }
+
+        return node ? sk : NULL;
+}
+
+/* Find socket with channel and source bdaddr.
+ * Returns closest match.
+ */
+static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
+{
+        struct sock *sk = NULL, *sk1 = NULL;
+        struct hlist_node *node;
+
+        sk_for_each(sk, node, &rfcomm_sk_list.head) {
+                if (state && sk->sk_state != state)
+                        continue;
+
+                if (rfcomm_pi(sk)->channel == channel) {
+                        /* Exact match. */
+                        if (!bacmp(&bt_sk(sk)->src, src))
+                                break;
+
+                        /* Closest match */
+                        if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                                sk1 = sk;
+                }
+        }
+        return node ? sk : sk1;
+}
+
+/* Find socket with given address (channel, src).
+ * Returns locked socket */
+static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
+{
+        struct sock *s;
+        read_lock(&rfcomm_sk_list.lock);
+        s = __rfcomm_get_sock_by_channel(state, channel, src);
+        if (s) bh_lock_sock(s);
+        read_unlock(&rfcomm_sk_list.lock);
+        return s;
+}
+
+static void rfcomm_sock_destruct(struct sock *sk)
+{
+        struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
+
+        BT_DBG("sk %p dlc %p", sk, d);
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+
+        rfcomm_dlc_lock(d);
+        rfcomm_pi(sk)->dlc = NULL;
+
+        /* Detach DLC if it's owned by this socket */
+        if (d->owner == sk)
+                d->owner = NULL;
+        rfcomm_dlc_unlock(d);
+
+        rfcomm_dlc_put(d);
+}
+
+static void rfcomm_sock_cleanup_listen(struct sock *parent)
+{
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted dlcs */
+        while ((sk = bt_accept_dequeue(parent, NULL))) {
+                rfcomm_sock_close(sk);
+                rfcomm_sock_kill(sk);
+        }
+
+        parent->sk_state  = BT_CLOSED;
+        sock_set_flag(parent, SOCK_ZAPPED);
+}
+
+/* Kill socket (only if zapped and orphan)
+ * Must be called on unlocked socket.
+ */
+static void rfcomm_sock_kill(struct sock *sk)
+{
+        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+                return;
+
+        BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
+
+        /* Kill poor orphan */
+        bt_sock_unlink(&rfcomm_sk_list, sk);
+        sock_set_flag(sk, SOCK_DEAD);
+        sock_put(sk);
+}
+
+static void __rfcomm_sock_close(struct sock *sk)
+{
+        struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
+
+        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
+
+        switch (sk->sk_state) {
+        case BT_LISTEN:
+                rfcomm_sock_cleanup_listen(sk);
+                break;
+
+        case BT_CONNECT:
+        case BT_CONNECT2:
+        case BT_CONFIG:
+        case BT_CONNECTED:
+                rfcomm_dlc_close(d, 0);
+
+        default:
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+        }
+}
+
+/* Close socket.
+ * Must be called on unlocked socket.
+ */
+static void rfcomm_sock_close(struct sock *sk)
+{
+        lock_sock(sk);
+        __rfcomm_sock_close(sk);
+        release_sock(sk);
+}
+
+static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
+{
+        struct rfcomm_pinfo *pi = rfcomm_pi(sk);
+
+        BT_DBG("sk %p", sk);
+
+        if (parent) {
+                sk->sk_type = parent->sk_type;
+                pi->link_mode = rfcomm_pi(parent)->link_mode;
+        } else {
+                pi->link_mode = 0;
+        }
+
+        pi->dlc->link_mode = pi->link_mode;
+}
+
+static struct proto rfcomm_proto = {
+        .name           = "RFCOMM",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct rfcomm_pinfo)
+};
+
+static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, int prio)
+{
+        struct rfcomm_dlc *d;
+        struct sock *sk;
+
+        sk = sk_alloc(PF_BLUETOOTH, prio, &rfcomm_proto, 1);
+        if (!sk)
+                return NULL;
+
+        sock_init_data(sock, sk);
+        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
+
+        d = rfcomm_dlc_alloc(prio);
+        if (!d) {
+                sk_free(sk);
+                return NULL;
+        }
+
+        d->data_ready   = rfcomm_sk_data_ready;
+        d->state_change = rfcomm_sk_state_change;
+
+        rfcomm_pi(sk)->dlc = d;
+        d->owner = sk;
+
+        sk->sk_destruct = rfcomm_sock_destruct;
+        sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
+
+        sk->sk_sndbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
+        sk->sk_rcvbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = proto;
+        sk->sk_state    = BT_OPEN;
+
+        bt_sock_link(&rfcomm_sk_list, sk);
+
+        BT_DBG("sk %p", sk);
+        return sk;
+}
+
+static int rfcomm_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        sock->state = SS_UNCONNECTED;
+
+        if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
+                return -ESOCKTNOSUPPORT;
+
+        sock->ops = &rfcomm_sock_ops;
+
+        if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
+                return -ENOMEM;
+
+        rfcomm_sock_init(sk, NULL);
+        return 0;
+}
+
+static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+{
+        struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
+
+        if (!addr || addr->sa_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_OPEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        write_lock_bh(&rfcomm_sk_list.lock);
+
+        if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
+                err = -EADDRINUSE;
+        } else {
+                /* Save source address */
+                bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
+                rfcomm_pi(sk)->channel = sa->rc_channel;
+                sk->sk_state = BT_BOUND;
+        }
+
+        write_unlock_bh(&rfcomm_sk_list.lock);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
+{
+        struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
+        struct sock *sk = sock->sk;
+        struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
+        int err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
+                return -EINVAL;
+
+        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
+                return -EBADFD;
+
+        if (sk->sk_type != SOCK_STREAM)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        sk->sk_state = BT_CONNECT;
+        bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
+        rfcomm_pi(sk)->channel = sa->rc_channel;
+
+        err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
+        if (!err)
+                err = bt_sock_wait_state(sk, BT_CONNECTED,
+                                sock_sndtimeo(sk, flags & O_NONBLOCK));
+
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_listen(struct socket *sock, int backlog)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p backlog %d", sk, backlog);
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_BOUND) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        if (!rfcomm_pi(sk)->channel) {
+                bdaddr_t *src = &bt_sk(sk)->src;
+                u8 channel;
+
+                err = -EINVAL;
+
+                write_lock_bh(&rfcomm_sk_list.lock);
+
+                for (channel = 1; channel < 31; channel++)
+                        if (!__rfcomm_get_sock_by_addr(channel, src)) {
+                                rfcomm_pi(sk)->channel = channel;
+                                err = 0;
+                                break;
+                        }
+
+                write_unlock_bh(&rfcomm_sk_list.lock);
+
+                if (err < 0)
+                        goto done;
+        }
+
+        sk->sk_max_ack_backlog = backlog;
+        sk->sk_ack_backlog = 0;
+        sk->sk_state = BT_LISTEN;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct sock *sk = sock->sk, *nsk;
+        long timeo;
+        int err = 0;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_LISTEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+
+        BT_DBG("sk %p timeo %ld", sk, timeo);
+
+        /* Wait for an incoming connection. (wake-one). */
+        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+
+        if (err)
+                goto done;
+
+        newsock->state = SS_CONNECTED;
+
+        BT_DBG("new socket %p", nsk);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
+{
+        struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        sa->rc_family  = AF_BLUETOOTH;
+        sa->rc_channel = rfcomm_pi(sk)->channel;
+        if (peer)
+                bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
+        else
+                bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
+
+        *len = sizeof(struct sockaddr_rc);
+        return 0;
+}
+
+static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
+                               struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
+        struct sk_buff *skb;
+        int err;
+        int sent = 0;
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        if (sk->sk_shutdown & SEND_SHUTDOWN)
+                return -EPIPE;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        lock_sock(sk);
+
+        while (len) {
+                size_t size = min_t(size_t, len, d->mtu);
+                
+                skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
+                                msg->msg_flags & MSG_DONTWAIT, &err);
+                if (!skb)
+                        break;
+                skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
+
+                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+                if (err) {
+                        kfree_skb(skb);
+                        sent = err;
+                        break;
+                }
+
+                err = rfcomm_dlc_send(d, skb);
+                if (err < 0) {
+                        kfree_skb(skb);
+                        break;
+                }
+
+                sent += size;
+                len  -= size;
+        }
+
+        release_sock(sk);
+
+        return sent ? sent : err;
+}
+
+static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
+{
+        DECLARE_WAITQUEUE(wait, current);
+
+        add_wait_queue(sk->sk_sleep, &wait);
+        for (;;) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (skb_queue_len(&sk->sk_receive_queue) || sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN) ||
+                                signal_pending(current) || !timeo)
+                        break;
+
+                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+        }
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+        return timeo;
+}
+
+static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+                               struct msghdr *msg, size_t size, int flags)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+        size_t target, copied = 0;
+        long timeo;
+
+        if (flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        msg->msg_namelen = 0;
+
+        BT_DBG("sk %p size %d", sk, size);
+
+        lock_sock(sk);
+
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
+        timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
+
+        do {
+                struct sk_buff *skb;
+                int chunk;
+
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                if (!skb) {
+                        if (copied >= target)
+                                break;
+
+                        if ((err = sock_error(sk)) != 0)
+                                break;
+                        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                                break;
+
+                        err = -EAGAIN;
+                        if (!timeo)
+                                break;
+
+                        timeo = rfcomm_sock_data_wait(sk, timeo);
+
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeo);
+                                goto out;
+                        }
+                        continue;
+                }
+
+                chunk = min_t(unsigned int, skb->len, size);
+                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        if (!copied)
+                                copied = -EFAULT;
+                        break;
+                }
+                copied += chunk;
+                size   -= chunk;
+
+                if (!(flags & MSG_PEEK)) {
+                        atomic_sub(chunk, &sk->sk_rmem_alloc);
+
+                        skb_pull(skb, chunk);
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                break;
+                        }
+                        kfree_skb(skb);
+
+                } else {
+                        /* put message back and return */
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        break;
+                }
+        } while (size);
+
+out:
+        if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
+                rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
+
+        release_sock(sk);
+        return copied ? : err;
+}
+
+static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+        u32 opt;
+
+        BT_DBG("sk %p", sk);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case RFCOMM_LM:
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                rfcomm_pi(sk)->link_mode = opt;
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct rfcomm_conninfo cinfo;
+        int len, err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case RFCOMM_LM:
+                if (put_user(rfcomm_pi(sk)->link_mode, (u32 __user *) optval))
+                        err = -EFAULT;
+                break;
+
+        case RFCOMM_CONNINFO:
+                if (sk->sk_state != BT_CONNECTED) {
+                        err = -ENOTCONN;
+                        break;
+                }
+
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+
+                cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
+                memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
+
+                len = min_t(unsigned int, len, sizeof(cinfo));
+                if (copy_to_user(optval, (char *) &cinfo, len))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        struct sock *sk = sock->sk;
+        int err;
+
+        lock_sock(sk);
+
+#ifdef CONFIG_BT_RFCOMM_TTY
+        err = rfcomm_dev_ioctl(sk, cmd, (void __user *)arg);
+#else
+        err = -EOPNOTSUPP;
+#endif
+
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_shutdown(struct socket *sock, int how)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk) return 0;
+
+        lock_sock(sk);
+        if (!sk->sk_shutdown) {
+                sk->sk_shutdown = SHUTDOWN_MASK;
+                __rfcomm_sock_close(sk);
+
+                if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
+                        err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
+        }
+        release_sock(sk);
+        return err;
+}
+
+static int rfcomm_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        int err;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        err = rfcomm_sock_shutdown(sock, 2);
+
+        sock_orphan(sk);
+        rfcomm_sock_kill(sk);
+        return err;
+}
+
+/* ---- RFCOMM core layer callbacks ---- 
+ *
+ * called under rfcomm_lock()
+ */
+int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
+{
+        struct sock *sk, *parent;
+        bdaddr_t src, dst;
+        int result = 0;
+
+        BT_DBG("session %p channel %d", s, channel);
+
+        rfcomm_session_getaddr(s, &src, &dst);
+
+        /* Check if we have socket listening on channel */
+        parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
+        if (!parent)
+                return 0;
+
+        /* Check for backlog size */
+        if (sk_acceptq_is_full(parent)) {
+                BT_DBG("backlog full %d", parent->sk_ack_backlog); 
+                goto done;
+        }
+
+        sk = rfcomm_sock_alloc(NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
+        if (!sk)
+                goto done;
+
+        rfcomm_sock_init(sk, parent);
+        bacpy(&bt_sk(sk)->src, &src);
+        bacpy(&bt_sk(sk)->dst, &dst);
+        rfcomm_pi(sk)->channel = channel;
+
+        sk->sk_state = BT_CONFIG;
+        bt_accept_enqueue(parent, sk);
+
+        /* Accept connection and return socket DLC */
+        *d = rfcomm_pi(sk)->dlc;
+        result = 1;
+
+done:
+        bh_unlock_sock(parent);
+        return result;
+}
+
+/* ---- Proc fs support ---- */
+#ifdef CONFIG_PROC_FS
+static void *rfcomm_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        loff_t l = *pos;
+
+        read_lock_bh(&rfcomm_sk_list.lock);
+
+        sk_for_each(sk, node, &rfcomm_sk_list.head)
+                if (!l--)
+                        return sk;
+        return NULL;
+}
+
+static void *rfcomm_seq_next(struct seq_file *seq, void *e, loff_t *pos)
+{
+        struct sock *sk = e;
+        (*pos)++;
+        return sk_next(sk);
+}
+
+static void rfcomm_seq_stop(struct seq_file *seq, void *e)
+{
+        read_unlock_bh(&rfcomm_sk_list.lock);
+}
+
+static int  rfcomm_seq_show(struct seq_file *seq, void *e)
+{
+        struct sock *sk = e;
+        seq_printf(seq, "%s %s %d %d\n",
+                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+                        sk->sk_state, rfcomm_pi(sk)->channel);
+        return 0;
+}
+
+static struct seq_operations rfcomm_seq_ops = {
+        .start  = rfcomm_seq_start,
+        .next   = rfcomm_seq_next,
+        .stop   = rfcomm_seq_stop,
+        .show   = rfcomm_seq_show 
+};
+
+static int rfcomm_seq_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &rfcomm_seq_ops);
+}
+
+static struct file_operations rfcomm_seq_fops = {
+        .owner   = THIS_MODULE,
+        .open    = rfcomm_seq_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release,
+};
+
+static int  __init rfcomm_sock_proc_init(void)
+{
+        struct proc_dir_entry *p = create_proc_entry("sock", S_IRUGO, proc_bt_rfcomm);
+        if (!p)
+                return -ENOMEM;
+        p->proc_fops = &rfcomm_seq_fops;
+        return 0;
+}
+
+static void __exit rfcomm_sock_proc_cleanup(void)
+{
+        remove_proc_entry("sock", proc_bt_rfcomm);
+}
+
+#else /* CONFIG_PROC_FS */
+
+static int  __init rfcomm_sock_proc_init(void)
+{
+        return 0;
+}
+
+static void __exit rfcomm_sock_proc_cleanup(void)
+{
+        return;
+}
+#endif /* CONFIG_PROC_FS */
+
+static struct proto_ops rfcomm_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = rfcomm_sock_release,
+        .bind           = rfcomm_sock_bind,
+        .connect        = rfcomm_sock_connect,
+        .listen         = rfcomm_sock_listen,
+        .accept         = rfcomm_sock_accept,
+        .getname        = rfcomm_sock_getname,
+        .sendmsg        = rfcomm_sock_sendmsg,
+        .recvmsg        = rfcomm_sock_recvmsg,
+        .shutdown       = rfcomm_sock_shutdown,
+        .setsockopt     = rfcomm_sock_setsockopt,
+        .getsockopt     = rfcomm_sock_getsockopt,
+        .ioctl          = rfcomm_sock_ioctl,
+        .poll           = bt_sock_poll,
+        .socketpair     = sock_no_socketpair,
+        .mmap           = sock_no_mmap
+};
+
+static struct net_proto_family rfcomm_sock_family_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .create         = rfcomm_sock_create
+};
+
+int  __init rfcomm_init_sockets(void)
+{
+        int err;
+
+        err = proto_register(&rfcomm_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
+        if (err < 0)
+                goto error;
+
+        rfcomm_sock_proc_init();
+
+        BT_INFO("RFCOMM socket layer initialized");
+
+        return 0;
+
+error:
+        BT_ERR("RFCOMM socket layer registration failed");
+        proto_unregister(&rfcomm_proto);
+        return err;
+}
+
+void __exit rfcomm_cleanup_sockets(void)
+{
+        rfcomm_sock_proc_cleanup();
+
+        if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
+                BT_ERR("RFCOMM socket layer unregistration failed");
+
+        proto_unregister(&rfcomm_proto);
+}
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
new file mode 100644
index 000000000000..6d689200bcf3
--- /dev/null
+++ b/net/bluetooth/rfcomm/tty.c
@@ -0,0 +1,930 @@
+/* 
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
+   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/*
+ * RFCOMM TTY.
+ *
+ * $Id: tty.c,v 1.24 2002/10/03 01:54:38 holtmann Exp $
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/rfcomm.h>
+
+#ifndef CONFIG_BT_RFCOMM_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
+#define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
+#define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
+#define RFCOMM_TTY_MINOR 0
+
+static struct tty_driver *rfcomm_tty_driver;
+
+struct rfcomm_dev {
+        struct list_head        list;
+        atomic_t                refcnt;
+
+        char                    name[12];
+        int                     id;
+        unsigned long           flags;
+        int                     opened;
+        int                     err;
+
+        bdaddr_t                src;
+        bdaddr_t                dst;
+        u8                      channel;
+
+        uint                    modem_status;
+
+        struct rfcomm_dlc       *dlc;
+        struct tty_struct       *tty;
+        wait_queue_head_t       wait;
+        struct tasklet_struct   wakeup_task;
+
+        atomic_t                wmem_alloc;
+};
+
+static LIST_HEAD(rfcomm_dev_list);
+static DEFINE_RWLOCK(rfcomm_dev_lock);
+
+static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
+static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
+static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
+
+static void rfcomm_tty_wakeup(unsigned long arg);
+
+/* ---- Device functions ---- */
+static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
+{
+        struct rfcomm_dlc *dlc = dev->dlc;
+
+        BT_DBG("dev %p dlc %p", dev, dlc);
+
+        rfcomm_dlc_lock(dlc);
+        /* Detach DLC if it's owned by this dev */
+        if (dlc->owner == dev)
+                dlc->owner = NULL;
+        rfcomm_dlc_unlock(dlc);
+
+        rfcomm_dlc_put(dlc);
+
+        tty_unregister_device(rfcomm_tty_driver, dev->id);
+
+        /* Refcount should only hit zero when called from rfcomm_dev_del()
+           which will have taken us off the list. Everything else are
+           refcounting bugs. */
+        BUG_ON(!list_empty(&dev->list));
+
+        kfree(dev);
+
+        /* It's safe to call module_put() here because socket still 
+           holds reference to this module. */
+        module_put(THIS_MODULE);
+}
+
+static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
+{
+        atomic_inc(&dev->refcnt);
+}
+
+static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
+{
+        /* The reason this isn't actually a race, as you no
+           doubt have a little voice screaming at you in your
+           head, is that the refcount should never actually
+           reach zero unless the device has already been taken
+           off the list, in rfcomm_dev_del(). And if that's not
+           true, we'll hit the BUG() in rfcomm_dev_destruct()
+           anyway. */
+        if (atomic_dec_and_test(&dev->refcnt))
+                rfcomm_dev_destruct(dev);
+}
+
+static struct rfcomm_dev *__rfcomm_dev_get(int id)
+{
+        struct rfcomm_dev *dev;
+        struct list_head  *p;
+
+        list_for_each(p, &rfcomm_dev_list) {
+                dev = list_entry(p, struct rfcomm_dev, list);
+                if (dev->id == id)
+                        return dev;
+        }
+
+        return NULL;
+}
+
+static inline struct rfcomm_dev *rfcomm_dev_get(int id)
+{
+        struct rfcomm_dev *dev;
+
+        read_lock(&rfcomm_dev_lock);
+
+        dev = __rfcomm_dev_get(id);
+        if (dev)
+                rfcomm_dev_hold(dev);
+
+        read_unlock(&rfcomm_dev_lock);
+
+        return dev;
+}
+
+static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
+{
+        struct rfcomm_dev *dev;
+        struct list_head *head = &rfcomm_dev_list, *p;
+        int err = 0;
+
+        BT_DBG("id %d channel %d", req->dev_id, req->channel);
+        
+        dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
+        if (!dev)
+                return -ENOMEM;
+        memset(dev, 0, sizeof(struct rfcomm_dev));
+
+        write_lock_bh(&rfcomm_dev_lock);
+
+        if (req->dev_id < 0) {
+                dev->id = 0;
+
+                list_for_each(p, &rfcomm_dev_list) {
+                        if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
+                                break;
+
+                        dev->id++;
+                        head = p;
+                }
+        } else {
+                dev->id = req->dev_id;
+
+                list_for_each(p, &rfcomm_dev_list) {
+                        struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
+
+                        if (entry->id == dev->id) {
+                                err = -EADDRINUSE;
+                                goto out;
+                        }
+
+                        if (entry->id > dev->id - 1)
+                                break;
+
+                        head = p;
+                }
+        }
+
+        if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
+                err = -ENFILE;
+                goto out;
+        }
+
+        sprintf(dev->name, "rfcomm%d", dev->id);
+
+        list_add(&dev->list, head);
+        atomic_set(&dev->refcnt, 1);
+
+        bacpy(&dev->src, &req->src);
+        bacpy(&dev->dst, &req->dst);
+        dev->channel = req->channel;
+
+        dev->flags = req->flags & 
+                ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
+
+        init_waitqueue_head(&dev->wait);
+        tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
+
+        rfcomm_dlc_lock(dlc);
+        dlc->data_ready   = rfcomm_dev_data_ready;
+        dlc->state_change = rfcomm_dev_state_change;
+        dlc->modem_status = rfcomm_dev_modem_status;
+
+        dlc->owner = dev;
+        dev->dlc   = dlc;
+        rfcomm_dlc_unlock(dlc);
+
+        /* It's safe to call __module_get() here because socket already 
+           holds reference to this module. */
+        __module_get(THIS_MODULE);
+
+out:
+        write_unlock_bh(&rfcomm_dev_lock);
+
+        if (err) {
+                kfree(dev);
+                return err;
+        }
+
+        tty_register_device(rfcomm_tty_driver, dev->id, NULL);
+
+        return dev->id;
+}
+
+static void rfcomm_dev_del(struct rfcomm_dev *dev)
+{
+        BT_DBG("dev %p", dev);
+
+        write_lock_bh(&rfcomm_dev_lock);
+        list_del_init(&dev->list);
+        write_unlock_bh(&rfcomm_dev_lock);
+
+        rfcomm_dev_put(dev);
+}
+
+/* ---- Send buffer ---- */
+static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
+{
+        /* We can't let it be zero, because we don't get a callback
+           when tx_credits becomes nonzero, hence we'd never wake up */
+        return dlc->mtu * (dlc->tx_credits?:1);
+}
+
+static void rfcomm_wfree(struct sk_buff *skb)
+{
+        struct rfcomm_dev *dev = (void *) skb->sk;
+        atomic_sub(skb->truesize, &dev->wmem_alloc);
+        if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
+                tasklet_schedule(&dev->wakeup_task);
+        rfcomm_dev_put(dev);
+}
+
+static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
+{
+        rfcomm_dev_hold(dev);
+        atomic_add(skb->truesize, &dev->wmem_alloc);
+        skb->sk = (void *) dev;
+        skb->destructor = rfcomm_wfree;
+}
+
+static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, int priority)
+{
+        if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
+                struct sk_buff *skb = alloc_skb(size, priority);
+                if (skb) {
+                        rfcomm_set_owner_w(skb, dev);
+                        return skb;
+                }
+        }
+        return NULL;
+}
+
+/* ---- Device IOCTLs ---- */
+
+#define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
+
+static int rfcomm_create_dev(struct sock *sk, void __user *arg)
+{
+        struct rfcomm_dev_req req;
+        struct rfcomm_dlc *dlc;
+        int id;
+
+        if (copy_from_user(&req, arg, sizeof(req)))
+                return -EFAULT;
+
+        BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
+
+        if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
+                /* Socket must be connected */
+                if (sk->sk_state != BT_CONNECTED)
+                        return -EBADFD;
+
+                dlc = rfcomm_pi(sk)->dlc;
+                rfcomm_dlc_hold(dlc);
+        } else {
+                dlc = rfcomm_dlc_alloc(GFP_KERNEL);
+                if (!dlc)
+                        return -ENOMEM;
+        }
+
+        id = rfcomm_dev_add(&req, dlc);
+        if (id < 0) {
+                rfcomm_dlc_put(dlc);
+                return id;
+        }
+
+        if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
+                /* DLC is now used by device.
+                 * Socket must be disconnected */
+                sk->sk_state = BT_CLOSED;
+        }
+
+        return id;
+}
+
+static int rfcomm_release_dev(void __user *arg)
+{
+        struct rfcomm_dev_req req;
+        struct rfcomm_dev *dev;
+
+        if (copy_from_user(&req, arg, sizeof(req)))
+                return -EFAULT;
+
+        BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
+
+        if (!(dev = rfcomm_dev_get(req.dev_id)))
+                return -ENODEV;
+
+        if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
+                rfcomm_dev_put(dev);
+                return -EPERM;
+        }
+
+        if (req.flags & (1 << RFCOMM_HANGUP_NOW))
+                rfcomm_dlc_close(dev->dlc, 0);
+
+        rfcomm_dev_del(dev);
+        rfcomm_dev_put(dev);
+        return 0;
+}
+
+static int rfcomm_get_dev_list(void __user *arg)
+{
+        struct rfcomm_dev_list_req *dl;
+        struct rfcomm_dev_info *di;
+        struct list_head *p;
+        int n = 0, size, err;
+        u16 dev_num;
+
+        BT_DBG("");
+
+        if (get_user(dev_num, (u16 __user *) arg))
+                return -EFAULT;
+
+        if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
+                return -EINVAL;
+
+        size = sizeof(*dl) + dev_num * sizeof(*di);
+
+        if (!(dl = kmalloc(size, GFP_KERNEL)))
+                return -ENOMEM;
+
+        di = dl->dev_info;
+
+        read_lock_bh(&rfcomm_dev_lock);
+
+        list_for_each(p, &rfcomm_dev_list) {
+                struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
+                (di + n)->id      = dev->id;
+                (di + n)->flags   = dev->flags;
+                (di + n)->state   = dev->dlc->state;
+                (di + n)->channel = dev->channel;
+                bacpy(&(di + n)->src, &dev->src);
+                bacpy(&(di + n)->dst, &dev->dst);
+                if (++n >= dev_num)
+                        break;
+        }
+
+        read_unlock_bh(&rfcomm_dev_lock);
+
+        dl->dev_num = n;
+        size = sizeof(*dl) + n * sizeof(*di);
+
+        err = copy_to_user(arg, dl, size);
+        kfree(dl);
+
+        return err ? -EFAULT : 0;
+}
+
+static int rfcomm_get_dev_info(void __user *arg)
+{
+        struct rfcomm_dev *dev;
+        struct rfcomm_dev_info di;
+        int err = 0;
+
+        BT_DBG("");
+
+        if (copy_from_user(&di, arg, sizeof(di)))
+                return -EFAULT;
+
+        if (!(dev = rfcomm_dev_get(di.id)))
+                return -ENODEV;
+
+        di.flags   = dev->flags;
+        di.channel = dev->channel;
+        di.state   = dev->dlc->state;
+        bacpy(&di.src, &dev->src);
+        bacpy(&di.dst, &dev->dst);
+
+        if (copy_to_user(arg, &di, sizeof(di)))
+                err = -EFAULT;
+
+        rfcomm_dev_put(dev);
+        return err;
+}
+
+int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        BT_DBG("cmd %d arg %p", cmd, arg);
+
+        switch (cmd) {
+        case RFCOMMCREATEDEV:
+                return rfcomm_create_dev(sk, arg);
+
+        case RFCOMMRELEASEDEV:
+                return rfcomm_release_dev(arg);
+
+        case RFCOMMGETDEVLIST:
+                return rfcomm_get_dev_list(arg);
+
+        case RFCOMMGETDEVINFO:
+                return rfcomm_get_dev_info(arg);
+        }
+
+        return -EINVAL;
+}
+
+/* ---- DLC callbacks ---- */
+static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
+{
+        struct rfcomm_dev *dev = dlc->owner;
+        struct tty_struct *tty;
+       
+        if (!dev || !(tty = dev->tty)) {
+                kfree_skb(skb);
+                return;
+        }
+
+        BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
+
+        if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
+                register int i;
+                for (i = 0; i < skb->len; i++) {
+                        if (tty->flip.count >= TTY_FLIPBUF_SIZE)
+                                tty_flip_buffer_push(tty);
+
+                        tty_insert_flip_char(tty, skb->data[i], 0);
+                }
+                tty_flip_buffer_push(tty);
+        } else
+                tty->ldisc.receive_buf(tty, skb->data, NULL, skb->len);
+
+        kfree_skb(skb);
+}
+
+static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
+{
+        struct rfcomm_dev *dev = dlc->owner;
+        if (!dev)
+                return;
+        
+        BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
+
+        dev->err = err;
+        wake_up_interruptible(&dev->wait);
+
+        if (dlc->state == BT_CLOSED) {
+                if (!dev->tty) {
+                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+                                rfcomm_dev_hold(dev);
+                                rfcomm_dev_del(dev);
+
+                                /* We have to drop DLC lock here, otherwise
+                                   rfcomm_dev_put() will dead lock if it's
+                                   the last reference. */
+                                rfcomm_dlc_unlock(dlc);
+                                rfcomm_dev_put(dev);
+                                rfcomm_dlc_lock(dlc);
+                        }
+                } else 
+                        tty_hangup(dev->tty);
+        }
+}
+
+static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
+{
+        struct rfcomm_dev *dev = dlc->owner;
+        if (!dev)
+                return;
+        
+        BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
+
+        dev->modem_status = 
+                ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
+                ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
+                ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
+                ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
+}
+
+/* ---- TTY functions ---- */
+static void rfcomm_tty_wakeup(unsigned long arg)
+{
+        struct rfcomm_dev *dev = (void *) arg;
+        struct tty_struct *tty = dev->tty;
+        if (!tty)
+                return;
+
+        BT_DBG("dev %p tty %p", dev, tty);
+
+        if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
+                (tty->ldisc.write_wakeup)(tty);
+
+        wake_up_interruptible(&tty->write_wait);
+#ifdef SERIAL_HAVE_POLL_WAIT
+        wake_up_interruptible(&tty->poll_wait);
+#endif
+}
+
+static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct rfcomm_dev *dev;
+        struct rfcomm_dlc *dlc;
+        int err, id;
+
+        id = tty->index;
+
+        BT_DBG("tty %p id %d", tty, id);
+
+        /* We don't leak this refcount. For reasons which are not entirely
+           clear, the TTY layer will call our ->close() method even if the
+           open fails. We decrease the refcount there, and decreasing it
+           here too would cause breakage. */
+        dev = rfcomm_dev_get(id);
+        if (!dev)
+                return -ENODEV;
+
+        BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst), dev->channel, dev->opened);
+
+        if (dev->opened++ != 0)
+                return 0;
+
+        dlc = dev->dlc;
+
+        /* Attach TTY and open DLC */
+
+        rfcomm_dlc_lock(dlc);
+        tty->driver_data = dev;
+        dev->tty = tty;
+        rfcomm_dlc_unlock(dlc);
+        set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
+
+        err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
+        if (err < 0)
+                return err;
+
+        /* Wait for DLC to connect */
+        add_wait_queue(&dev->wait, &wait);
+        while (1) {
+                set_current_state(TASK_INTERRUPTIBLE);
+
+                if (dlc->state == BT_CLOSED) {
+                        err = -dev->err;
+                        break;
+                }
+
+                if (dlc->state == BT_CONNECTED)
+                        break;
+
+                if (signal_pending(current)) {
+                        err = -EINTR;
+                        break;
+                }
+
+                schedule();
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(&dev->wait, &wait);
+
+        return err;
+}
+
+static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        if (!dev)
+                return;
+
+        BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened);
+
+        if (--dev->opened == 0) {
+                /* Close DLC and dettach TTY */
+                rfcomm_dlc_close(dev->dlc, 0);
+
+                clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
+                tasklet_kill(&dev->wakeup_task);
+
+                rfcomm_dlc_lock(dev->dlc);
+                tty->driver_data = NULL;
+                dev->tty = NULL;
+                rfcomm_dlc_unlock(dev->dlc);
+        }
+
+        rfcomm_dev_put(dev);
+}
+
+static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        struct rfcomm_dlc *dlc = dev->dlc;
+        struct sk_buff *skb;
+        int err = 0, sent = 0, size;
+
+        BT_DBG("tty %p count %d", tty, count);
+
+        while (count) {
+                size = min_t(uint, count, dlc->mtu);
+
+                skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
+                
+                if (!skb)
+                        break;
+
+                skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
+
+                memcpy(skb_put(skb, size), buf + sent, size);
+
+                if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
+                        kfree_skb(skb);
+                        break;
+                }
+
+                sent  += size;
+                count -= size;
+        }
+
+        return sent ? sent : err;
+}
+
+static int rfcomm_tty_write_room(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        int room;
+
+        BT_DBG("tty %p", tty);
+
+        room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
+        if (room < 0)
+                room = 0;
+        return room;
+}
+
+static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
+{
+        BT_DBG("tty %p cmd 0x%02x", tty, cmd);
+
+        switch (cmd) {
+        case TCGETS:
+                BT_DBG("TCGETS is not supported");
+                return -ENOIOCTLCMD;
+
+        case TCSETS:
+                BT_DBG("TCSETS is not supported");
+                return -ENOIOCTLCMD;
+
+        case TIOCMIWAIT:
+                BT_DBG("TIOCMIWAIT");
+                break;
+
+        case TIOCGICOUNT:
+                BT_DBG("TIOCGICOUNT");
+                break;
+
+        case TIOCGSERIAL:
+                BT_ERR("TIOCGSERIAL is not supported");
+                return -ENOIOCTLCMD;
+
+        case TIOCSSERIAL:
+                BT_ERR("TIOCSSERIAL is not supported");
+                return -ENOIOCTLCMD;
+
+        case TIOCSERGSTRUCT:
+                BT_ERR("TIOCSERGSTRUCT is not supported");
+                return -ENOIOCTLCMD;
+
+        case TIOCSERGETLSR:
+                BT_ERR("TIOCSERGETLSR is not supported");
+                return -ENOIOCTLCMD;
+
+        case TIOCSERCONFIG:
+                BT_ERR("TIOCSERCONFIG is not supported");
+                return -ENOIOCTLCMD;
+
+        default:
+                return -ENOIOCTLCMD;    /* ioctls which we must ignore */
+
+        }
+
+        return -ENOIOCTLCMD;
+}
+
+#define RELEVANT_IFLAG(iflag) (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
+
+static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
+{
+        BT_DBG("tty %p", tty);
+
+        if ((tty->termios->c_cflag == old->c_cflag) &&
+                (RELEVANT_IFLAG(tty->termios->c_iflag) == RELEVANT_IFLAG(old->c_iflag)))
+                return;
+
+        /* handle turning off CRTSCTS */
+        if ((old->c_cflag & CRTSCTS) && !(tty->termios->c_cflag & CRTSCTS)) {
+                BT_DBG("turning off CRTSCTS");
+        }
+}
+
+static void rfcomm_tty_throttle(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+        
+        rfcomm_dlc_throttle(dev->dlc);
+}
+
+static void rfcomm_tty_unthrottle(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+        
+        rfcomm_dlc_unthrottle(dev->dlc);
+}
+
+static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        struct rfcomm_dlc *dlc = dev->dlc;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+
+        if (skb_queue_len(&dlc->tx_queue))
+                return dlc->mtu;
+
+        return 0;
+}
+
+static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        if (!dev)
+                return;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+
+        skb_queue_purge(&dev->dlc->tx_queue);
+
+        if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
+                tty->ldisc.write_wakeup(tty);
+}
+
+static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
+{
+        BT_DBG("tty %p ch %c", tty, ch);
+}
+
+static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
+{
+        BT_DBG("tty %p timeout %d", tty, timeout);
+}
+
+static void rfcomm_tty_hangup(struct tty_struct *tty)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        if (!dev)
+                return;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+
+        rfcomm_tty_flush_buffer(tty);
+
+        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
+                rfcomm_dev_del(dev);
+}
+
+static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)
+{
+        return 0;
+}
+
+static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+
+        BT_DBG("tty %p dev %p", tty, dev);
+
+        return dev->modem_status;
+}
+
+static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
+{
+        struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
+        struct rfcomm_dlc *dlc = dev->dlc;
+        u8 v24_sig;
+
+        BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
+
+        rfcomm_dlc_get_modem_status(dlc, &v24_sig);
+
+        if (set & TIOCM_DSR || set & TIOCM_DTR)
+                v24_sig |= RFCOMM_V24_RTC;
+        if (set & TIOCM_RTS || set & TIOCM_CTS)
+                v24_sig |= RFCOMM_V24_RTR;
+        if (set & TIOCM_RI)
+                v24_sig |= RFCOMM_V24_IC;
+        if (set & TIOCM_CD)
+                v24_sig |= RFCOMM_V24_DV;
+
+        if (clear & TIOCM_DSR || clear & TIOCM_DTR)
+                v24_sig &= ~RFCOMM_V24_RTC;
+        if (clear & TIOCM_RTS || clear & TIOCM_CTS)
+                v24_sig &= ~RFCOMM_V24_RTR;
+        if (clear & TIOCM_RI)
+                v24_sig &= ~RFCOMM_V24_IC;
+        if (clear & TIOCM_CD)
+                v24_sig &= ~RFCOMM_V24_DV;
+
+        rfcomm_dlc_set_modem_status(dlc, v24_sig);
+
+        return 0;
+}
+
+/* ---- TTY structure ---- */
+
+static struct tty_operations rfcomm_ops = {
+        .open                   = rfcomm_tty_open,
+        .close                  = rfcomm_tty_close,
+        .write                  = rfcomm_tty_write,
+        .write_room             = rfcomm_tty_write_room,
+        .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
+        .flush_buffer           = rfcomm_tty_flush_buffer,
+        .ioctl                  = rfcomm_tty_ioctl,
+        .throttle               = rfcomm_tty_throttle,
+        .unthrottle             = rfcomm_tty_unthrottle,
+        .set_termios            = rfcomm_tty_set_termios,
+        .send_xchar             = rfcomm_tty_send_xchar,
+        .hangup                 = rfcomm_tty_hangup,
+        .wait_until_sent        = rfcomm_tty_wait_until_sent,
+        .read_proc              = rfcomm_tty_read_proc,
+        .tiocmget               = rfcomm_tty_tiocmget,
+        .tiocmset               = rfcomm_tty_tiocmset,
+};
+
+int rfcomm_init_ttys(void)
+{
+        rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
+        if (!rfcomm_tty_driver)
+                return -1;
+
+        rfcomm_tty_driver->owner        = THIS_MODULE;
+        rfcomm_tty_driver->driver_name  = "rfcomm";
+        rfcomm_tty_driver->devfs_name   = "bluetooth/rfcomm/";
+        rfcomm_tty_driver->name         = "rfcomm";
+        rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
+        rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
+        rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
+        rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
+        rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_NO_DEVFS;
+        rfcomm_tty_driver->init_termios = tty_std_termios;
+        rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
+        tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
+
+        if (tty_register_driver(rfcomm_tty_driver)) {
+                BT_ERR("Can't register RFCOMM TTY driver");
+                put_tty_driver(rfcomm_tty_driver);
+                return -1;
+        }
+
+        BT_INFO("RFCOMM TTY layer initialized");
+
+        return 0;
+}
+
+void rfcomm_cleanup_ttys(void)
+{
+        tty_unregister_driver(rfcomm_tty_driver);
+        put_tty_driver(rfcomm_tty_driver);
+}
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
new file mode 100644
index 000000000000..3e750ef09e60
--- /dev/null
+++ b/net/bluetooth/sco.c
@@ -0,0 +1,1071 @@
+/* 
+   BlueZ - Bluetooth protocol stack for Linux
+   Copyright (C) 2000-2001 Qualcomm Incorporated
+
+   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License version 2 as
+   published by the Free Software Foundation;
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   SOFTWARE IS DISCLAIMED.
+*/
+
+/* Bluetooth SCO sockets. */
+
+#include <linux/config.h>
+#include <linux/module.h>
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/major.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/poll.h>
+#include <linux/fcntl.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+#include <linux/list.h>
+#include <net/sock.h>
+
+#include <asm/system.h>
+#include <asm/uaccess.h>
+
+#include <net/bluetooth/bluetooth.h>
+#include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/sco.h>
+
+#ifndef CONFIG_BT_SCO_DEBUG
+#undef  BT_DBG
+#define BT_DBG(D...)
+#endif
+
+#define VERSION "0.4"
+
+static struct proto_ops sco_sock_ops;
+
+static struct bt_sock_list sco_sk_list = {
+        .lock = RW_LOCK_UNLOCKED
+};
+
+static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
+static void sco_chan_del(struct sock *sk, int err);
+
+static int  sco_conn_del(struct hci_conn *conn, int err);
+
+static void sco_sock_close(struct sock *sk);
+static void sco_sock_kill(struct sock *sk);
+
+/* ---- SCO timers ---- */
+static void sco_sock_timeout(unsigned long arg)
+{
+        struct sock *sk = (struct sock *) arg;
+
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+
+        bh_lock_sock(sk);
+        sk->sk_err = ETIMEDOUT;
+        sk->sk_state_change(sk);
+        bh_unlock_sock(sk);
+
+        sco_sock_kill(sk);
+        sock_put(sk);
+}
+
+static void sco_sock_set_timer(struct sock *sk, long timeout)
+{
+        BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
+        sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
+}
+
+static void sco_sock_clear_timer(struct sock *sk)
+{
+        BT_DBG("sock %p state %d", sk, sk->sk_state);
+        sk_stop_timer(sk, &sk->sk_timer);
+}
+
+static void sco_sock_init_timer(struct sock *sk)
+{
+        init_timer(&sk->sk_timer);
+        sk->sk_timer.function = sco_sock_timeout;
+        sk->sk_timer.data = (unsigned long)sk;
+}
+
+/* ---- SCO connections ---- */
+static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
+{
+        struct hci_dev *hdev = hcon->hdev;
+        struct sco_conn *conn;
+
+        if ((conn = hcon->sco_data))
+                return conn;
+
+        if (status)
+                return conn;
+
+        if (!(conn = kmalloc(sizeof(struct sco_conn), GFP_ATOMIC)))
+                return NULL;
+        memset(conn, 0, sizeof(struct sco_conn));
+
+        spin_lock_init(&conn->lock);
+
+        hcon->sco_data = conn;
+        conn->hcon = hcon;
+
+        conn->src = &hdev->bdaddr;
+        conn->dst = &hcon->dst;
+
+        if (hdev->sco_mtu > 0)
+                conn->mtu = hdev->sco_mtu;
+        else
+                conn->mtu = 60;
+
+        BT_DBG("hcon %p conn %p", hcon, conn);
+        return conn;
+}
+
+static inline struct sock *sco_chan_get(struct sco_conn *conn)
+{
+        struct sock *sk = NULL;
+        sco_conn_lock(conn);
+        sk = conn->sk;
+        sco_conn_unlock(conn);
+        return sk;
+}
+
+static int sco_conn_del(struct hci_conn *hcon, int err)
+{
+        struct sco_conn *conn;
+        struct sock *sk;
+
+        if (!(conn = hcon->sco_data)) 
+                return 0;
+
+        BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+
+        /* Kill socket */
+        if ((sk = sco_chan_get(conn))) {
+                bh_lock_sock(sk);
+                sco_sock_clear_timer(sk);
+                sco_chan_del(sk, err);
+                bh_unlock_sock(sk);
+                sco_sock_kill(sk);
+        }
+
+        hcon->sco_data = NULL;
+        kfree(conn);
+        return 0;
+}
+
+static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
+{
+        int err = 0;
+
+        sco_conn_lock(conn);
+        if (conn->sk) {
+                err = -EBUSY;
+        } else {
+                __sco_chan_add(conn, sk, parent);
+        }
+        sco_conn_unlock(conn);
+        return err;
+}
+
+static int sco_connect(struct sock *sk)
+{
+        bdaddr_t *src = &bt_sk(sk)->src;
+        bdaddr_t *dst = &bt_sk(sk)->dst;
+        struct sco_conn *conn;
+        struct hci_conn *hcon;
+        struct hci_dev  *hdev;
+        int err = 0;
+
+        BT_DBG("%s -> %s", batostr(src), batostr(dst));
+
+        if (!(hdev = hci_get_route(dst, src)))
+                return -EHOSTUNREACH;
+
+        hci_dev_lock_bh(hdev);
+
+        err = -ENOMEM;
+
+        hcon = hci_connect(hdev, SCO_LINK, dst);
+        if (!hcon)
+                goto done;
+
+        conn = sco_conn_add(hcon, 0);
+        if (!conn) {
+                hci_conn_put(hcon);
+                goto done;
+        }
+
+        /* Update source addr of the socket */
+        bacpy(src, conn->src);
+
+        err = sco_chan_add(conn, sk, NULL);
+        if (err)
+                goto done;
+
+        if (hcon->state == BT_CONNECTED) {
+                sco_sock_clear_timer(sk);
+                sk->sk_state = BT_CONNECTED;
+        } else {
+                sk->sk_state = BT_CONNECT;
+                sco_sock_set_timer(sk, sk->sk_sndtimeo);
+        }
+done:
+        hci_dev_unlock_bh(hdev);
+        hci_dev_put(hdev);
+        return err;
+}
+
+static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+{
+        struct sco_conn *conn = sco_pi(sk)->conn;
+        struct sk_buff *skb;
+        int err, count;
+
+        /* Check outgoing MTU */
+        if (len > conn->mtu)
+                return -EINVAL;
+
+        BT_DBG("sk %p len %d", sk, len);
+
+        count = min_t(unsigned int, conn->mtu, len);
+        if (!(skb = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
+                return err;
+
+        if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
+                err = -EFAULT;
+                goto fail;
+        }
+
+        if ((err = hci_send_sco(conn->hcon, skb)) < 0)
+                goto fail;
+
+        return count;
+
+fail:
+        kfree_skb(skb);
+        return err;
+}
+
+static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
+{
+        struct sock *sk = sco_chan_get(conn);
+
+        if (!sk)
+                goto drop;
+
+        BT_DBG("sk %p len %d", sk, skb->len);
+
+        if (sk->sk_state != BT_CONNECTED)
+                goto drop;
+
+        if (!sock_queue_rcv_skb(sk, skb))
+                return;
+
+drop:
+        kfree_skb(skb);
+        return;
+}
+
+/* -------- Socket interface ---------- */
+static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+
+        sk_for_each(sk, node, &sco_sk_list.head)
+                if (!bacmp(&bt_sk(sk)->src, ba))
+                        goto found;
+        sk = NULL;
+found:
+        return sk;
+}
+
+/* Find socket listening on source bdaddr.
+ * Returns closest match.
+ */
+static struct sock *sco_get_sock_listen(bdaddr_t *src)
+{
+        struct sock *sk = NULL, *sk1 = NULL;
+        struct hlist_node *node;
+
+        read_lock(&sco_sk_list.lock);
+
+        sk_for_each(sk, node, &sco_sk_list.head) {
+                if (sk->sk_state != BT_LISTEN)
+                        continue;
+
+                /* Exact match. */
+                if (!bacmp(&bt_sk(sk)->src, src))
+                        break;
+
+                /* Closest match */
+                if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
+                        sk1 = sk;
+        }
+
+        read_unlock(&sco_sk_list.lock);
+
+        return node ? sk : sk1;
+}
+
+static void sco_sock_destruct(struct sock *sk)
+{
+        BT_DBG("sk %p", sk);
+
+        skb_queue_purge(&sk->sk_receive_queue);
+        skb_queue_purge(&sk->sk_write_queue);
+}
+
+static void sco_sock_cleanup_listen(struct sock *parent)
+{
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL))) {
+                sco_sock_close(sk);
+                sco_sock_kill(sk);
+        }
+
+        parent->sk_state  = BT_CLOSED;
+        sock_set_flag(parent, SOCK_ZAPPED);
+}
+
+/* Kill socket (only if zapped and orphan)
+ * Must be called on unlocked socket.
+ */
+static void sco_sock_kill(struct sock *sk)
+{
+        if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+                return;
+
+        BT_DBG("sk %p state %d", sk, sk->sk_state);
+
+        /* Kill poor orphan */
+        bt_sock_unlink(&sco_sk_list, sk);
+        sock_set_flag(sk, SOCK_DEAD);
+        sock_put(sk);
+}
+
+/* Close socket.
+ * Must be called on unlocked socket.
+ */
+static void sco_sock_close(struct sock *sk)
+{
+        struct sco_conn *conn;
+
+        sco_sock_clear_timer(sk);
+
+        lock_sock(sk);
+
+        conn = sco_pi(sk)->conn;
+
+        BT_DBG("sk %p state %d conn %p socket %p", sk, sk->sk_state, conn, sk->sk_socket);
+
+        switch (sk->sk_state) {
+        case BT_LISTEN:
+                sco_sock_cleanup_listen(sk);
+                break;
+
+        case BT_CONNECTED:
+        case BT_CONFIG:
+        case BT_CONNECT:
+        case BT_DISCONN:
+                sco_chan_del(sk, ECONNRESET);
+                break;
+
+        default:
+                sock_set_flag(sk, SOCK_ZAPPED);
+                break;
+        };
+
+        release_sock(sk);
+
+        sco_sock_kill(sk);
+}
+
+static void sco_sock_init(struct sock *sk, struct sock *parent)
+{
+        BT_DBG("sk %p", sk);
+
+        if (parent) 
+                sk->sk_type = parent->sk_type;
+}
+
+static struct proto sco_proto = {
+        .name           = "SCO",
+        .owner          = THIS_MODULE,
+        .obj_size       = sizeof(struct sco_pinfo)
+};
+
+static struct sock *sco_sock_alloc(struct socket *sock, int proto, int prio)
+{
+        struct sock *sk;
+
+        sk = sk_alloc(PF_BLUETOOTH, prio, &sco_proto, 1);
+        if (!sk)
+                return NULL;
+
+        sock_init_data(sock, sk);
+        INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
+
+        sk->sk_destruct = sco_sock_destruct;
+        sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
+
+        sock_reset_flag(sk, SOCK_ZAPPED);
+
+        sk->sk_protocol = proto;
+        sk->sk_state    = BT_OPEN;
+
+        sco_sock_init_timer(sk);
+
+        bt_sock_link(&sco_sk_list, sk);
+        return sk;
+}
+
+static int sco_sock_create(struct socket *sock, int protocol)
+{
+        struct sock *sk;
+
+        BT_DBG("sock %p", sock);
+
+        sock->state = SS_UNCONNECTED;
+
+        if (sock->type != SOCK_SEQPACKET)
+                return -ESOCKTNOSUPPORT;
+
+        sock->ops = &sco_sock_ops;
+
+        if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL)))
+                return -ENOMEM;
+
+        sco_sock_init(sk, NULL);
+        return 0;
+}
+
+static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
+{
+        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+        struct sock *sk = sock->sk;
+        bdaddr_t *src = &sa->sco_bdaddr;
+        int err = 0;
+
+        BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
+
+        if (!addr || addr->sa_family != AF_BLUETOOTH)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_OPEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        write_lock_bh(&sco_sk_list.lock);
+
+        if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
+                err = -EADDRINUSE;
+        } else {
+                /* Save source address */
+                bacpy(&bt_sk(sk)->src, &sa->sco_bdaddr);
+                sk->sk_state = BT_BOUND;
+        }
+
+        write_unlock_bh(&sco_sk_list.lock);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
+{
+        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+
+        BT_DBG("sk %p", sk);
+
+        if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
+                return -EINVAL;
+
+        if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
+                return -EBADFD;
+
+        if (sk->sk_type != SOCK_SEQPACKET)
+                return -EINVAL;
+
+        lock_sock(sk);
+
+        /* Set destination address and psm */
+        bacpy(&bt_sk(sk)->dst, &sa->sco_bdaddr);
+
+        if ((err = sco_connect(sk)))
+                goto done;
+
+        err = bt_sock_wait_state(sk, BT_CONNECTED, 
+                        sock_sndtimeo(sk, flags & O_NONBLOCK));
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_listen(struct socket *sock, int backlog)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p backlog %d", sk, backlog);
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        sk->sk_max_ack_backlog = backlog;
+        sk->sk_ack_backlog = 0;
+        sk->sk_state = BT_LISTEN;
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        struct sock *sk = sock->sk, *ch;
+        long timeo;
+        int err = 0;
+
+        lock_sock(sk);
+
+        if (sk->sk_state != BT_LISTEN) {
+                err = -EBADFD;
+                goto done;
+        }
+
+        timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
+
+        BT_DBG("sk %p timeo %ld", sk, timeo);
+
+        /* Wait for an incoming connection. (wake-one). */
+        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        while (!(ch = bt_accept_dequeue(sk, newsock))) {
+                set_current_state(TASK_INTERRUPTIBLE);
+                if (!timeo) {
+                        err = -EAGAIN;
+                        break;
+                }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        err = sock_intr_errno(timeo);
+                        break;
+                }
+        }
+        set_current_state(TASK_RUNNING);
+        remove_wait_queue(sk->sk_sleep, &wait);
+
+        if (err)
+                goto done;
+
+        newsock->state = SS_CONNECTED;
+
+        BT_DBG("new socket %p", ch);
+
+done:
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
+{
+        struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
+        struct sock *sk = sock->sk;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        addr->sa_family = AF_BLUETOOTH;
+        *len = sizeof(struct sockaddr_sco);
+
+        if (peer)
+                bacpy(&sa->sco_bdaddr, &bt_sk(sk)->dst);
+        else
+                bacpy(&sa->sco_bdaddr, &bt_sk(sk)->src);
+
+        return 0;
+}
+
+static int sco_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 
+                            struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (sk->sk_err)
+                return sock_error(sk);
+
+        if (msg->msg_flags & MSG_OOB)
+                return -EOPNOTSUPP;
+
+        lock_sock(sk);
+
+        if (sk->sk_state == BT_CONNECTED)
+                err = sco_send_frame(sk, msg, len);
+        else
+                err = -ENOTCONN;
+
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sk %p", sk);
+
+        lock_sock(sk);
+
+        switch (optname) {
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct sco_options opts;
+        struct sco_conninfo cinfo;
+        int len, err = 0; 
+
+        BT_DBG("sk %p", sk);
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case SCO_OPTIONS:
+                if (sk->sk_state != BT_CONNECTED) {
+                        err = -ENOTCONN;
+                        break;
+                }
+
+                opts.mtu = sco_pi(sk)->conn->mtu;
+
+                BT_DBG("mtu %d", opts.mtu);
+
+                len = min_t(unsigned int, len, sizeof(opts));
+                if (copy_to_user(optval, (char *)&opts, len))
+                        err = -EFAULT;
+
+                break;
+
+        case SCO_CONNINFO:
+                if (sk->sk_state != BT_CONNECTED) {
+                        err = -ENOTCONN;
+                        break;
+                }
+
+                cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
+                memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
+
+                len = min_t(unsigned int, len, sizeof(cinfo));
+                if (copy_to_user(optval, (char *)&cinfo, len))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+        return err;
+}
+
+static int sco_sock_release(struct socket *sock)
+{
+        struct sock *sk = sock->sk;
+        int err = 0;
+
+        BT_DBG("sock %p, sk %p", sock, sk);
+
+        if (!sk)
+                return 0;
+
+        sco_sock_close(sk);
+
+        if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
+                lock_sock(sk);
+                err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
+                release_sock(sk);
+        }
+
+        sock_orphan(sk);
+        sco_sock_kill(sk);
+        return err;
+}
+
+static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
+{
+        BT_DBG("conn %p", conn);
+
+        sco_pi(sk)->conn = conn;
+        conn->sk = sk;
+
+        if (parent)
+                bt_accept_enqueue(parent, sk);
+}
+
+/* Delete channel. 
+ * Must be called on the locked socket. */
+static void sco_chan_del(struct sock *sk, int err)
+{
+        struct sco_conn *conn;
+
+        conn = sco_pi(sk)->conn;
+
+        BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
+
+        if (conn) { 
+                sco_conn_lock(conn);
+                conn->sk = NULL;
+                sco_pi(sk)->conn = NULL;
+                sco_conn_unlock(conn);
+                hci_conn_put(conn->hcon);
+        }
+
+        sk->sk_state = BT_CLOSED;
+        sk->sk_err   = err;
+        sk->sk_state_change(sk);
+
+        sock_set_flag(sk, SOCK_ZAPPED);
+}
+
+static void sco_conn_ready(struct sco_conn *conn)
+{
+        struct sock *parent, *sk;
+
+        BT_DBG("conn %p", conn);
+
+        sco_conn_lock(conn);
+
+        if ((sk = conn->sk)) {
+                sco_sock_clear_timer(sk);
+                bh_lock_sock(sk);
+                sk->sk_state = BT_CONNECTED;
+                sk->sk_state_change(sk);
+                bh_unlock_sock(sk);
+        } else {
+                parent = sco_get_sock_listen(conn->src);
+                if (!parent)
+                        goto done;
+
+                bh_lock_sock(parent);
+
+                sk = sco_sock_alloc(NULL, BTPROTO_SCO, GFP_ATOMIC);
+                if (!sk) {
+                        bh_unlock_sock(parent);
+                        goto done;
+                }
+
+                sco_sock_init(sk, parent);
+
+                bacpy(&bt_sk(sk)->src, conn->src);
+                bacpy(&bt_sk(sk)->dst, conn->dst);
+
+                hci_conn_hold(conn->hcon);
+                __sco_chan_add(conn, sk, parent);
+
+                sk->sk_state = BT_CONNECTED;
+
+                /* Wake up parent */
+                parent->sk_data_ready(parent, 1);
+
+                bh_unlock_sock(parent);
+        }
+
+done:
+        sco_conn_unlock(conn);
+}
+
+/* ----- SCO interface with lower layer (HCI) ----- */
+static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
+{
+        BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
+
+        /* Always accept connection */
+        return HCI_LM_ACCEPT;
+}
+
+static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
+{
+        BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
+
+        if (hcon->type != SCO_LINK)
+                return 0;
+
+        if (!status) {
+                struct sco_conn *conn;
+
+                conn = sco_conn_add(hcon, status);
+                if (conn)
+                        sco_conn_ready(conn);
+        } else 
+                sco_conn_del(hcon, bt_err(status));
+
+        return 0;
+}
+
+static int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
+{
+        BT_DBG("hcon %p reason %d", hcon, reason);
+
+        if (hcon->type != SCO_LINK)
+                return 0;
+
+        sco_conn_del(hcon, bt_err(reason));
+        return 0;
+}
+
+static int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
+{
+        struct sco_conn *conn = hcon->sco_data;
+
+        if (!conn)
+                goto drop;
+
+        BT_DBG("conn %p len %d", conn, skb->len);
+
+        if (skb->len) {
+                sco_recv_frame(conn, skb);
+                return 0;
+        }
+
+drop:
+        kfree_skb(skb); 
+        return 0;
+}
+
+/* ---- Proc fs support ---- */
+#ifdef CONFIG_PROC_FS
+static void *sco_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        loff_t l = *pos;
+
+        read_lock_bh(&sco_sk_list.lock);
+
+        sk_for_each(sk, node, &sco_sk_list.head)
+                if (!l--)
+                        goto found;
+        sk = NULL;
+found:
+        return sk;
+}
+
+static void *sco_seq_next(struct seq_file *seq, void *e, loff_t *pos)
+{
+        struct sock *sk = e;
+        (*pos)++;
+        return sk_next(sk);
+}
+
+static void sco_seq_stop(struct seq_file *seq, void *e)
+{
+        read_unlock_bh(&sco_sk_list.lock);
+}
+
+static int  sco_seq_show(struct seq_file *seq, void *e)
+{
+        struct sock *sk = e;
+        seq_printf(seq, "%s %s %d\n",
+                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst), sk->sk_state);
+        return 0;
+}
+
+static struct seq_operations sco_seq_ops = {
+        .start  = sco_seq_start,
+        .next   = sco_seq_next,
+        .stop   = sco_seq_stop,
+        .show   = sco_seq_show 
+};
+
+static int sco_seq_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &sco_seq_ops);
+}
+
+static struct file_operations sco_seq_fops = {
+        .owner          = THIS_MODULE,
+        .open           = sco_seq_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
+
+static int __init sco_proc_init(void)
+{
+        struct proc_dir_entry *p = create_proc_entry("sco", S_IRUGO, proc_bt);
+        if (!p)
+                return -ENOMEM;
+        p->owner     = THIS_MODULE;
+        p->proc_fops = &sco_seq_fops;
+        return 0;
+}
+
+static void __exit sco_proc_cleanup(void)
+{
+        remove_proc_entry("sco", proc_bt);
+}
+
+#else /* CONFIG_PROC_FS */
+
+static int __init sco_proc_init(void)
+{
+        return 0;
+}
+
+static void __exit sco_proc_cleanup(void)
+{
+        return;
+}
+#endif /* CONFIG_PROC_FS */
+
+static struct proto_ops sco_sock_ops = {
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = sco_sock_release,
+        .bind           = sco_sock_bind,
+        .connect        = sco_sock_connect,
+        .listen         = sco_sock_listen,
+        .accept         = sco_sock_accept,
+        .getname        = sco_sock_getname,
+        .sendmsg        = sco_sock_sendmsg,
+        .recvmsg        = bt_sock_recvmsg,
+        .poll           = bt_sock_poll,
+        .ioctl          = sock_no_ioctl,
+        .mmap           = sock_no_mmap,
+        .socketpair     = sock_no_socketpair,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sco_sock_setsockopt,
+        .getsockopt     = sco_sock_getsockopt
+};
+
+static struct net_proto_family sco_sock_family_ops = {
+        .family = PF_BLUETOOTH,
+        .owner  = THIS_MODULE,
+        .create = sco_sock_create,
+};
+
+static struct hci_proto sco_hci_proto = {
+        .name           = "SCO",
+        .id             = HCI_PROTO_SCO,
+        .connect_ind    = sco_connect_ind,
+        .connect_cfm    = sco_connect_cfm,
+        .disconn_ind    = sco_disconn_ind,
+        .recv_scodata   = sco_recv_scodata
+};
+
+static int __init sco_init(void)
+{
+        int err;
+
+        err = proto_register(&sco_proto, 0);
+        if (err < 0)
+                return err;
+
+        err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
+        if (err < 0) {
+                BT_ERR("SCO socket registration failed");
+                goto error;
+        }
+
+        err = hci_register_proto(&sco_hci_proto);
+        if (err < 0) {
+                BT_ERR("SCO protocol registration failed");
+                bt_sock_unregister(BTPROTO_SCO);
+                goto error;
+        }
+
+        sco_proc_init();
+
+        BT_INFO("SCO (Voice Link) ver %s", VERSION);
+        BT_INFO("SCO socket layer initialized");
+
+        return 0;
+
+error:
+        proto_unregister(&sco_proto);
+        return err;
+}
+
+static void __exit sco_exit(void)
+{
+        sco_proc_cleanup();
+
+        if (bt_sock_unregister(BTPROTO_SCO) < 0)
+                BT_ERR("SCO socket unregistration failed");
+
+        if (hci_unregister_proto(&sco_hci_proto) < 0)
+                BT_ERR("SCO protocol unregistration failed");
+
+        proto_unregister(&sco_proto);
+}
+
+module_init(sco_init);
+module_exit(sco_exit);
+
+MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("bt-proto-2");