13 files changed, 800 insertions, 263 deletions

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 73492b91105a..8796ffa08b43 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -420,12 +420,18 @@ static int conn_send(struct l2cap_conn *conn,
         return 0;
 }
 
-static void get_dest_bdaddr(struct in6_addr *ip6_daddr,
-                            bdaddr_t *addr, u8 *addr_type)
+static u8 get_addr_type_from_eui64(u8 byte)
 {
-        u8 *eui64;
+        /* Is universal(0) or local(1) bit,  */
+        if (byte & 0x02)
+                return ADDR_LE_DEV_RANDOM;
 
-        eui64 = ip6_daddr->s6_addr + 8;
+        return ADDR_LE_DEV_PUBLIC;
+}
+
+static void copy_to_bdaddr(struct in6_addr *ip6_daddr, bdaddr_t *addr)
+{
+        u8 *eui64 = ip6_daddr->s6_addr + 8;
 
         addr->b[0] = eui64[7];
         addr->b[1] = eui64[6];
@@ -433,16 +439,19 @@ static void get_dest_bdaddr(struct in6_addr *ip6_daddr,
         addr->b[3] = eui64[2];
         addr->b[4] = eui64[1];
         addr->b[5] = eui64[0];
+}
 
-        addr->b[5] ^= 2;
+static void convert_dest_bdaddr(struct in6_addr *ip6_daddr,
+                                bdaddr_t *addr, u8 *addr_type)
+{
+        copy_to_bdaddr(ip6_daddr, addr);
 
-        /* Set universal/local bit to 0 */
-        if (addr->b[5] & 1) {
-                addr->b[5] &= ~1;
-                *addr_type = ADDR_LE_DEV_PUBLIC;
-        } else {
-                *addr_type = ADDR_LE_DEV_RANDOM;
-        }
+        /* We need to toggle the U/L bit that we got from IPv6 address
+         * so that we get the proper address and type of the BD address.
+         */
+        addr->b[5] ^= 0x02;
+
+        *addr_type = get_addr_type_from_eui64(addr->b[5]);
 }
 
 static int header_create(struct sk_buff *skb, struct net_device *netdev,
@@ -473,9 +482,11 @@ static int header_create(struct sk_buff *skb, struct net_device *netdev,
                 /* Get destination BT device from skb.
                  * If there is no such peer then discard the packet.
                  */
-                get_dest_bdaddr(&hdr->daddr, &addr, &addr_type);
+                convert_dest_bdaddr(&hdr->daddr, &addr, &addr_type);
 
-                BT_DBG("dest addr %pMR type %d", &addr, addr_type);
+                BT_DBG("dest addr %pMR type %s IP %pI6c", &addr,
+                       addr_type == ADDR_LE_DEV_PUBLIC ? "PUBLIC" : "RANDOM",
+                       &hdr->daddr);
 
                 read_lock_irqsave(&devices_lock, flags);
                 peer = peer_lookup_ba(dev, &addr, addr_type);
@@ -556,7 +567,7 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
         } else {
                 unsigned long flags;
 
-                get_dest_bdaddr(&lowpan_cb(skb)->addr, &addr, &addr_type);
+                convert_dest_bdaddr(&lowpan_cb(skb)->addr, &addr, &addr_type);
                 eui64_addr = lowpan_cb(skb)->addr.s6_addr + 8;
                 dev = lowpan_dev(netdev);
 
@@ -564,8 +575,10 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
                 peer = peer_lookup_ba(dev, &addr, addr_type);
                 read_unlock_irqrestore(&devices_lock, flags);
 
-                BT_DBG("xmit from %s to %pMR (%pI6c) peer %p", netdev->name,
-                       &addr, &lowpan_cb(skb)->addr, peer);
+                BT_DBG("xmit %s to %pMR type %s IP %pI6c peer %p",
+                       netdev->name, &addr,
+                       addr_type == ADDR_LE_DEV_PUBLIC ? "PUBLIC" : "RANDOM",
+                       &lowpan_cb(skb)->addr, peer);
 
                 if (peer && peer->conn)
                         err = send_pkt(peer->conn, netdev->dev_addr,
@@ -620,13 +633,13 @@ static void set_addr(u8 *eui, u8 *addr, u8 addr_type)
         eui[6] = addr[1];
         eui[7] = addr[0];
 
-        eui[0] ^= 2;
-
-        /* Universal/local bit set, RFC 4291 */
+        /* Universal/local bit set, BT 6lowpan draft ch. 3.2.1 */
         if (addr_type == ADDR_LE_DEV_PUBLIC)
-                eui[0] |= 1;
+                eui[0] &= ~0x02;
         else
-                eui[0] &= ~1;
+                eui[0] |= 0x02;
+
+        BT_DBG("type %d addr %*phC", addr_type, 8, eui);
 }
 
 static void set_dev_addr(struct net_device *netdev, bdaddr_t *addr,
@@ -634,7 +647,6 @@ static void set_dev_addr(struct net_device *netdev, bdaddr_t *addr,
 {
         netdev->addr_assign_type = NET_ADDR_PERM;
         set_addr(netdev->dev_addr, addr->b, addr_type);
-        netdev->dev_addr[0] ^= 2;
 }
 
 static void ifup(struct net_device *netdev)
@@ -684,13 +696,6 @@ static int add_peer_conn(struct l2cap_conn *conn, struct lowpan_dev *dev)
 
         memcpy(&peer->eui64_addr, (u8 *)&peer->peer_addr.s6_addr + 8,
                EUI64_ADDR_LEN);
-        peer->eui64_addr[0] ^= 2; /* second bit-flip (Universe/Local)
-                                   * is done according RFC2464
-                                   */
-
-        raw_dump_inline(__func__, "peer IPv6 address",
-                        (unsigned char *)&peer->peer_addr, 16);
-        raw_dump_inline(__func__, "peer EUI64 address", peer->eui64_addr, 8);
 
         write_lock_irqsave(&devices_lock, flags);
         INIT_LIST_HEAD(&peer->list);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 521fd4f3985e..8671bc79a35b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -28,6 +28,7 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
 
 #include "smp.h"
 #include "a2mp.h"
@@ -367,9 +368,23 @@ static void le_conn_timeout(struct work_struct *work)
 {
         struct hci_conn *conn = container_of(work, struct hci_conn,
                                              le_conn_timeout.work);
+        struct hci_dev *hdev = conn->hdev;
 
         BT_DBG("");
 
+        /* We could end up here due to having done directed advertising,
+         * so clean up the state if necessary. This should however only
+         * happen with broken hardware or if low duty cycle was used
+         * (which doesn't have a timeout of its own).
+         */
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+                u8 enable = 0x00;
+                hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable),
+                             &enable);
+                hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT);
+                return;
+        }
+
         hci_le_create_connection_cancel(conn);
 }
 
@@ -393,6 +408,8 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->io_capability = hdev->io_capability;
         conn->remote_auth = 0xff;
         conn->key_type = 0xff;
+        conn->tx_power = HCI_TX_POWER_INVALID;
+        conn->max_tx_power = HCI_TX_POWER_INVALID;
 
         set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
@@ -401,6 +418,10 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         case ACL_LINK:
                 conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
                 break;
+        case LE_LINK:
+                /* conn->src should reflect the local identity address */
+                hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+                break;
         case SCO_LINK:
                 if (lmp_esco_capable(hdev))
                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
@@ -545,6 +566,11 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status)
          * favor of connection establishment, we should restart it.
          */
         hci_update_background_scan(hdev);
+
+        /* Re-enable advertising in case this was a failed connection
+         * attempt as a peripheral.
+         */
+        mgmt_reenable_advertising(hdev);
 }
 
 static void create_le_conn_complete(struct hci_dev *hdev, u8 status)
@@ -605,6 +631,45 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         conn->state = BT_CONNECT;
 }
 
+static void hci_req_directed_advertising(struct hci_request *req,
+                                         struct hci_conn *conn)
+{
+        struct hci_dev *hdev = req->hdev;
+        struct hci_cp_le_set_adv_param cp;
+        u8 own_addr_type;
+        u8 enable;
+
+        enable = 0x00;
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+
+        /* Clear the HCI_ADVERTISING bit temporarily so that the
+         * hci_update_random_address knows that it's safe to go ahead
+         * and write a new random address. The flag will be set back on
+         * as soon as the SET_ADV_ENABLE HCI command completes.
+         */
+        clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+
+        /* Set require_privacy to false so that the remote device has a
+         * chance of identifying us.
+         */
+        if (hci_update_random_address(req, false, &own_addr_type) < 0)
+                return;
+
+        memset(&cp, 0, sizeof(cp));
+        cp.type = LE_ADV_DIRECT_IND;
+        cp.own_address_type = own_addr_type;
+        cp.direct_addr_type = conn->dst_type;
+        bacpy(&cp.direct_addr, &conn->dst);
+        cp.channel_map = hdev->le_adv_channel_map;
+
+        hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
+
+        enable = 0x01;
+        hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
+
+        conn->state = BT_CONNECT;
+}
+
 struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                                 u8 dst_type, u8 sec_level, u8 auth_type)
 {
@@ -614,9 +679,6 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
         struct hci_request req;
         int err;
 
-        if (test_bit(HCI_ADVERTISING, &hdev->flags))
-                return ERR_PTR(-ENOTSUPP);
-
         /* Some devices send ATT messages as soon as the physical link is
          * established. To be able to handle these ATT messages, the user-
          * space first establishes the connection and then starts the pairing
@@ -664,13 +726,20 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                 return ERR_PTR(-ENOMEM);
 
         conn->dst_type = dst_type;
-
-        conn->out = true;
-        conn->link_mode |= HCI_LM_MASTER;
         conn->sec_level = BT_SECURITY_LOW;
         conn->pending_sec_level = sec_level;
         conn->auth_type = auth_type;
 
+        hci_req_init(&req, hdev);
+
+        if (test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
+                hci_req_directed_advertising(&req, conn);
+                goto create_conn;
+        }
+
+        conn->out = true;
+        conn->link_mode |= HCI_LM_MASTER;
+
         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
         if (params) {
                 conn->le_conn_min_interval = params->conn_min_interval;
@@ -680,8 +749,6 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
         }
 
-        hci_req_init(&req, hdev);
-
         /* If controller is scanning, we stop it since some controllers are
          * not able to scan and connect at the same time. Also set the
          * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
@@ -695,6 +762,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 
         hci_req_add_le_create_conn(&req, conn);
 
+create_conn:
         err = hci_req_run(&req, create_le_conn_complete);
         if (err) {
                 hci_conn_del(conn);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1c6ffaa8902f..0a43cce9a914 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -34,6 +34,7 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
 
 #include "smp.h"
 
@@ -579,6 +580,62 @@ static int sniff_max_interval_get(void *data, u64 *val)
 DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
                         sniff_max_interval_set, "%llu\n");
 
+static int conn_info_min_age_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        if (val == 0 || val > hdev->conn_info_max_age)
+                return -EINVAL;
+
+        hci_dev_lock(hdev);
+        hdev->conn_info_min_age = val;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int conn_info_min_age_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock(hdev);
+        *val = hdev->conn_info_min_age;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(conn_info_min_age_fops, conn_info_min_age_get,
+                        conn_info_min_age_set, "%llu\n");
+
+static int conn_info_max_age_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+
+        if (val == 0 || val < hdev->conn_info_min_age)
+                return -EINVAL;
+
+        hci_dev_lock(hdev);
+        hdev->conn_info_max_age = val;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+static int conn_info_max_age_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+
+        hci_dev_lock(hdev);
+        *val = hdev->conn_info_max_age;
+        hci_dev_unlock(hdev);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(conn_info_max_age_fops, conn_info_max_age_get,
+                        conn_info_max_age_set, "%llu\n");
+
 static int identity_show(struct seq_file *f, void *p)
 {
         struct hci_dev *hdev = f->private;
@@ -955,14 +1012,9 @@ static ssize_t le_auto_conn_write(struct file *file, const char __user *data,
         if (count < 3)
                 return -EINVAL;
 
-        buf = kzalloc(count, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        if (copy_from_user(buf, data, count)) {
-                err = -EFAULT;
-                goto done;
-        }
+        buf = memdup_user(data, count);
+        if (IS_ERR(buf))
+                return PTR_ERR(buf);
 
         if (memcmp(buf, "add", 3) == 0) {
                 n = sscanf(&buf[4], "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu %hhu",
@@ -1759,6 +1811,11 @@ static int __hci_init(struct hci_dev *hdev)
                             &blacklist_fops);
         debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
 
+        debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
+                            &conn_info_min_age_fops);
+        debugfs_create_file("conn_info_max_age", 0644, hdev->debugfs, hdev,
+                            &conn_info_max_age_fops);
+
         if (lmp_bredr_capable(hdev)) {
                 debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
                                     hdev, &inquiry_cache_fops);
@@ -1828,6 +1885,9 @@ static int __hci_init(struct hci_dev *hdev)
                                     &lowpan_debugfs_fops);
                 debugfs_create_file("le_auto_conn", 0644, hdev->debugfs, hdev,
                                     &le_auto_conn_fops);
+                debugfs_create_u16("discov_interleaved_timeout", 0644,
+                                   hdev->debugfs,
+                                   &hdev->discov_interleaved_timeout);
         }
 
         return 0;
@@ -2033,12 +2093,11 @@ bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 
         hci_remove_remote_oob_data(hdev, &data->bdaddr);
 
-        if (ssp)
-                *ssp = data->ssp_mode;
+        *ssp = data->ssp_mode;
 
         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
         if (ie) {
-                if (ie->data.ssp_mode && ssp)
+                if (ie->data.ssp_mode)
                         *ssp = true;
 
                 if (ie->name_state == NAME_NEEDED &&
@@ -3791,6 +3850,9 @@ struct hci_dev *hci_alloc_dev(void)
         hdev->le_conn_max_interval = 0x0038;
 
         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
+        hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
+        hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
+        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
 
         mutex_init(&hdev->lock);
         mutex_init(&hdev->req_lock);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 682f33a38366..21e5913d12e0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -991,10 +991,25 @@ static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        if (status)
+                return;
+
         hci_dev_lock(hdev);
 
-        if (!status)
-                mgmt_advertising(hdev, *sent);
+        /* If we're doing connection initation as peripheral. Set a
+         * timeout in case something goes wrong.
+         */
+        if (*sent) {
+                struct hci_conn *conn;
+
+                conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
+                if (conn)
+                        queue_delayed_work(hdev->workqueue,
+                                           &conn->le_conn_timeout,
+                                           HCI_LE_CONN_TIMEOUT);
+        }
+
+        mgmt_advertising(hdev, *sent);
 
         hci_dev_unlock(hdev);
 }
@@ -1018,6 +1033,33 @@ static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
         hci_dev_unlock(hdev);
 }
 
+static bool has_pending_adv_report(struct hci_dev *hdev)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        return bacmp(&d->last_adv_addr, BDADDR_ANY);
+}
+
+static void clear_pending_adv_report(struct hci_dev *hdev)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        bacpy(&d->last_adv_addr, BDADDR_ANY);
+        d->last_adv_data_len = 0;
+}
+
+static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                     u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
+{
+        struct discovery_state *d = &hdev->discovery;
+
+        bacpy(&d->last_adv_addr, bdaddr);
+        d->last_adv_addr_type = bdaddr_type;
+        d->last_adv_rssi = rssi;
+        memcpy(d->last_adv_data, data, len);
+        d->last_adv_data_len = len;
+}
+
 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                                       struct sk_buff *skb)
 {
@@ -1036,9 +1078,25 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
+                if (hdev->le_scan_type == LE_SCAN_ACTIVE)
+                        clear_pending_adv_report(hdev);
                 break;
 
         case LE_SCAN_DISABLE:
+                /* We do this here instead of when setting DISCOVERY_STOPPED
+                 * since the latter would potentially require waiting for
+                 * inquiry to stop too.
+                 */
+                if (has_pending_adv_report(hdev)) {
+                        struct discovery_state *d = &hdev->discovery;
+
+                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                                          d->last_adv_addr_type, NULL,
+                                          d->last_adv_rssi, 0, 1,
+                                          d->last_adv_data,
+                                          d->last_adv_data_len, NULL, 0);
+                }
+
                 /* Cancel this timer so that we don't try to disable scanning
                  * when it's already disabled.
                  */
@@ -1187,6 +1245,59 @@ static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
 }
 
+static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_read_rssi *rp = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
+        if (conn)
+                conn->rssi = rp->rssi;
+
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_cp_read_tx_power *sent;
+        struct hci_rp_read_tx_power *rp = (void *) skb->data;
+        struct hci_conn *conn;
+
+        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
+        if (!sent)
+                return;
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
+        if (!conn)
+                goto unlock;
+
+        switch (sent->type) {
+        case 0x00:
+                conn->tx_power = rp->tx_power;
+                break;
+        case 0x01:
+                conn->max_tx_power = rp->tx_power;
+                break;
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 {
         BT_DBG("%s status 0x%2.2x", hdev->name, status);
@@ -1342,6 +1453,7 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
          * is requested.
          */
         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
+            conn->pending_sec_level != BT_SECURITY_FIPS &&
             conn->pending_sec_level != BT_SECURITY_HIGH &&
             conn->pending_sec_level != BT_SECURITY_MEDIUM)
                 return 0;
@@ -1827,7 +1939,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                   info->dev_class, 0, !name_known, ssp, NULL,
-                                  0);
+                                  0, NULL, 0);
         }
 
         hci_dev_unlock(hdev);
@@ -2579,6 +2691,14 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cc_write_remote_amp_assoc(hdev, skb);
                 break;
 
+        case HCI_OP_READ_RSSI:
+                hci_cc_read_rssi(hdev, skb);
+                break;
+
+        case HCI_OP_READ_TX_POWER:
+                hci_cc_read_tx_power(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
                 break;
@@ -2957,7 +3077,8 @@ static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 }
 
                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
-                    conn->pending_sec_level == BT_SECURITY_HIGH) {
+                    (conn->pending_sec_level == BT_SECURITY_HIGH ||
+                     conn->pending_sec_level == BT_SECURITY_FIPS)) {
                         BT_DBG("%s ignoring key unauthenticated for high security",
                                hdev->name);
                         goto not_found;
@@ -3102,7 +3223,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                                               false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                           info->dev_class, info->rssi,
-                                          !name_known, ssp, NULL, 0);
+                                          !name_known, ssp, NULL, 0, NULL, 0);
                 }
         } else {
                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
@@ -3120,7 +3241,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
                                                               false, &ssp);
                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                           info->dev_class, info->rssi,
-                                          !name_known, ssp, NULL, 0);
+                                          !name_known, ssp, NULL, 0, NULL, 0);
                 }
         }
 
@@ -3309,7 +3430,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
                 eir_len = eir_get_length(info->data, sizeof(info->data));
                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
                                   info->dev_class, info->rssi, !name_known,
-                                  ssp, info->data, eir_len);
+                                  ssp, info->data, eir_len, NULL, 0);
         }
 
         hci_dev_unlock(hdev);
@@ -3367,24 +3488,20 @@ unlock:
 
 static u8 hci_get_auth_req(struct hci_conn *conn)
 {
-        /* If remote requests dedicated bonding follow that lead */
-        if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
-            conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
-                /* If both remote and local IO capabilities allow MITM
-                 * protection then require it, otherwise don't */
-                if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
-                    conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
-                        return HCI_AT_DEDICATED_BONDING;
-                else
-                        return HCI_AT_DEDICATED_BONDING_MITM;
-        }
-
         /* If remote requests no-bonding follow that lead */
         if (conn->remote_auth == HCI_AT_NO_BONDING ||
             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
                 return conn->remote_auth | (conn->auth_type & 0x01);
 
-        return conn->auth_type;
+        /* If both remote and local have enough IO capabilities, require
+         * MITM protection
+         */
+        if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
+            conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
+                return conn->remote_auth | 0x01;
+
+        /* No MITM protection possible so ignore remote requirement */
+        return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
 }
 
 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
@@ -3414,8 +3531,21 @@ static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                  * to DisplayYesNo as it is not supported by BT spec. */
                 cp.capability = (conn->io_capability == 0x04) ?
                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
-                conn->auth_type = hci_get_auth_req(conn);
-                cp.authentication = conn->auth_type;
+
+                /* If we are initiators, there is no remote information yet */
+                if (conn->remote_auth == 0xff) {
+                        cp.authentication = conn->auth_type;
+
+                        /* Request MITM protection if our IO caps allow it
+                         * except for the no-bonding case
+                         */
+                        if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
+                            cp.authentication != HCI_AT_NO_BONDING)
+                                cp.authentication |= 0x01;
+                } else {
+                        conn->auth_type = hci_get_auth_req(conn);
+                        cp.authentication = conn->auth_type;
+                }
 
                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
@@ -3483,12 +3613,9 @@ static void hci_user_confirm_request_evt(struct hci_dev *hdev,
         rem_mitm = (conn->remote_auth & 0x01);
 
         /* If we require MITM but the remote device can't provide that
-         * (it has NoInputNoOutput) then reject the confirmation
-         * request. The only exception is when we're dedicated bonding
-         * initiators (connect_cfm_cb set) since then we always have the MITM
-         * bit set. */
-        if (!conn->connect_cfm_cb && loc_mitm &&
-            conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
+         * (it has NoInputNoOutput) then reject the confirmation request
+         */
+        if (loc_mitm && conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
                 BT_DBG("Rejecting request: remote device can't provide MITM");
                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
                              sizeof(ev->bdaddr), &ev->bdaddr);
@@ -3846,17 +3973,6 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 
                 conn->dst_type = ev->bdaddr_type;
 
-                /* The advertising parameters for own address type
-                 * define which source address and source address
-                 * type this connections has.
-                 */
-                if (bacmp(&conn->src, BDADDR_ANY)) {
-                        conn->src_type = ADDR_LE_DEV_PUBLIC;
-                } else {
-                        bacpy(&conn->src, &hdev->static_addr);
-                        conn->src_type = ADDR_LE_DEV_RANDOM;
-                }
-
                 if (ev->role == LE_CONN_ROLE_MASTER) {
                         conn->out = true;
                         conn->link_mode |= HCI_LM_MASTER;
@@ -3881,27 +3997,24 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                                                           &conn->init_addr,
                                                           &conn->init_addr_type);
                         }
-                } else {
-                        /* Set the responder (our side) address type based on
-                         * the advertising address type.
-                         */
-                        conn->resp_addr_type = hdev->adv_addr_type;
-                        if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
-                                bacpy(&conn->resp_addr, &hdev->random_addr);
-                        else
-                                bacpy(&conn->resp_addr, &hdev->bdaddr);
-
-                        conn->init_addr_type = ev->bdaddr_type;
-                        bacpy(&conn->init_addr, &ev->bdaddr);
                 }
         } else {
                 cancel_delayed_work(&conn->le_conn_timeout);
         }
 
-        /* Ensure that the hci_conn contains the identity address type
-         * regardless of which address the connection was made with.
-         */
-        hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
+        if (!conn->out) {
+                /* Set the responder (our side) address type based on
+                 * the advertising address type.
+                 */
+                conn->resp_addr_type = hdev->adv_addr_type;
+                if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
+                        bacpy(&conn->resp_addr, &hdev->random_addr);
+                else
+                        bacpy(&conn->resp_addr, &hdev->bdaddr);
+
+                conn->init_addr_type = ev->bdaddr_type;
+                bacpy(&conn->init_addr, &ev->bdaddr);
+        }
 
         /* Lookup the identity address from the stored connection
          * address and address type.
@@ -3981,25 +4094,97 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
         }
 }
 
+static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
+                               u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
+{
+        struct discovery_state *d = &hdev->discovery;
+        bool match;
+
+        /* Passive scanning shouldn't trigger any device found events */
+        if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
+                if (type == LE_ADV_IND || type == LE_ADV_DIRECT_IND)
+                        check_pending_le_conn(hdev, bdaddr, bdaddr_type);
+                return;
+        }
+
+        /* If there's nothing pending either store the data from this
+         * event or send an immediate device found event if the data
+         * should not be stored for later.
+         */
+        if (!has_pending_adv_report(hdev)) {
+                /* If the report will trigger a SCAN_REQ store it for
+                 * later merging.
+                 */
+                if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+                        store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+                                                 rssi, data, len);
+                        return;
+                }
+
+                mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
+                                  rssi, 0, 1, data, len, NULL, 0);
+                return;
+        }
+
+        /* Check if the pending report is for the same device as the new one */
+        match = (!bacmp(bdaddr, &d->last_adv_addr) &&
+                 bdaddr_type == d->last_adv_addr_type);
+
+        /* If the pending data doesn't match this report or this isn't a
+         * scan response (e.g. we got a duplicate ADV_IND) then force
+         * sending of the pending data.
+         */
+        if (type != LE_ADV_SCAN_RSP || !match) {
+                /* Send out whatever is in the cache, but skip duplicates */
+                if (!match)
+                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                                          d->last_adv_addr_type, NULL,
+                                          d->last_adv_rssi, 0, 1,
+                                          d->last_adv_data,
+                                          d->last_adv_data_len, NULL, 0);
+
+                /* If the new report will trigger a SCAN_REQ store it for
+                 * later merging.
+                 */
+                if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
+                        store_pending_adv_report(hdev, bdaddr, bdaddr_type,
+                                                 rssi, data, len);
+                        return;
+                }
+
+                /* The advertising reports cannot be merged, so clear
+                 * the pending report and send out a device found event.
+                 */
+                clear_pending_adv_report(hdev);
+                mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
+                                  rssi, 0, 1, data, len, NULL, 0);
+                return;
+        }
+
+        /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
+         * the new event is a SCAN_RSP. We can therefore proceed with
+         * sending a merged device found event.
+         */
+        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
+                          d->last_adv_addr_type, NULL, rssi, 0, 1, data, len,
+                          d->last_adv_data, d->last_adv_data_len);
+        clear_pending_adv_report(hdev);
+}
+
 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         u8 num_reports = skb->data[0];
         void *ptr = &skb->data[1];
-        s8 rssi;
 
         hci_dev_lock(hdev);
 
         while (num_reports--) {
                 struct hci_ev_le_advertising_info *ev = ptr;
-
-                if (ev->evt_type == LE_ADV_IND ||
-                    ev->evt_type == LE_ADV_DIRECT_IND)
-                        check_pending_le_conn(hdev, &ev->bdaddr,
-                                              ev->bdaddr_type);
+                s8 rssi;
 
                 rssi = ev->data[ev->length];
-                mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
-                                  NULL, rssi, 0, 1, ev->data, ev->length);
+                process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
+                                   ev->bdaddr_type, rssi, ev->data, ev->length);
 
                 ptr += sizeof(*ev) + ev->length + 1;
         }
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index b9a418e578e0..80d25c150a65 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -143,7 +143,7 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 
                 if (!skb_copy) {
                         /* Create a private copy with headroom */
-                        skb_copy = __pskb_copy(skb, 1, GFP_ATOMIC);
+                        skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
                         if (!skb_copy)
                                 continue;
 
@@ -247,8 +247,8 @@ void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
                         struct hci_mon_hdr *hdr;
 
                         /* Create a private copy with headroom */
-                        skb_copy = __pskb_copy(skb, HCI_MON_HDR_SIZE,
-                                               GFP_ATOMIC);
+                        skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE,
+                                                      GFP_ATOMIC, true);
                         if (!skb_copy)
                                 continue;
 
@@ -524,16 +524,7 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
         case HCISETRAW:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-
-                if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-                        return -EPERM;
-
-                if (arg)
-                        set_bit(HCI_RAW, &hdev->flags);
-                else
-                        clear_bit(HCI_RAW, &hdev->flags);
-
-                return 0;
+                return -EOPNOTSUPP;
 
         case HCIGETCONNINFO:
                 return hci_get_conn_info(hdev, (void __user *) arg);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index dc4d301d3a72..6eabbe05fe54 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -471,8 +471,14 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan)
         chan->max_tx = L2CAP_DEFAULT_MAX_TX;
         chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
         chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
+        chan->remote_max_tx = chan->max_tx;
+        chan->remote_tx_win = chan->tx_win;
         chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
         chan->sec_level = BT_SECURITY_LOW;
+        chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+        chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+        chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+        chan->conf_state = 0;
 
         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ef5e5b04f34f..ade3fb4c23bc 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1180,13 +1180,16 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
         /* Check for backlog size */
         if (sk_acceptq_is_full(parent)) {
                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
+                release_sock(parent);
                 return NULL;
         }
 
         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
                               GFP_ATOMIC);
-        if (!sk)
+        if (!sk) {
+                release_sock(parent);
                 return NULL;
+        }
 
         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
 
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index b3fbc73516c4..941ad7530eda 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -58,6 +58,7 @@ int bt_to_errno(__u16 code)
                 return EIO;
 
         case 0x04:
+        case 0x3c:
                 return EHOSTDOWN;
 
         case 0x05:
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index d2d4e0d5aed0..0fce54412ffd 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -29,12 +29,13 @@
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/mgmt.h>
 
 #include "smp.h"
 
 #define MGMT_VERSION    1
-#define MGMT_REVISION   5
+#define MGMT_REVISION   6
 
 static const u16 mgmt_commands[] = {
         MGMT_OP_READ_INDEX_LIST,
@@ -83,6 +84,7 @@ static const u16 mgmt_commands[] = {
         MGMT_OP_SET_DEBUG_KEYS,
         MGMT_OP_SET_PRIVACY,
         MGMT_OP_LOAD_IRKS,
+        MGMT_OP_GET_CONN_INFO,
 };
 
 static const u16 mgmt_events[] = {
@@ -2850,10 +2852,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         }
 
         sec_level = BT_SECURITY_MEDIUM;
-        if (cp->io_cap == 0x03)
-                auth_type = HCI_AT_DEDICATED_BONDING;
-        else
-                auth_type = HCI_AT_DEDICATED_BONDING_MITM;
+        auth_type = HCI_AT_DEDICATED_BONDING;
 
         if (cp->addr.type == BDADDR_BREDR) {
                 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level,
@@ -3351,6 +3350,8 @@ static int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 
 static void start_discovery_complete(struct hci_dev *hdev, u8 status)
 {
+        unsigned long timeout = 0;
+
         BT_DBG("status %d", status);
 
         if (status) {
@@ -3366,13 +3367,11 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status)
 
         switch (hdev->discovery.type) {
         case DISCOV_TYPE_LE:
-                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                                   DISCOV_LE_TIMEOUT);
+                timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
                 break;
 
         case DISCOV_TYPE_INTERLEAVED:
-                queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
-                                   DISCOV_INTERLEAVED_TIMEOUT);
+                timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
                 break;
 
         case DISCOV_TYPE_BREDR:
@@ -3381,6 +3380,11 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status)
         default:
                 BT_ERR("Invalid discovery type %d", hdev->discovery.type);
         }
+
+        if (!timeout)
+                return;
+
+        queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable, timeout);
 }
 
 static int start_discovery(struct sock *sk, struct hci_dev *hdev,
@@ -4530,7 +4534,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
 
         for (i = 0; i < key_count; i++) {
                 struct mgmt_ltk_info *key = &cp->keys[i];
-                u8 type, addr_type;
+                u8 type, addr_type, authenticated;
 
                 if (key->addr.type == BDADDR_LE_PUBLIC)
                         addr_type = ADDR_LE_DEV_PUBLIC;
@@ -4542,8 +4546,19 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                 else
                         type = HCI_SMP_LTK_SLAVE;
 
+                switch (key->type) {
+                case MGMT_LTK_UNAUTHENTICATED:
+                        authenticated = 0x00;
+                        break;
+                case MGMT_LTK_AUTHENTICATED:
+                        authenticated = 0x01;
+                        break;
+                default:
+                        continue;
+                }
+
                 hci_add_ltk(hdev, &key->addr.bdaddr, addr_type, type,
-                            key->type, key->val, key->enc_size, key->ediv,
+                            authenticated, key->val, key->enc_size, key->ediv,
                             key->rand);
         }
 
@@ -4555,6 +4570,218 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
         return err;
 }
 
+struct cmd_conn_lookup {
+        struct hci_conn *conn;
+        bool valid_tx_power;
+        u8 mgmt_status;
+};
+
+static void get_conn_info_complete(struct pending_cmd *cmd, void *data)
+{
+        struct cmd_conn_lookup *match = data;
+        struct mgmt_cp_get_conn_info *cp;
+        struct mgmt_rp_get_conn_info rp;
+        struct hci_conn *conn = cmd->user_data;
+
+        if (conn != match->conn)
+                return;
+
+        cp = (struct mgmt_cp_get_conn_info *) cmd->param;
+
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!match->mgmt_status) {
+                rp.rssi = conn->rssi;
+
+                if (match->valid_tx_power) {
+                        rp.tx_power = conn->tx_power;
+                        rp.max_tx_power = conn->max_tx_power;
+                } else {
+                        rp.tx_power = HCI_TX_POWER_INVALID;
+                        rp.max_tx_power = HCI_TX_POWER_INVALID;
+                }
+        }
+
+        cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
+                     match->mgmt_status, &rp, sizeof(rp));
+
+        hci_conn_drop(conn);
+
+        mgmt_pending_remove(cmd);
+}
+
+static void conn_info_refresh_complete(struct hci_dev *hdev, u8 status)
+{
+        struct hci_cp_read_rssi *cp;
+        struct hci_conn *conn;
+        struct cmd_conn_lookup match;
+        u16 handle;
+
+        BT_DBG("status 0x%02x", status);
+
+        hci_dev_lock(hdev);
+
+        /* TX power data is valid in case request completed successfully,
+         * otherwise we assume it's not valid. At the moment we assume that
+         * either both or none of current and max values are valid to keep code
+         * simple.
+         */
+        match.valid_tx_power = !status;
+
+        /* Commands sent in request are either Read RSSI or Read Transmit Power
+         * Level so we check which one was last sent to retrieve connection
+         * handle.  Both commands have handle as first parameter so it's safe to
+         * cast data on the same command struct.
+         *
+         * First command sent is always Read RSSI and we fail only if it fails.
+         * In other case we simply override error to indicate success as we
+         * already remembered if TX power value is actually valid.
+         */
+        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI);
+        if (!cp) {
+                cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
+                status = 0;
+        }
+
+        if (!cp) {
+                BT_ERR("invalid sent_cmd in response");
+                goto unlock;
+        }
+
+        handle = __le16_to_cpu(cp->handle);
+        conn = hci_conn_hash_lookup_handle(hdev, handle);
+        if (!conn) {
+                BT_ERR("unknown handle (%d) in response", handle);
+                goto unlock;
+        }
+
+        match.conn = conn;
+        match.mgmt_status = mgmt_status(status);
+
+        /* Cache refresh is complete, now reply for mgmt request for given
+         * connection only.
+         */
+        mgmt_pending_foreach(MGMT_OP_GET_CONN_INFO, hdev,
+                             get_conn_info_complete, &match);
+
+unlock:
+        hci_dev_unlock(hdev);
+}
+
+static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
+                         u16 len)
+{
+        struct mgmt_cp_get_conn_info *cp = data;
+        struct mgmt_rp_get_conn_info rp;
+        struct hci_conn *conn;
+        unsigned long conn_info_age;
+        int err = 0;
+
+        BT_DBG("%s", hdev->name);
+
+        memset(&rp, 0, sizeof(rp));
+        bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+        rp.addr.type = cp->addr.type;
+
+        if (!bdaddr_type_is_valid(cp->addr.type))
+                return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                    MGMT_STATUS_INVALID_PARAMS,
+                                    &rp, sizeof(rp));
+
+        hci_dev_lock(hdev);
+
+        if (!hdev_is_powered(hdev)) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                   MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+                goto unlock;
+        }
+
+        if (cp->addr.type == BDADDR_BREDR)
+                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                               &cp->addr.bdaddr);
+        else
+                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
+
+        if (!conn || conn->state != BT_CONNECTED) {
+                err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                   MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
+                goto unlock;
+        }
+
+        /* To avoid client trying to guess when to poll again for information we
+         * calculate conn info age as random value between min/max set in hdev.
+         */
+        conn_info_age = hdev->conn_info_min_age +
+                        prandom_u32_max(hdev->conn_info_max_age -
+                                        hdev->conn_info_min_age);
+
+        /* Query controller to refresh cached values if they are too old or were
+         * never read.
+         */
+        if (time_after(jiffies, conn->conn_info_timestamp +
+                       msecs_to_jiffies(conn_info_age)) ||
+            !conn->conn_info_timestamp) {
+                struct hci_request req;
+                struct hci_cp_read_tx_power req_txp_cp;
+                struct hci_cp_read_rssi req_rssi_cp;
+                struct pending_cmd *cmd;
+
+                hci_req_init(&req, hdev);
+                req_rssi_cp.handle = cpu_to_le16(conn->handle);
+                hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp),
+                            &req_rssi_cp);
+
+                /* For LE links TX power does not change thus we don't need to
+                 * query for it once value is known.
+                 */
+                if (!bdaddr_type_is_le(cp->addr.type) ||
+                    conn->tx_power == HCI_TX_POWER_INVALID) {
+                        req_txp_cp.handle = cpu_to_le16(conn->handle);
+                        req_txp_cp.type = 0x00;
+                        hci_req_add(&req, HCI_OP_READ_TX_POWER,
+                                    sizeof(req_txp_cp), &req_txp_cp);
+                }
+
+                /* Max TX power needs to be read only once per connection */
+                if (conn->max_tx_power == HCI_TX_POWER_INVALID) {
+                        req_txp_cp.handle = cpu_to_le16(conn->handle);
+                        req_txp_cp.type = 0x01;
+                        hci_req_add(&req, HCI_OP_READ_TX_POWER,
+                                    sizeof(req_txp_cp), &req_txp_cp);
+                }
+
+                err = hci_req_run(&req, conn_info_refresh_complete);
+                if (err < 0)
+                        goto unlock;
+
+                cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev,
+                                       data, len);
+                if (!cmd) {
+                        err = -ENOMEM;
+                        goto unlock;
+                }
+
+                hci_conn_hold(conn);
+                cmd->user_data = conn;
+
+                conn->conn_info_timestamp = jiffies;
+        } else {
+                /* Cache is valid, just reply with values cached in hci_conn */
+                rp.rssi = conn->rssi;
+                rp.tx_power = conn->tx_power;
+                rp.max_tx_power = conn->max_tx_power;
+
+                err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                   MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+        }
+
+unlock:
+        hci_dev_unlock(hdev);
+        return err;
+}
+
 static const struct mgmt_handler {
         int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
                      u16 data_len);
@@ -4610,6 +4837,7 @@ static const struct mgmt_handler {
         { set_debug_keys,         false, MGMT_SETTING_SIZE },
         { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
         { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
+        { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
 };
 
 
@@ -5005,6 +5233,14 @@ void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
         mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
+static u8 mgmt_ltk_type(struct smp_ltk *ltk)
+{
+        if (ltk->authenticated)
+                return MGMT_LTK_AUTHENTICATED;
+
+        return MGMT_LTK_UNAUTHENTICATED;
+}
+
 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
 {
         struct mgmt_ev_new_long_term_key ev;
@@ -5030,7 +5266,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
 
         bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
         ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
-        ev.key.type = key->authenticated;
+        ev.key.type = mgmt_ltk_type(key);
         ev.key.enc_size = key->enc_size;
         ev.key.ediv = key->ediv;
         ev.key.rand = key->rand;
@@ -5668,8 +5904,9 @@ void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
 }
 
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name, u8
-                       ssp, u8 *eir, u16 eir_len)
+                       u8 addr_type, u8 *dev_class, s8 rssi, u8 cfm_name,
+                       u8 ssp, u8 *eir, u16 eir_len, u8 *scan_rsp,
+                       u8 scan_rsp_len)
 {
         char buf[512];
         struct mgmt_ev_device_found *ev = (void *) buf;
@@ -5679,8 +5916,10 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
         if (!hci_discovery_active(hdev))
                 return;
 
-        /* Leave 5 bytes for a potential CoD field */
-        if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
+        /* Make sure that the buffer is big enough. The 5 extra bytes
+         * are for the potential CoD field.
+         */
+        if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf))
                 return;
 
         memset(buf, 0, sizeof(buf));
@@ -5707,8 +5946,11 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
                                           dev_class, 3);
 
-        ev->eir_len = cpu_to_le16(eir_len);
-        ev_size = sizeof(*ev) + eir_len;
+        if (scan_rsp_len > 0)
+                memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
+
+        ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
+        ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
 
         mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
 }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index cf620260affa..754b6fe4f742 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -307,7 +307,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 
         skb_queue_head_init(&d->tx_queue);
-        spin_lock_init(&d->lock);
+        mutex_init(&d->lock);
         atomic_set(&d->refcnt, 1);
 
         rfcomm_dlc_clear_state(d);
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 403ec09f480a..8e385a0ae60e 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -70,7 +70,7 @@ struct rfcomm_dev {
 };
 
 static LIST_HEAD(rfcomm_dev_list);
-static DEFINE_SPINLOCK(rfcomm_dev_lock);
+static DEFINE_MUTEX(rfcomm_dev_lock);
 
 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
@@ -96,9 +96,9 @@ static void rfcomm_dev_destruct(struct tty_port *port)
         if (dev->tty_dev)
                 tty_unregister_device(rfcomm_tty_driver, dev->id);
 
-        spin_lock(&rfcomm_dev_lock);
+        mutex_lock(&rfcomm_dev_lock);
         list_del(&dev->list);
-        spin_unlock(&rfcomm_dev_lock);
+        mutex_unlock(&rfcomm_dev_lock);
 
         kfree(dev);
 
@@ -161,14 +161,14 @@ static struct rfcomm_dev *rfcomm_dev_get(int id)
 {
         struct rfcomm_dev *dev;
 
-        spin_lock(&rfcomm_dev_lock);
+        mutex_lock(&rfcomm_dev_lock);
 
         dev = __rfcomm_dev_lookup(id);
 
         if (dev && !tty_port_get(&dev->port))
                 dev = NULL;
 
-        spin_unlock(&rfcomm_dev_lock);
+        mutex_unlock(&rfcomm_dev_lock);
 
         return dev;
 }
@@ -224,7 +224,7 @@ static struct rfcomm_dev *__rfcomm_dev_add(struct rfcomm_dev_req *req,
         if (!dev)
                 return ERR_PTR(-ENOMEM);
 
-        spin_lock(&rfcomm_dev_lock);
+        mutex_lock(&rfcomm_dev_lock);
 
         if (req->dev_id < 0) {
                 dev->id = 0;
@@ -305,11 +305,11 @@ static struct rfcomm_dev *__rfcomm_dev_add(struct rfcomm_dev_req *req,
            holds reference to this module. */
         __module_get(THIS_MODULE);
 
-        spin_unlock(&rfcomm_dev_lock);
+        mutex_unlock(&rfcomm_dev_lock);
         return dev;
 
 out:
-        spin_unlock(&rfcomm_dev_lock);
+        mutex_unlock(&rfcomm_dev_lock);
         kfree(dev);
         return ERR_PTR(err);
 }
@@ -524,7 +524,7 @@ static int rfcomm_get_dev_list(void __user *arg)
 
         di = dl->dev_info;
 
-        spin_lock(&rfcomm_dev_lock);
+        mutex_lock(&rfcomm_dev_lock);
 
         list_for_each_entry(dev, &rfcomm_dev_list, list) {
                 if (!tty_port_get(&dev->port))
@@ -540,7 +540,7 @@ static int rfcomm_get_dev_list(void __user *arg)
                         break;
         }
 
-        spin_unlock(&rfcomm_dev_lock);
+        mutex_unlock(&rfcomm_dev_lock);
 
         dl->dev_num = n;
         size = sizeof(*dl) + n * sizeof(*di);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index dfb4e1161c10..3d1cc164557d 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -35,6 +35,33 @@
 
 #define AUTH_REQ_MASK   0x07
 
+#define SMP_FLAG_TK_VALID       1
+#define SMP_FLAG_CFM_PENDING    2
+#define SMP_FLAG_MITM_AUTH      3
+#define SMP_FLAG_COMPLETE       4
+#define SMP_FLAG_INITIATOR      5
+
+struct smp_chan {
+        struct l2cap_conn *conn;
+        u8              preq[7]; /* SMP Pairing Request */
+        u8              prsp[7]; /* SMP Pairing Response */
+        u8              prnd[16]; /* SMP Pairing Random (local) */
+        u8              rrnd[16]; /* SMP Pairing Random (remote) */
+        u8              pcnf[16]; /* SMP Pairing Confirm */
+        u8              tk[16]; /* SMP Temporary Key */
+        u8              enc_key_size;
+        u8              remote_key_dist;
+        bdaddr_t        id_addr;
+        u8              id_addr_type;
+        u8              irk[16];
+        struct smp_csrk *csrk;
+        struct smp_csrk *slave_csrk;
+        struct smp_ltk  *ltk;
+        struct smp_ltk  *slave_ltk;
+        struct smp_irk  *remote_irk;
+        unsigned long   flags;
+};
+
 static inline void swap128(const u8 src[16], u8 dst[16])
 {
         int i;
@@ -369,7 +396,7 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
 
         /* Initialize key for JUST WORKS */
         memset(smp->tk, 0, sizeof(smp->tk));
-        clear_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
+        clear_bit(SMP_FLAG_TK_VALID, &smp->flags);
 
         BT_DBG("tk_request: auth:%d lcl:%d rem:%d", auth, local_io, remote_io);
 
@@ -388,19 +415,18 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                 method = JUST_WORKS;
 
         /* Don't confirm locally initiated pairing attempts */
-        if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR,
-                                           &smp->smp_flags))
+        if (method == JUST_CFM && test_bit(SMP_FLAG_INITIATOR, &smp->flags))
                 method = JUST_WORKS;
 
         /* If Just Works, Continue with Zero TK */
         if (method == JUST_WORKS) {
-                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
+                set_bit(SMP_FLAG_TK_VALID, &smp->flags);
                 return 0;
         }
 
         /* Not Just Works/Confirm results in MITM Authentication */
         if (method != JUST_CFM)
-                set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
+                set_bit(SMP_FLAG_MITM_AUTH, &smp->flags);
 
         /* If both devices have Keyoard-Display I/O, the master
          * Confirms and the slave Enters the passkey.
@@ -419,7 +445,7 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
                 passkey %= 1000000;
                 put_unaligned_le32(passkey, smp->tk);
                 BT_DBG("PassKey: %d", passkey);
-                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
+                set_bit(SMP_FLAG_TK_VALID, &smp->flags);
         }
 
         hci_dev_lock(hcon->hdev);
@@ -441,15 +467,13 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
         return ret;
 }
 
-static void confirm_work(struct work_struct *work)
+static u8 smp_confirm(struct smp_chan *smp)
 {
-        struct smp_chan *smp = container_of(work, struct smp_chan, confirm);
         struct l2cap_conn *conn = smp->conn;
         struct hci_dev *hdev = conn->hcon->hdev;
         struct crypto_blkcipher *tfm = hdev->tfm_aes;
         struct smp_cmd_pairing_confirm cp;
         int ret;
-        u8 reason;
 
         BT_DBG("conn %p", conn);
 
@@ -463,35 +487,27 @@ static void confirm_work(struct work_struct *work)
 
         hci_dev_unlock(hdev);
 
-        if (ret) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
+        if (ret)
+                return SMP_UNSPECIFIED;
 
-        clear_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
+        clear_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
 
         smp_send_cmd(smp->conn, SMP_CMD_PAIRING_CONFIRM, sizeof(cp), &cp);
 
-        return;
-
-error:
-        smp_failure(conn, reason);
+        return 0;
 }
 
-static void random_work(struct work_struct *work)
+static u8 smp_random(struct smp_chan *smp)
 {
-        struct smp_chan *smp = container_of(work, struct smp_chan, random);
         struct l2cap_conn *conn = smp->conn;
         struct hci_conn *hcon = conn->hcon;
         struct hci_dev *hdev = hcon->hdev;
         struct crypto_blkcipher *tfm = hdev->tfm_aes;
-        u8 reason, confirm[16];
+        u8 confirm[16];
         int ret;
 
-        if (IS_ERR_OR_NULL(tfm)) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
+        if (IS_ERR_OR_NULL(tfm))
+                return SMP_UNSPECIFIED;
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
@@ -504,15 +520,12 @@ static void random_work(struct work_struct *work)
 
         hci_dev_unlock(hdev);
 
-        if (ret) {
-                reason = SMP_UNSPECIFIED;
-                goto error;
-        }
+        if (ret)
+                return SMP_UNSPECIFIED;
 
         if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) {
                 BT_ERR("Pairing failed (confirmation values mismatch)");
-                reason = SMP_CONFIRM_FAILED;
-                goto error;
+                return SMP_CONFIRM_FAILED;
         }
 
         if (hcon->out) {
@@ -525,10 +538,8 @@ static void random_work(struct work_struct *work)
                 memset(stk + smp->enc_key_size, 0,
                        SMP_MAX_ENC_KEY_SIZE - smp->enc_key_size);
 
-                if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) {
-                        reason = SMP_UNSPECIFIED;
-                        goto error;
-                }
+                if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
+                        return SMP_UNSPECIFIED;
 
                 hci_le_start_enc(hcon, ediv, rand, stk);
                 hcon->enc_key_size = smp->enc_key_size;
@@ -550,10 +561,7 @@ static void random_work(struct work_struct *work)
                             ediv, rand);
         }
 
-        return;
-
-error:
-        smp_failure(conn, reason);
+        return 0;
 }
 
 static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
@@ -564,9 +572,6 @@ static struct smp_chan *smp_chan_create(struct l2cap_conn *conn)
         if (!smp)
                 return NULL;
 
-        INIT_WORK(&smp->confirm, confirm_work);
-        INIT_WORK(&smp->random, random_work);
-
         smp->conn = conn;
         conn->smp_chan = smp;
         conn->hcon->smp_conn = conn;
@@ -583,7 +588,7 @@ void smp_chan_destroy(struct l2cap_conn *conn)
 
         BUG_ON(!smp);
 
-        complete = test_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
+        complete = test_bit(SMP_FLAG_COMPLETE, &smp->flags);
         mgmt_smp_complete(conn->hcon, complete);
 
         kfree(smp->csrk);
@@ -634,7 +639,7 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
                 put_unaligned_le32(value, smp->tk);
                 /* Fall Through */
         case MGMT_OP_USER_CONFIRM_REPLY:
-                set_bit(SMP_FLAG_TK_VALID, &smp->smp_flags);
+                set_bit(SMP_FLAG_TK_VALID, &smp->flags);
                 break;
         case MGMT_OP_USER_PASSKEY_NEG_REPLY:
         case MGMT_OP_USER_CONFIRM_NEG_REPLY:
@@ -646,8 +651,11 @@ int smp_user_confirm_reply(struct hci_conn *hcon, u16 mgmt_op, __le32 passkey)
         }
 
         /* If it is our turn to send Pairing Confirm, do so now */
-        if (test_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags))
-                queue_work(hcon->hdev->workqueue, &smp->confirm);
+        if (test_bit(SMP_FLAG_CFM_PENDING, &smp->flags)) {
+                u8 rsp = smp_confirm(smp);
+                if (rsp)
+                        smp_failure(conn, rsp);
+        }
 
         return 0;
 }
@@ -656,14 +664,13 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_pairing rsp, *req = (void *) skb->data;
         struct smp_chan *smp;
-        u8 key_size;
-        u8 auth = SMP_AUTH_NONE;
+        u8 key_size, auth;
         int ret;
 
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*req))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         if (conn->hcon->link_mode & HCI_LM_MASTER)
                 return SMP_CMD_NOTSUPP;
@@ -681,8 +688,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         skb_pull(skb, sizeof(*req));
 
         /* We didn't start the pairing, so match remote */
-        if (req->auth_req & SMP_AUTH_BONDING)
-                auth = req->auth_req;
+        auth = req->auth_req;
 
         conn->hcon->pending_sec_level = authreq_to_seclevel(auth);
 
@@ -704,7 +710,7 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         if (ret)
                 return SMP_UNSPECIFIED;
 
-        clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+        clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
 
         return 0;
 }
@@ -713,14 +719,13 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_cmd_pairing *req, *rsp = (void *) skb->data;
         struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
         u8 key_size, auth = SMP_AUTH_NONE;
         int ret;
 
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*rsp))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         if (!(conn->hcon->link_mode & HCI_LM_MASTER))
                 return SMP_CMD_NOTSUPP;
@@ -753,11 +758,11 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
         if (ret)
                 return SMP_UNSPECIFIED;
 
-        set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
+        set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
 
         /* Can't compose response until we have been confirmed */
-        if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
-                queue_work(hdev->workqueue, &smp->confirm);
+        if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
+                return smp_confirm(smp);
 
         return 0;
 }
@@ -765,12 +770,11 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
 static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
 
         BT_DBG("conn %p %s", conn, conn->hcon->out ? "master" : "slave");
 
         if (skb->len < sizeof(smp->pcnf))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         memcpy(smp->pcnf, skb->data, sizeof(smp->pcnf));
         skb_pull(skb, sizeof(smp->pcnf));
@@ -778,10 +782,10 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
         if (conn->hcon->out)
                 smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
                              smp->prnd);
-        else if (test_bit(SMP_FLAG_TK_VALID, &smp->smp_flags))
-                queue_work(hdev->workqueue, &smp->confirm);
+        else if (test_bit(SMP_FLAG_TK_VALID, &smp->flags))
+                return smp_confirm(smp);
         else
-                set_bit(SMP_FLAG_CFM_PENDING, &smp->smp_flags);
+                set_bit(SMP_FLAG_CFM_PENDING, &smp->flags);
 
         return 0;
 }
@@ -789,19 +793,16 @@ static u8 smp_cmd_pairing_confirm(struct l2cap_conn *conn, struct sk_buff *skb)
 static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
 {
         struct smp_chan *smp = conn->smp_chan;
-        struct hci_dev *hdev = conn->hcon->hdev;
 
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(smp->rrnd))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         memcpy(smp->rrnd, skb->data, sizeof(smp->rrnd));
         skb_pull(skb, sizeof(smp->rrnd));
 
-        queue_work(hdev->workqueue, &smp->random);
-
-        return 0;
+        return smp_random(smp);
 }
 
 static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
@@ -836,7 +837,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*rp))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         if (!(conn->hcon->link_mode & HCI_LM_MASTER))
                 return SMP_CMD_NOTSUPP;
@@ -861,7 +862,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         smp_send_cmd(conn, SMP_CMD_PAIRING_REQ, sizeof(cp), &cp);
 
-        clear_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+        clear_bit(SMP_FLAG_INITIATOR, &smp->flags);
 
         return 0;
 }
@@ -908,10 +909,11 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 
         authreq = seclevel_to_authreq(sec_level);
 
-        /* hcon->auth_type is set by pair_device in mgmt.c. If the MITM
-         * flag is set we should also set it for the SMP request.
+        /* Require MITM if IO Capability allows or the security level
+         * requires it.
          */
-        if ((hcon->auth_type & 0x01))
+        if (hcon->io_capability != HCI_IO_NO_INPUT_OUTPUT ||
+            sec_level > BT_SECURITY_MEDIUM)
                 authreq |= SMP_AUTH_MITM;
 
         if (hcon->link_mode & HCI_LM_MASTER) {
@@ -928,7 +930,7 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
                 smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
         }
 
-        set_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
+        set_bit(SMP_FLAG_INITIATOR, &smp->flags);
 
 done:
         hcon->pending_sec_level = sec_level;
@@ -944,7 +946,7 @@ static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*rp))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         /* Ignore this PDU if it wasn't requested */
         if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
@@ -969,7 +971,7 @@ static int smp_cmd_master_ident(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*rp))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         /* Ignore this PDU if it wasn't requested */
         if (!(smp->remote_key_dist & SMP_DIST_ENC_KEY))
@@ -1001,7 +1003,7 @@ static int smp_cmd_ident_info(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("");
 
         if (skb->len < sizeof(*info))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         /* Ignore this PDU if it wasn't requested */
         if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
@@ -1025,7 +1027,7 @@ static int smp_cmd_ident_addr_info(struct l2cap_conn *conn,
         BT_DBG("");
 
         if (skb->len < sizeof(*info))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         /* Ignore this PDU if it wasn't requested */
         if (!(smp->remote_key_dist & SMP_DIST_ID_KEY))
@@ -1075,7 +1077,7 @@ static int smp_cmd_sign_info(struct l2cap_conn *conn, struct sk_buff *skb)
         BT_DBG("conn %p", conn);
 
         if (skb->len < sizeof(*rp))
-                return SMP_UNSPECIFIED;
+                return SMP_INVALID_PARAMS;
 
         /* Ignore this PDU if it wasn't requested */
         if (!(smp->remote_key_dist & SMP_DIST_SIGN))
@@ -1358,7 +1360,7 @@ int smp_distribute_keys(struct l2cap_conn *conn)
 
         clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags);
         cancel_delayed_work_sync(&conn->security_timer);
-        set_bit(SMP_FLAG_COMPLETE, &smp->smp_flags);
+        set_bit(SMP_FLAG_COMPLETE, &smp->flags);
         smp_notify_keys(conn);
 
         smp_chan_destroy(conn);
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index 1277147a9150..5a8dc36460a1 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -111,39 +111,11 @@ struct smp_cmd_security_req {
 #define SMP_CMD_NOTSUPP                 0x07
 #define SMP_UNSPECIFIED                 0x08
 #define SMP_REPEATED_ATTEMPTS           0x09
+#define SMP_INVALID_PARAMS              0x0a
 
 #define SMP_MIN_ENC_KEY_SIZE            7
 #define SMP_MAX_ENC_KEY_SIZE            16
 
-#define SMP_FLAG_TK_VALID       1
-#define SMP_FLAG_CFM_PENDING    2
-#define SMP_FLAG_MITM_AUTH      3
-#define SMP_FLAG_COMPLETE       4
-#define SMP_FLAG_INITIATOR      5
-
-struct smp_chan {
-        struct l2cap_conn *conn;
-        u8              preq[7]; /* SMP Pairing Request */
-        u8              prsp[7]; /* SMP Pairing Response */
-        u8              prnd[16]; /* SMP Pairing Random (local) */
-        u8              rrnd[16]; /* SMP Pairing Random (remote) */
-        u8              pcnf[16]; /* SMP Pairing Confirm */
-        u8              tk[16]; /* SMP Temporary Key */
-        u8              enc_key_size;
-        u8              remote_key_dist;
-        bdaddr_t        id_addr;
-        u8              id_addr_type;
-        u8              irk[16];
-        struct smp_csrk *csrk;
-        struct smp_csrk *slave_csrk;
-        struct smp_ltk  *ltk;
-        struct smp_ltk  *slave_ltk;
-        struct smp_irk  *remote_irk;
-        unsigned long   smp_flags;
-        struct work_struct confirm;
-        struct work_struct random;
-};
-
 /* SMP Commands */
 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level);
 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);