13 files changed, 188 insertions, 68 deletions

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 8cfb5a849841..087cc51f5927 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -45,7 +45,7 @@
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
-static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
 static DEFINE_RWLOCK(bt_proto_lock);
 
 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
@@ -86,7 +86,7 @@ static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
 
-int bt_sock_register(int proto, struct net_proto_family *ops)
+int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
         int err = 0;
 
@@ -126,7 +126,8 @@ int bt_sock_unregister(int proto)
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
-static int bt_sock_create(struct net *net, struct socket *sock, int proto)
+static int bt_sock_create(struct net *net, struct socket *sock, int proto,
+                          int kern)
 {
         int err;
 
@@ -144,7 +145,7 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto)
         read_lock(&bt_proto_lock);
 
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
-                err = bt_proto[proto]->create(net, sock, proto);
+                err = bt_proto[proto]->create(net, sock, proto, kern);
                 bt_sock_reclassify_lock(sock, proto);
                 module_put(bt_proto[proto]->owner);
         }
@@ -257,7 +258,7 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
         if (err == 0)
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
         skb_free_datagram(sk, skb);
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 9ac0497decb8..ef09c7b3a858 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -230,7 +230,6 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
 
         switch (cmd) {
         case BNEP_CMD_NOT_UNDERSTOOD:
-        case BNEP_SETUP_CONN_REQ:
         case BNEP_SETUP_CONN_RSP:
         case BNEP_FILTER_NET_TYPE_RSP:
         case BNEP_FILTER_MULTI_ADDR_RSP:
@@ -245,6 +244,10 @@ static int bnep_rx_control(struct bnep_session *s, void *data, int len)
                 err = bnep_ctrl_set_mcfilter(s, data, len);
                 break;
 
+        case BNEP_SETUP_CONN_REQ:
+                err = bnep_send_rsp(s, BNEP_SETUP_CONN_RSP, BNEP_CONN_NOT_ALLOWED);
+                break;
+
         default: {
                         u8 pkt[3];
                         pkt[0] = BNEP_CONTROL;
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index e857628b0b27..2ff6ac7b2ed4 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -195,7 +195,8 @@ static struct proto bnep_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
+static int bnep_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -222,7 +223,7 @@ static int bnep_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family bnep_sock_family_ops = {
+static const struct net_proto_family bnep_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = bnep_sock_create
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 16b0fad74f6e..978cc3a718ad 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -190,7 +190,8 @@ static struct proto cmtp_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
+static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -217,7 +218,7 @@ static int cmtp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family cmtp_sock_family_ops = {
+static const struct net_proto_family cmtp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = cmtp_sock_create
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e1da8f68759c..94ba34982021 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -193,8 +193,9 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         while ((skb = skb_dequeue(&hdev->driver_init))) {
                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
                 skb->dev = (void *) hdev;
+
                 skb_queue_tail(&hdev->cmd_q, skb);
-                hci_sched_cmd(hdev);
+                tasklet_schedule(&hdev->cmd_task);
         }
         skb_queue_purge(&hdev->driver_init);
 
@@ -987,6 +988,30 @@ int hci_resume_dev(struct hci_dev *hdev)
 }
 EXPORT_SYMBOL(hci_resume_dev);
 
+/* Receive frame from HCI drivers */
+int hci_recv_frame(struct sk_buff *skb)
+{
+        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
+        if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
+                                && !test_bit(HCI_INIT, &hdev->flags))) {
+                kfree_skb(skb);
+                return -ENXIO;
+        }
+
+        /* Incomming skb */
+        bt_cb(skb)->incoming = 1;
+
+        /* Time stamp */
+        __net_timestamp(skb);
+
+        /* Queue frame for rx task */
+        skb_queue_tail(&hdev->rx_q, skb);
+        tasklet_schedule(&hdev->rx_task);
+
+        return 0;
+}
+EXPORT_SYMBOL(hci_recv_frame);
+
 /* Receive packet type fragment */
 #define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 2])
 
@@ -1193,8 +1218,9 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
 
         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
         skb->dev = (void *) hdev;
+
         skb_queue_tail(&hdev->cmd_q, skb);
-        hci_sched_cmd(hdev);
+        tasklet_schedule(&hdev->cmd_task);
 
         return 0;
 }
@@ -1271,7 +1297,8 @@ int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
                 spin_unlock_bh(&conn->data_q.lock);
         }
 
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
+
         return 0;
 }
 EXPORT_SYMBOL(hci_send_acl);
@@ -1298,8 +1325,10 @@ int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
 
         skb->dev = (void *) hdev;
         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
+
         skb_queue_tail(&conn->data_q, skb);
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
+
         return 0;
 }
 EXPORT_SYMBOL(hci_send_sco);
@@ -1612,7 +1641,7 @@ static void hci_cmd_task(unsigned long arg)
                         hdev->cmd_last_tx = jiffies;
                 } else {
                         skb_queue_head(&hdev->cmd_q, skb);
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
                 }
         }
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e99fe385fba2..28517bad796c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1320,7 +1320,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
         if (ev->ncmd) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
         }
 }
 
@@ -1386,7 +1386,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->ncmd) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
         }
 }
 
@@ -1454,7 +1454,7 @@ static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *s
                 }
         }
 
-        hci_sched_tx(hdev);
+        tasklet_schedule(&hdev->tx_task);
 
         tasklet_enable(&hdev->tx_task);
 }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 75302a986067..688cfebfbee0 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -414,6 +414,11 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 goto done;
         }
 
+        if (!test_bit(HCI_UP, &hdev->flags)) {
+                err = -ENETDOWN;
+                goto done;
+        }
+
         if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
                 goto done;
 
@@ -440,10 +445,10 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
                         skb_queue_tail(&hdev->raw_q, skb);
-                        hci_sched_tx(hdev);
+                        tasklet_schedule(&hdev->tx_task);
                 } else {
                         skb_queue_tail(&hdev->cmd_q, skb);
-                        hci_sched_cmd(hdev);
+                        tasklet_schedule(&hdev->cmd_task);
                 }
         } else {
                 if (!capable(CAP_NET_RAW)) {
@@ -452,7 +457,7 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 skb_queue_tail(&hdev->raw_q, skb);
-                hci_sched_tx(hdev);
+                tasklet_schedule(&hdev->tx_task);
         }
 
         err = len;
@@ -621,7 +626,8 @@ static struct proto hci_sk_proto = {
         .obj_size       = sizeof(struct hci_pinfo)
 };
 
-static int hci_sock_create(struct net *net, struct socket *sock, int protocol)
+static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
+                           int kern)
 {
         struct sock *sk;
 
@@ -687,7 +693,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
         return NOTIFY_DONE;
 }
 
-static struct net_proto_family hci_sock_family_ops = {
+static const struct net_proto_family hci_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hci_sock_create,
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 49d8495d69be..569750010fd3 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -280,6 +280,13 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_queue_report(session, buf, rsize);
 }
 
+static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count)
+{
+        if (hidp_queue_report(hid->driver_data, data, count))
+                return -ENOMEM;
+        return count;
+}
+
 static void hidp_idle_timeout(unsigned long arg)
 {
         struct hidp_session *session = (struct hidp_session *) arg;
@@ -785,6 +792,8 @@ static int hidp_setup_hid(struct hidp_session *session,
         hid->dev.parent = hidp_get_device(session);
         hid->ll_driver = &hidp_hid_driver;
 
+        hid->hid_output_raw_report = hidp_output_raw_report;
+
         err = hid_add_device(hid);
         if (err < 0)
                 goto failed;
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 37c9d7d2e688..9cfef68b9fec 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -241,7 +241,8 @@ static struct proto hidp_proto = {
         .obj_size       = sizeof(struct bt_sock)
 };
 
-static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
+static int hidp_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
         struct sock *sk;
 
@@ -268,7 +269,7 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol)
         return 0;
 }
 
-static struct net_proto_family hidp_sock_family_ops = {
+static const struct net_proto_family hidp_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = hidp_sock_create
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 947f8bbb4bb3..5129b88c8e5b 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -54,6 +54,7 @@
 #define VERSION "2.14"
 
 static int enable_ertm = 0;
+static int max_transmit = L2CAP_DEFAULT_MAX_TX;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
@@ -373,6 +374,8 @@ static inline int l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
         else
                 control |= L2CAP_SUPER_RCV_READY;
 
+        control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
         return l2cap_send_sframe(pi, control);
 }
 
@@ -819,7 +822,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         return sk;
 }
 
-static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
+static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
+                             int kern)
 {
         struct sock *sk;
 
@@ -831,7 +835,7 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 return -EPERM;
 
         sock->ops = &l2cap_sock_ops;
@@ -1332,7 +1336,7 @@ static int l2cap_retransmit_frame(struct sock *sk, u8 tx_seq)
                 tx_skb = skb_clone(skb, GFP_ATOMIC);
                 bt_cb(skb)->retries++;
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                 | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
@@ -1361,8 +1365,8 @@ static int l2cap_ertm_send(struct sock *sk)
         if (pi->conn_state & L2CAP_CONN_WAIT_F)
                 return 0;
 
-        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))
-                        && !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
+        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
+               !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
                 tx_skb = skb_clone(skb, GFP_ATOMIC);
 
                 if (pi->remote_max_tx &&
@@ -1374,7 +1378,7 @@ static int l2cap_ertm_send(struct sock *sk)
                 bt_cb(skb)->retries++;
 
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-                control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+                control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                 | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
@@ -1603,8 +1607,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 return -EOPNOTSUPP;
 
         /* Check outgoing MTU */
-        if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC
-                        && len > pi->omtu)
+        if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC &&
+            len > pi->omtu)
                 return -EINVAL;
 
         lock_sock(sk);
@@ -2172,6 +2176,21 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
         *ptr += L2CAP_CONF_OPT_SIZE + len;
 }
 
+static inline void l2cap_ertm_init(struct sock *sk)
+{
+        l2cap_pi(sk)->expected_ack_seq = 0;
+        l2cap_pi(sk)->unacked_frames = 0;
+        l2cap_pi(sk)->buffer_seq = 0;
+        l2cap_pi(sk)->num_to_ack = 0;
+
+        setup_timer(&l2cap_pi(sk)->retrans_timer,
+                        l2cap_retrans_timeout, (unsigned long) sk);
+        setup_timer(&l2cap_pi(sk)->monitor_timer,
+                        l2cap_monitor_timeout, (unsigned long) sk);
+
+        __skb_queue_head_init(SREJ_QUEUE(sk));
+}
+
 static int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
 {
         u32 local_feat_mask = l2cap_feat_mask;
@@ -2235,7 +2254,7 @@ done:
         case L2CAP_MODE_ERTM:
                 rfc.mode            = L2CAP_MODE_ERTM;
                 rfc.txwin_size      = L2CAP_DEFAULT_TX_WINDOW;
-                rfc.max_transmit    = L2CAP_DEFAULT_MAX_TX;
+                rfc.max_transmit    = max_transmit;
                 rfc.retrans_timeout = 0;
                 rfc.monitor_timeout = 0;
                 rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
@@ -2755,22 +2774,18 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                         l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                 sk->sk_state = BT_CONNECTED;
-                l2cap_pi(sk)->next_tx_seq = 0;
-                l2cap_pi(sk)->expected_ack_seq = 0;
-                l2cap_pi(sk)->unacked_frames = 0;
-
-                setup_timer(&l2cap_pi(sk)->retrans_timer,
-                                l2cap_retrans_timeout, (unsigned long) sk);
-                setup_timer(&l2cap_pi(sk)->monitor_timer,
-                                l2cap_monitor_timeout, (unsigned long) sk);
 
+                l2cap_pi(sk)->next_tx_seq = 0;
+                l2cap_pi(sk)->expected_tx_seq = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
-                __skb_queue_head_init(SREJ_QUEUE(sk));
+                if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(sk);
+
                 l2cap_chan_ready(sk);
                 goto unlock;
         }
@@ -2844,16 +2859,17 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                                || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                         l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                 sk->sk_state = BT_CONNECTED;
+                l2cap_pi(sk)->next_tx_seq = 0;
                 l2cap_pi(sk)->expected_tx_seq = 0;
-                l2cap_pi(sk)->buffer_seq = 0;
-                l2cap_pi(sk)->num_to_ack = 0;
                 __skb_queue_head_init(TX_QUEUE(sk));
-                __skb_queue_head_init(SREJ_QUEUE(sk));
+                if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
+                        l2cap_ertm_init(sk);
+
                 l2cap_chan_ready(sk);
         }
 
@@ -2885,9 +2901,12 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
         sk->sk_shutdown = SHUTDOWN_MASK;
 
         skb_queue_purge(TX_QUEUE(sk));
-        skb_queue_purge(SREJ_QUEUE(sk));
-        del_timer(&l2cap_pi(sk)->retrans_timer);
-        del_timer(&l2cap_pi(sk)->monitor_timer);
+
+        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+                skb_queue_purge(SREJ_QUEUE(sk));
+                del_timer(&l2cap_pi(sk)->retrans_timer);
+                del_timer(&l2cap_pi(sk)->monitor_timer);
+        }
 
         l2cap_chan_del(sk, ECONNRESET);
         bh_unlock_sock(sk);
@@ -2912,9 +2931,12 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
                 return 0;
 
         skb_queue_purge(TX_QUEUE(sk));
-        skb_queue_purge(SREJ_QUEUE(sk));
-        del_timer(&l2cap_pi(sk)->retrans_timer);
-        del_timer(&l2cap_pi(sk)->monitor_timer);
+
+        if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+                skb_queue_purge(SREJ_QUEUE(sk));
+                del_timer(&l2cap_pi(sk)->retrans_timer);
+                del_timer(&l2cap_pi(sk)->monitor_timer);
+        }
 
         l2cap_chan_del(sk, 0);
         bh_unlock_sock(sk);
@@ -3279,12 +3301,16 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         u8 tx_seq = __get_txseq(rx_control);
+        u8 req_seq = __get_reqseq(rx_control);
         u16 tx_control = 0;
         u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
         int err = 0;
 
         BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
 
+        pi->expected_ack_seq = req_seq;
+        l2cap_drop_acked_frames(sk);
+
         if (tx_seq == pi->expected_tx_seq)
                 goto expected;
 
@@ -3339,6 +3365,16 @@ expected:
                 return 0;
         }
 
+        if (rx_control & L2CAP_CTRL_FINAL) {
+                if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                        pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                else {
+                        sk->sk_send_head = TX_QUEUE(sk)->next;
+                        pi->next_tx_seq = pi->expected_ack_seq;
+                        l2cap_ertm_send(sk);
+                }
+        }
+
         pi->buffer_seq = (pi->buffer_seq + 1) % 64;
 
         err = l2cap_sar_reassembly_sdu(sk, skb, rx_control);
@@ -3375,6 +3411,14 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
 
+                        if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                                pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                        else {
+                                sk->sk_send_head = TX_QUEUE(sk)->next;
+                                pi->next_tx_seq = pi->expected_ack_seq;
+                                l2cap_ertm_send(sk);
+                        }
+
                         if (!(pi->conn_state & L2CAP_CONN_WAIT_F))
                                 break;
 
@@ -3387,8 +3431,8 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                         pi->expected_ack_seq = tx_seq;
                         l2cap_drop_acked_frames(sk);
 
-                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
-                                        && (pi->unacked_frames > 0))
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                            (pi->unacked_frames > 0))
                                 __mod_retrans_timer();
 
                         l2cap_ertm_send(sk);
@@ -3402,10 +3446,24 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 pi->expected_ack_seq = __get_reqseq(rx_control);
                 l2cap_drop_acked_frames(sk);
 
-                sk->sk_send_head = TX_QUEUE(sk)->next;
-                pi->next_tx_seq = pi->expected_ack_seq;
+                if (rx_control & L2CAP_CTRL_FINAL) {
+                        if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                                pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+                        else {
+                                sk->sk_send_head = TX_QUEUE(sk)->next;
+                                pi->next_tx_seq = pi->expected_ack_seq;
+                                l2cap_ertm_send(sk);
+                        }
+                } else {
+                        sk->sk_send_head = TX_QUEUE(sk)->next;
+                        pi->next_tx_seq = pi->expected_ack_seq;
+                        l2cap_ertm_send(sk);
 
-                l2cap_ertm_send(sk);
+                        if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                                pi->srej_save_reqseq = tx_seq;
+                                pi->conn_state |= L2CAP_CONN_REJ_ACT;
+                        }
+                }
 
                 break;
 
@@ -3424,7 +3482,7 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
                 } else if (rx_control & L2CAP_CTRL_FINAL) {
                         if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
                                         pi->srej_save_reqseq == tx_seq)
-                                pi->srej_save_reqseq &= ~L2CAP_CONN_SREJ_ACT;
+                                pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
                         else
                                 l2cap_retransmit_frame(sk, tx_seq);
                 }
@@ -3924,7 +3982,7 @@ static const struct proto_ops l2cap_sock_ops = {
         .getsockopt     = l2cap_sock_getsockopt
 };
 
-static struct net_proto_family l2cap_sock_family_ops = {
+static const struct net_proto_family l2cap_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = l2cap_sock_create,
@@ -4003,6 +4061,9 @@ module_exit(l2cap_exit);
 module_param(enable_ertm, bool, 0644);
 MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
 
+module_param(max_transmit, uint, 0644);
+MODULE_PARM_DESC(max_transmit, "Max transmit value (default = 3)");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 25692bc0a342..fc5ee3296e22 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -51,6 +51,7 @@
 static int disable_cfc = 0;
 static int channel_mtu = -1;
 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
+static int l2cap_ertm = 0;
 
 static struct task_struct *rfcomm_thread;
 
@@ -702,6 +703,8 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         sk = sock->sk;
         lock_sock(sk);
         l2cap_pi(sk)->imtu = l2cap_mtu;
+        if (l2cap_ertm)
+                l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
         release_sock(sk);
 
         s = rfcomm_session_add(sock, BT_BOUND);
@@ -2185,6 +2188,9 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 module_param(l2cap_mtu, uint, 0644);
 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
 
+module_param(l2cap_ertm, bool, 0644);
+MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8a20aaf1f231..4b5968dda673 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -323,7 +323,8 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int
         return sk;
 }
 
-static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
+static int rfcomm_sock_create(struct net *net, struct socket *sock,
+                              int protocol, int kern)
 {
         struct sock *sk;
 
@@ -703,7 +704,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += chunk;
                 size   -= chunk;
 
-                sock_recv_timestamp(msg, sk, skb);
+                sock_recv_ts_and_drops(msg, sk, skb);
 
                 if (!(flags & MSG_PEEK)) {
                         atomic_sub(chunk, &sk->sk_rmem_alloc);
@@ -1101,7 +1102,7 @@ static const struct proto_ops rfcomm_sock_ops = {
         .mmap           = sock_no_mmap
 };
 
-static struct net_proto_family rfcomm_sock_family_ops = {
+static const struct net_proto_family rfcomm_sock_family_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .create         = rfcomm_sock_create
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 77f4153bdb5e..dd8f6ec57dce 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -430,7 +430,8 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, int pro
         return sk;
 }
 
-static int sco_sock_create(struct net *net, struct socket *sock, int protocol)
+static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
+                           int kern)
 {
         struct sock *sk;
 
@@ -993,7 +994,7 @@ static const struct proto_ops sco_sock_ops = {
         .getsockopt     = sco_sock_getsockopt
 };
 
-static struct net_proto_family sco_sock_family_ops = {
+static const struct net_proto_family sco_sock_family_ops = {
         .family = PF_BLUETOOTH,
         .owner  = THIS_MODULE,
         .create = sco_sock_create,