]> git.karo-electronics.de Git - karo-tx-linux.git/blobdiff - net/bluetooth/mgmt.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/blueto...
[karo-tx-linux.git] / net / bluetooth / mgmt.c
index e4a353cfa97d3519424489ded76743bb47509bb5..fbcbef6ecceb633dc8fa8123e1b5b03f210f3549 100644 (file)
@@ -24,6 +24,7 @@
 
 #include <linux/kernel.h>
 #include <linux/uaccess.h>
+#include <linux/module.h>
 #include <asm/unaligned.h>
 
 #include <net/bluetooth/bluetooth.h>
@@ -35,6 +36,8 @@
 
 #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
 
+#define SERVICE_CACHE_TIMEOUT (5 * 1000)
+
 struct pending_cmd {
        struct list_head list;
        u16 opcode;
@@ -242,6 +245,262 @@ static int read_index_list(struct sock *sk)
        return err;
 }
 
+static u32 get_supported_settings(struct hci_dev *hdev)
+{
+       u32 settings = 0;
+
+       settings |= MGMT_SETTING_POWERED;
+       settings |= MGMT_SETTING_CONNECTABLE;
+       settings |= MGMT_SETTING_FAST_CONNECTABLE;
+       settings |= MGMT_SETTING_DISCOVERABLE;
+       settings |= MGMT_SETTING_PAIRABLE;
+
+       if (hdev->features[6] & LMP_SIMPLE_PAIR)
+               settings |= MGMT_SETTING_SSP;
+
+       if (!(hdev->features[4] & LMP_NO_BREDR)) {
+               settings |= MGMT_SETTING_BREDR;
+               settings |= MGMT_SETTING_LINK_SECURITY;
+       }
+
+       if (hdev->features[4] & LMP_LE)
+               settings |= MGMT_SETTING_LE;
+
+       return settings;
+}
+
+static u32 get_current_settings(struct hci_dev *hdev)
+{
+       u32 settings = 0;
+
+       if (test_bit(HCI_UP, &hdev->flags))
+               settings |= MGMT_SETTING_POWERED;
+       else
+               return settings;
+
+       if (test_bit(HCI_PSCAN, &hdev->flags))
+               settings |= MGMT_SETTING_CONNECTABLE;
+
+       if (test_bit(HCI_ISCAN, &hdev->flags))
+               settings |= MGMT_SETTING_DISCOVERABLE;
+
+       if (test_bit(HCI_PAIRABLE, &hdev->flags))
+               settings |= MGMT_SETTING_PAIRABLE;
+
+       if (!(hdev->features[4] & LMP_NO_BREDR))
+               settings |= MGMT_SETTING_BREDR;
+
+       if (hdev->extfeatures[0] & LMP_HOST_LE)
+               settings |= MGMT_SETTING_LE;
+
+       if (test_bit(HCI_AUTH, &hdev->flags))
+               settings |= MGMT_SETTING_LINK_SECURITY;
+
+       if (hdev->ssp_mode > 0)
+               settings |= MGMT_SETTING_SSP;
+
+       return settings;
+}
+
+#define EIR_FLAGS              0x01 /* flags */
+#define EIR_UUID16_SOME                0x02 /* 16-bit UUID, more available */
+#define EIR_UUID16_ALL         0x03 /* 16-bit UUID, all listed */
+#define EIR_UUID32_SOME                0x04 /* 32-bit UUID, more available */
+#define EIR_UUID32_ALL         0x05 /* 32-bit UUID, all listed */
+#define EIR_UUID128_SOME       0x06 /* 128-bit UUID, more available */
+#define EIR_UUID128_ALL                0x07 /* 128-bit UUID, all listed */
+#define EIR_NAME_SHORT         0x08 /* shortened local name */
+#define EIR_NAME_COMPLETE      0x09 /* complete local name */
+#define EIR_TX_POWER           0x0A /* transmit power level */
+#define EIR_DEVICE_ID          0x10 /* device ID */
+
+#define PNP_INFO_SVCLASS_ID            0x1200
+
+static u8 bluetooth_base_uuid[] = {
+                       0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
+                       0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static u16 get_uuid16(u8 *uuid128)
+{
+       u32 val;
+       int i;
+
+       for (i = 0; i < 12; i++) {
+               if (bluetooth_base_uuid[i] != uuid128[i])
+                       return 0;
+       }
+
+       memcpy(&val, &uuid128[12], 4);
+
+       val = le32_to_cpu(val);
+       if (val > 0xffff)
+               return 0;
+
+       return (u16) val;
+}
+
+static void create_eir(struct hci_dev *hdev, u8 *data)
+{
+       u8 *ptr = data;
+       u16 eir_len = 0;
+       u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
+       int i, truncated = 0;
+       struct bt_uuid *uuid;
+       size_t name_len;
+
+       name_len = strlen(hdev->dev_name);
+
+       if (name_len > 0) {
+               /* EIR Data type */
+               if (name_len > 48) {
+                       name_len = 48;
+                       ptr[1] = EIR_NAME_SHORT;
+               } else
+                       ptr[1] = EIR_NAME_COMPLETE;
+
+               /* EIR Data length */
+               ptr[0] = name_len + 1;
+
+               memcpy(ptr + 2, hdev->dev_name, name_len);
+
+               eir_len += (name_len + 2);
+               ptr += (name_len + 2);
+       }
+
+       memset(uuid16_list, 0, sizeof(uuid16_list));
+
+       /* Group all UUID16 types */
+       list_for_each_entry(uuid, &hdev->uuids, list) {
+               u16 uuid16;
+
+               uuid16 = get_uuid16(uuid->uuid);
+               if (uuid16 == 0)
+                       return;
+
+               if (uuid16 < 0x1100)
+                       continue;
+
+               if (uuid16 == PNP_INFO_SVCLASS_ID)
+                       continue;
+
+               /* Stop if not enough space to put next UUID */
+               if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
+                       truncated = 1;
+                       break;
+               }
+
+               /* Check for duplicates */
+               for (i = 0; uuid16_list[i] != 0; i++)
+                       if (uuid16_list[i] == uuid16)
+                               break;
+
+               if (uuid16_list[i] == 0) {
+                       uuid16_list[i] = uuid16;
+                       eir_len += sizeof(u16);
+               }
+       }
+
+       if (uuid16_list[0] != 0) {
+               u8 *length = ptr;
+
+               /* EIR Data type */
+               ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
+
+               ptr += 2;
+               eir_len += 2;
+
+               for (i = 0; uuid16_list[i] != 0; i++) {
+                       *ptr++ = (uuid16_list[i] & 0x00ff);
+                       *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
+               }
+
+               /* EIR Data length */
+               *length = (i * sizeof(u16)) + 1;
+       }
+}
+
+static int update_eir(struct hci_dev *hdev)
+{
+       struct hci_cp_write_eir cp;
+
+       if (!(hdev->features[6] & LMP_EXT_INQ))
+               return 0;
+
+       if (hdev->ssp_mode == 0)
+               return 0;
+
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return 0;
+
+       memset(&cp, 0, sizeof(cp));
+
+       create_eir(hdev, cp.data);
+
+       if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
+               return 0;
+
+       memcpy(hdev->eir, cp.data, sizeof(cp.data));
+
+       return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+}
+
+static u8 get_service_classes(struct hci_dev *hdev)
+{
+       struct bt_uuid *uuid;
+       u8 val = 0;
+
+       list_for_each_entry(uuid, &hdev->uuids, list)
+               val |= uuid->svc_hint;
+
+       return val;
+}
+
+static int update_class(struct hci_dev *hdev)
+{
+       u8 cod[3];
+
+       BT_DBG("%s", hdev->name);
+
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return 0;
+
+       cod[0] = hdev->minor_class;
+       cod[1] = hdev->major_class;
+       cod[2] = get_service_classes(hdev);
+
+       if (memcmp(cod, hdev->dev_class, 3) == 0)
+               return 0;
+
+       return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+}
+
+static void service_cache_off(struct work_struct *work)
+{
+       struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                                       service_cache.work);
+
+       if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return;
+
+       hci_dev_lock(hdev);
+
+       update_eir(hdev);
+       update_class(hdev);
+
+       hci_dev_unlock(hdev);
+}
+
+static void mgmt_init_hdev(struct hci_dev *hdev)
+{
+       if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
+               INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
+
+       if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               schedule_delayed_work(&hdev->service_cache,
+                               msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
+}
+
 static int read_controller_info(struct sock *sk, u16 index)
 {
        struct mgmt_rp_read_info rp;
@@ -257,36 +516,27 @@ static int read_controller_info(struct sock *sk, u16 index)
        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
                cancel_delayed_work_sync(&hdev->power_off);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
-       set_bit(HCI_MGMT, &hdev->flags);
+       if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
+               mgmt_init_hdev(hdev);
 
        memset(&rp, 0, sizeof(rp));
 
-       rp.type = hdev->dev_type;
+       bacpy(&rp.bdaddr, &hdev->bdaddr);
 
-       rp.powered = test_bit(HCI_UP, &hdev->flags);
-       rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
-       rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
-       rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
+       rp.version = hdev->hci_ver;
 
-       if (test_bit(HCI_AUTH, &hdev->flags))
-               rp.sec_mode = 3;
-       else if (hdev->ssp_mode > 0)
-               rp.sec_mode = 4;
-       else
-               rp.sec_mode = 2;
+       put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
+
+       rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
+       rp.current_settings = cpu_to_le32(get_current_settings(hdev));
 
-       bacpy(&rp.bdaddr, &hdev->bdaddr);
-       memcpy(rp.features, hdev->features, 8);
        memcpy(rp.dev_class, hdev->dev_class, 3);
-       put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
-       rp.hci_ver = hdev->hci_ver;
-       put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
 
        memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
@@ -365,13 +615,11 @@ static void mgmt_pending_remove(struct pending_cmd *cmd)
        mgmt_pending_free(cmd);
 }
 
-static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
+static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
-       struct mgmt_mode rp;
+       __le32 settings = cpu_to_le32(get_current_settings(hdev));
 
-       rp.val = val;
-
-       return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
+       return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
 }
 
 static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@ -394,11 +642,11 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_SET_POWERED,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        up = test_bit(HCI_UP, &hdev->flags);
        if ((cp->val && up) || (!cp->val && !up)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_POWERED, cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
                goto failed;
        }
 
@@ -415,14 +663,14 @@ static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
        }
 
        if (cp->val)
-               queue_work(hdev->workqueue, &hdev->power_on);
+               schedule_work(&hdev->power_on);
        else
-               queue_work(hdev->workqueue, &hdev->power_off.work);
+               schedule_work(&hdev->power_off.work);
 
        err = 0;
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
        return err;
 }
@@ -449,7 +697,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
@@ -466,8 +714,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
 
        if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
                                        test_bit(HCI_PSCAN, &hdev->flags)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                               cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
                goto failed;
        }
 
@@ -492,7 +739,7 @@ static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
                hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -520,7 +767,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
@@ -536,8 +783,7 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
        }
 
        if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                               cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
                goto failed;
        }
 
@@ -557,254 +803,82 @@ static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
-       hci_dev_put(hdev);
-
-       return err;
-}
-
-static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
-                                       u16 data_len, struct sock *skip_sk)
-{
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-
-       skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
-       if (!skb)
-               return -ENOMEM;
-
-       bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-       hdr->opcode = cpu_to_le16(event);
-       if (hdev)
-               hdr->index = cpu_to_le16(hdev->id);
-       else
-               hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
-       hdr->len = cpu_to_le16(data_len);
-
-       if (data)
-               memcpy(skb_put(skb, data_len), data, data_len);
-
-       hci_send_to_sock(NULL, skb, skip_sk);
-       kfree_skb(skb);
-
-       return 0;
-}
-
-static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
-{
-       struct mgmt_mode *cp, ev;
-       struct hci_dev *hdev;
-       int err;
-
-       cp = (void *) data;
-
-       BT_DBG("request for hci%u", index);
-
-       if (len != sizeof(*cp))
-               return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
-                                               MGMT_STATUS_INVALID_PARAMS);
-
-       hdev = hci_dev_get(index);
-       if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
-                                               MGMT_STATUS_INVALID_PARAMS);
-
-       hci_dev_lock_bh(hdev);
-
-       if (cp->val)
-               set_bit(HCI_PAIRABLE, &hdev->flags);
-       else
-               clear_bit(HCI_PAIRABLE, &hdev->flags);
-
-       err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
-       if (err < 0)
-               goto failed;
-
-       ev.val = cp->val;
-
-       err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
-
-failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
-       return err;
-}
-
-#define EIR_FLAGS              0x01 /* flags */
-#define EIR_UUID16_SOME                0x02 /* 16-bit UUID, more available */
-#define EIR_UUID16_ALL         0x03 /* 16-bit UUID, all listed */
-#define EIR_UUID32_SOME                0x04 /* 32-bit UUID, more available */
-#define EIR_UUID32_ALL         0x05 /* 32-bit UUID, all listed */
-#define EIR_UUID128_SOME       0x06 /* 128-bit UUID, more available */
-#define EIR_UUID128_ALL                0x07 /* 128-bit UUID, all listed */
-#define EIR_NAME_SHORT         0x08 /* shortened local name */
-#define EIR_NAME_COMPLETE      0x09 /* complete local name */
-#define EIR_TX_POWER           0x0A /* transmit power level */
-#define EIR_DEVICE_ID          0x10 /* device ID */
-
-#define PNP_INFO_SVCLASS_ID            0x1200
-
-static u8 bluetooth_base_uuid[] = {
-                       0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
-                       0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-};
-
-static u16 get_uuid16(u8 *uuid128)
-{
-       u32 val;
-       int i;
-
-       for (i = 0; i < 12; i++) {
-               if (bluetooth_base_uuid[i] != uuid128[i])
-                       return 0;
-       }
-
-       memcpy(&val, &uuid128[12], 4);
-
-       val = le32_to_cpu(val);
-       if (val > 0xffff)
-               return 0;
-
-       return (u16) val;
-}
-
-static void create_eir(struct hci_dev *hdev, u8 *data)
-{
-       u8 *ptr = data;
-       u16 eir_len = 0;
-       u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
-       int i, truncated = 0;
-       struct bt_uuid *uuid;
-       size_t name_len;
-
-       name_len = strlen(hdev->dev_name);
-
-       if (name_len > 0) {
-               /* EIR Data type */
-               if (name_len > 48) {
-                       name_len = 48;
-                       ptr[1] = EIR_NAME_SHORT;
-               } else
-                       ptr[1] = EIR_NAME_COMPLETE;
-
-               /* EIR Data length */
-               ptr[0] = name_len + 1;
-
-               memcpy(ptr + 2, hdev->dev_name, name_len);
-
-               eir_len += (name_len + 2);
-               ptr += (name_len + 2);
-       }
-
-       memset(uuid16_list, 0, sizeof(uuid16_list));
-
-       /* Group all UUID16 types */
-       list_for_each_entry(uuid, &hdev->uuids, list) {
-               u16 uuid16;
-
-               uuid16 = get_uuid16(uuid->uuid);
-               if (uuid16 == 0)
-                       return;
-
-               if (uuid16 < 0x1100)
-                       continue;
-
-               if (uuid16 == PNP_INFO_SVCLASS_ID)
-                       continue;
-
-               /* Stop if not enough space to put next UUID */
-               if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
-                       truncated = 1;
-                       break;
-               }
-
-               /* Check for duplicates */
-               for (i = 0; uuid16_list[i] != 0; i++)
-                       if (uuid16_list[i] == uuid16)
-                               break;
-
-               if (uuid16_list[i] == 0) {
-                       uuid16_list[i] = uuid16;
-                       eir_len += sizeof(u16);
-               }
-       }
-
-       if (uuid16_list[0] != 0) {
-               u8 *length = ptr;
-
-               /* EIR Data type */
-               ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
-
-               ptr += 2;
-               eir_len += 2;
-
-               for (i = 0; uuid16_list[i] != 0; i++) {
-                       *ptr++ = (uuid16_list[i] & 0x00ff);
-                       *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
-               }
-
-               /* EIR Data length */
-               *length = (i * sizeof(u16)) + 1;
-       }
-}
-
-static int update_eir(struct hci_dev *hdev)
-{
-       struct hci_cp_write_eir cp;
-
-       if (!(hdev->features[6] & LMP_EXT_INQ))
-               return 0;
+       return err;
+}
 
-       if (hdev->ssp_mode == 0)
-               return 0;
+static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
+                                       u16 data_len, struct sock *skip_sk)
+{
+       struct sk_buff *skb;
+       struct mgmt_hdr *hdr;
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
-               return 0;
+       skb = alloc_skb(sizeof(*hdr) + data_len, GFP_ATOMIC);
+       if (!skb)
+               return -ENOMEM;
 
-       memset(&cp, 0, sizeof(cp));
+       bt_cb(skb)->channel = HCI_CHANNEL_CONTROL;
 
-       create_eir(hdev, cp.data);
+       hdr = (void *) skb_put(skb, sizeof(*hdr));
+       hdr->opcode = cpu_to_le16(event);
+       if (hdev)
+               hdr->index = cpu_to_le16(hdev->id);
+       else
+               hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
+       hdr->len = cpu_to_le16(data_len);
 
-       if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
-               return 0;
+       if (data)
+               memcpy(skb_put(skb, data_len), data, data_len);
 
-       memcpy(hdev->eir, cp.data, sizeof(cp.data));
+       hci_send_to_sock(NULL, skb, skip_sk);
+       kfree_skb(skb);
 
-       return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+       return 0;
 }
 
-static u8 get_service_classes(struct hci_dev *hdev)
+static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
+                                                                       u16 len)
 {
-       struct bt_uuid *uuid;
-       u8 val = 0;
+       struct mgmt_mode *cp;
+       struct hci_dev *hdev;
+       __le32 ev;
+       int err;
 
-       list_for_each_entry(uuid, &hdev->uuids, list)
-               val |= uuid->svc_hint;
+       cp = (void *) data;
 
-       return val;
-}
+       BT_DBG("request for hci%u", index);
 
-static int update_class(struct hci_dev *hdev)
-{
-       u8 cod[3];
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
+                                               MGMT_STATUS_INVALID_PARAMS);
 
-       BT_DBG("%s", hdev->name);
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
+                                               MGMT_STATUS_INVALID_PARAMS);
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
-               return 0;
+       hci_dev_lock(hdev);
 
-       cod[0] = hdev->minor_class;
-       cod[1] = hdev->major_class;
-       cod[2] = get_service_classes(hdev);
+       if (cp->val)
+               set_bit(HCI_PAIRABLE, &hdev->flags);
+       else
+               clear_bit(HCI_PAIRABLE, &hdev->flags);
 
-       if (memcmp(cod, hdev->dev_class, 3) == 0)
-               return 0;
+       err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
+       if (err < 0)
+               goto failed;
 
-       return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+       ev = cpu_to_le32(get_current_settings(hdev));
+
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
+
+failed:
+       hci_dev_unlock(hdev);
+       hci_dev_put(hdev);
+
+       return err;
 }
 
 static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@ -827,7 +901,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_ADD_UUID,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
        if (!uuid) {
@@ -851,7 +925,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
        err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -878,7 +952,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
                err = hci_uuids_clear(hdev);
@@ -914,7 +988,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
        err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
 
 unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -940,62 +1014,24 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        hdev->major_class = cp->major;
        hdev->minor_class = cp->minor;
 
+       if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
+               hci_dev_unlock(hdev);
+               cancel_delayed_work_sync(&hdev->service_cache);
+               hci_dev_lock(hdev);
+               update_eir(hdev);
+       }
+
        err = update_class(hdev);
 
        if (err == 0)
                err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
 
-       hci_dev_unlock_bh(hdev);
-       hci_dev_put(hdev);
-
-       return err;
-}
-
-static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
-                                                                       u16 len)
-{
-       struct hci_dev *hdev;
-       struct mgmt_cp_set_service_cache *cp;
-       int err;
-
-       cp = (void *) data;
-
-       if (len != sizeof(*cp))
-               return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
-                                               MGMT_STATUS_INVALID_PARAMS);
-
-       hdev = hci_dev_get(index);
-       if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
-                                               MGMT_STATUS_INVALID_PARAMS);
-
-       hci_dev_lock_bh(hdev);
-
-       BT_DBG("hci%u enable %d", index, cp->enable);
-
-       if (cp->enable) {
-               set_bit(HCI_SERVICE_CACHE, &hdev->flags);
-               err = 0;
-       } else {
-               clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
-               err = update_class(hdev);
-               if (err == 0)
-                       err = update_eir(hdev);
-       }
-
-       if (err == 0)
-               err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
-                                                                       0);
-       else
-               cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
-
-
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1034,7 +1070,7 @@ static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
        BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
                                                                key_count);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        hci_link_keys_clear(hdev);
 
@@ -1054,7 +1090,7 @@ static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 
        cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return 0;
@@ -1082,7 +1118,7 @@ static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        memset(&rp, 0, sizeof(rp));
        bacpy(&rp.bdaddr, &cp->bdaddr);
@@ -1123,7 +1159,7 @@ unlock:
        if (err < 0)
                err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
                                                                sizeof(rp));
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1151,7 +1187,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_DISCONNECT,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
@@ -1189,7 +1225,7 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1231,7 +1267,7 @@ static int get_connections(struct sock *sk, u16 index)
                return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        count = 0;
        list_for_each(p, &hdev->conn_hash.list) {
@@ -1263,7 +1299,7 @@ static int get_connections(struct sock *sk, u16 index)
 
 unlock:
        kfree(rp);
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
        return err;
 }
@@ -1311,7 +1347,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
@@ -1354,7 +1390,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1380,7 +1416,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
@@ -1391,7 +1427,7 @@ static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
        err = send_pin_code_neg_reply(sk, index, hdev, cp);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1416,14 +1452,14 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        hdev->io_capability = cp->io_capability;
 
        BT_DBG("%s IO capability set to 0x%02x", hdev->name,
                                                        hdev->io_capability);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
@@ -1504,7 +1540,7 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        sec_level = BT_SECURITY_MEDIUM;
        if (cp->io_cap == 0x03)
@@ -1561,64 +1597,144 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
        err = 0;
 
 unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
 }
 
-static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
-                                                       u16 len, int success)
+static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
+                                       u16 mgmt_op, u16 hci_op, __le32 passkey)
 {
-       struct mgmt_cp_user_confirm_reply *cp = (void *) data;
-       u16 mgmt_op, hci_op;
        struct pending_cmd *cmd;
        struct hci_dev *hdev;
+       struct hci_conn *conn;
        int err;
 
-       BT_DBG("");
-
-       if (success) {
-               mgmt_op = MGMT_OP_USER_CONFIRM_REPLY;
-               hci_op = HCI_OP_USER_CONFIRM_REPLY;
-       } else {
-               mgmt_op = MGMT_OP_USER_CONFIRM_NEG_REPLY;
-               hci_op = HCI_OP_USER_CONFIRM_NEG_REPLY;
-       }
-
-       if (len != sizeof(*cp))
-               return cmd_status(sk, index, mgmt_op,
-                                               MGMT_STATUS_INVALID_PARAMS);
-
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, mgmt_op,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
-               err = cmd_status(sk, index, mgmt_op, ENETDOWN);
-               goto failed;
+               err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
+               goto done;
+       }
+
+       /*
+        * Check for an existing ACL link, if present pair via
+        * HCI commands.
+        *
+        * If no ACL link is present, check for an LE link and if
+        * present, pair via the SMP engine.
+        *
+        * If neither ACL nor LE links are present, fail with error.
+        */
+       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
+       if (!conn) {
+               conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
+               if (!conn) {
+                       err = cmd_status(sk, index, mgmt_op,
+                                               MGMT_STATUS_NOT_CONNECTED);
+                       goto done;
+               }
+
+               /* Continue with pairing via SMP */
+
+               err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_SUCCESS);
+               goto done;
        }
 
-       cmd = mgmt_pending_add(sk, mgmt_op, hdev, data, len);
+       cmd = mgmt_pending_add(sk, mgmt_op, hdev, bdaddr, sizeof(*bdaddr));
        if (!cmd) {
                err = -ENOMEM;
-               goto failed;
+               goto done;
        }
 
-       err = hci_send_cmd(hdev, hci_op, sizeof(cp->bdaddr), &cp->bdaddr);
+       /* Continue with pairing via HCI */
+       if (hci_op == HCI_OP_USER_PASSKEY_REPLY) {
+               struct hci_cp_user_passkey_reply cp;
+
+               bacpy(&cp.bdaddr, bdaddr);
+               cp.passkey = passkey;
+               err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp);
+       } else
+               err = hci_send_cmd(hdev, hci_op, sizeof(*bdaddr), bdaddr);
+
        if (err < 0)
                mgmt_pending_remove(cmd);
 
-failed:
-       hci_dev_unlock_bh(hdev);
+done:
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
 }
 
+static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
+{
+       struct mgmt_cp_user_confirm_reply *cp = (void *) data;
+
+       BT_DBG("");
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       return user_pairing_resp(sk, index, &cp->bdaddr,
+                       MGMT_OP_USER_CONFIRM_REPLY,
+                       HCI_OP_USER_CONFIRM_REPLY, 0);
+}
+
+static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
+                                                                       u16 len)
+{
+       struct mgmt_cp_user_confirm_neg_reply *cp = data;
+
+       BT_DBG("");
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       return user_pairing_resp(sk, index, &cp->bdaddr,
+                       MGMT_OP_USER_CONFIRM_NEG_REPLY,
+                       HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
+}
+
+static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
+{
+       struct mgmt_cp_user_passkey_reply *cp = (void *) data;
+
+       BT_DBG("");
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
+                                                                       EINVAL);
+
+       return user_pairing_resp(sk, index, &cp->bdaddr,
+                       MGMT_OP_USER_PASSKEY_REPLY,
+                       HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
+}
+
+static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
+                                                                       u16 len)
+{
+       struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
+
+       BT_DBG("");
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
+                                                                       EINVAL);
+
+       return user_pairing_resp(sk, index, &cp->bdaddr,
+                       MGMT_OP_USER_PASSKEY_NEG_REPLY,
+                       HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
+}
+
 static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
                                                                u16 len)
 {
@@ -1639,7 +1755,7 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
        if (!cmd) {
@@ -1654,7 +1770,7 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1673,7 +1789,7 @@ static int read_local_oob_data(struct sock *sk, u16 index)
                return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
@@ -1704,7 +1820,7 @@ static int read_local_oob_data(struct sock *sk, u16 index)
                mgmt_pending_remove(cmd);
 
 unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1728,7 +1844,7 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
                                                                cp->randomizer);
@@ -1739,7 +1855,7 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
                err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
                                                                        0);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1763,7 +1879,7 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
        if (err < 0)
@@ -1773,26 +1889,32 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
                err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                                NULL, 0);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
 }
 
-static int start_discovery(struct sock *sk, u16 index)
+static int start_discovery(struct sock *sk, u16 index,
+                                               unsigned char *data, u16 len)
 {
+       struct mgmt_cp_start_discovery *cp = (void *) data;
        struct pending_cmd *cmd;
        struct hci_dev *hdev;
        int err;
 
        BT_DBG("hci%u", index);
 
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
        hdev = hci_dev_get(index);
        if (!hdev)
                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
@@ -1811,7 +1933,7 @@ static int start_discovery(struct sock *sk, u16 index)
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1830,7 +1952,7 @@ static int stop_discovery(struct sock *sk, u16 index)
                return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
        if (!cmd) {
@@ -1843,7 +1965,7 @@ static int stop_discovery(struct sock *sk, u16 index)
                mgmt_pending_remove(cmd);
 
 failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1867,7 +1989,7 @@ static int block_device(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        err = hci_blacklist_add(hdev, &cp->bdaddr);
        if (err < 0)
@@ -1877,7 +1999,7 @@ static int block_device(struct sock *sk, u16 index, unsigned char *data,
                err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
                                                        NULL, 0);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1901,7 +2023,7 @@ static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
 
        err = hci_blacklist_del(hdev, &cp->bdaddr);
 
@@ -1912,7 +2034,7 @@ static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
                err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
                                                                NULL, 0);
 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
@@ -1922,7 +2044,7 @@ static int set_fast_connectable(struct sock *sk, u16 index,
                                        unsigned char *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_set_fast_connectable *cp = (void *) data;
+       struct mgmt_mode *cp = (void *) data;
        struct hci_cp_write_page_scan_activity acp;
        u8 type;
        int err;
@@ -1940,7 +2062,7 @@ static int set_fast_connectable(struct sock *sk, u16 index,
 
        hci_dev_lock(hdev);
 
-       if (cp->enable) {
+       if (cp->val) {
                type = PAGE_SCAN_TYPE_INTERLACED;
                acp.interval = 0x0024;  /* 22.5 msec page scan interval */
        } else {
@@ -2024,6 +2146,10 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
        case MGMT_OP_SET_CONNECTABLE:
                err = set_connectable(sk, index, buf + sizeof(*hdr), len);
                break;
+       case MGMT_OP_SET_FAST_CONNECTABLE:
+               err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
+                                                               len);
+               break;
        case MGMT_OP_SET_PAIRABLE:
                err = set_pairable(sk, index, buf + sizeof(*hdr), len);
                break;
@@ -2036,9 +2162,6 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
        case MGMT_OP_SET_DEV_CLASS:
                err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
                break;
-       case MGMT_OP_SET_SERVICE_CACHE:
-               err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
-               break;
        case MGMT_OP_LOAD_LINK_KEYS:
                err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
                break;
@@ -2064,10 +2187,18 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                err = pair_device(sk, index, buf + sizeof(*hdr), len);
                break;
        case MGMT_OP_USER_CONFIRM_REPLY:
-               err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 1);
+               err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
                break;
        case MGMT_OP_USER_CONFIRM_NEG_REPLY:
-               err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len, 0);
+               err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
+                                                                       len);
+               break;
+       case MGMT_OP_USER_PASSKEY_REPLY:
+               err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
+               break;
+       case MGMT_OP_USER_PASSKEY_NEG_REPLY:
+               err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
+                                                                       len);
                break;
        case MGMT_OP_SET_LOCAL_NAME:
                err = set_local_name(sk, index, buf + sizeof(*hdr), len);
@@ -2083,7 +2214,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                                                                        len);
                break;
        case MGMT_OP_START_DISCOVERY:
-               err = start_discovery(sk, index);
+               err = start_discovery(sk, index, buf + sizeof(*hdr), len);
                break;
        case MGMT_OP_STOP_DISCOVERY:
                err = stop_discovery(sk, index);
@@ -2094,10 +2225,6 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
        case MGMT_OP_UNBLOCK_DEVICE:
                err = unblock_device(sk, index, buf + sizeof(*hdr), len);
                break;
-       case MGMT_OP_SET_FAST_CONNECTABLE:
-               err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
-                                                               len);
-               break;
        default:
                BT_DBG("Unknown op %u", opcode);
                err = cmd_status(sk, index, opcode,
@@ -2140,17 +2267,14 @@ int mgmt_index_removed(struct hci_dev *hdev)
 struct cmd_lookup {
        u8 val;
        struct sock *sk;
+       struct hci_dev *hdev;
 };
 
-static void mode_rsp(struct pending_cmd *cmd, void *data)
+static void settings_rsp(struct pending_cmd *cmd, void *data)
 {
-       struct mgmt_mode *cp = cmd->param;
        struct cmd_lookup *match = data;
 
-       if (cp->val != match->val)
-               return;
-
-       send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
+       send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
 
        list_del(&cmd->list);
 
@@ -2164,20 +2288,21 @@ static void mode_rsp(struct pending_cmd *cmd, void *data)
 
 int mgmt_powered(struct hci_dev *hdev, u8 powered)
 {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { powered, NULL };
+       struct cmd_lookup match = { powered, NULL, hdev };
+       __le32 ev;
        int ret;
 
-       mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
        if (!powered) {
                u8 status = ENETDOWN;
                mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
        }
 
-       ev.val = powered;
+       ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
+                                                               match.sk);
 
        if (match.sk)
                sock_put(match.sk);
@@ -2187,17 +2312,16 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
 
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { discoverable, NULL };
+       struct cmd_lookup match = { discoverable, NULL, hdev };
+       __le32 ev;
        int ret;
 
-       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
 
-       ev.val = discoverable;
+       ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
                                                                match.sk);
-
        if (match.sk)
                sock_put(match.sk);
 
@@ -2206,15 +2330,16 @@ int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
 {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { connectable, NULL };
+       __le32 ev;
+       struct cmd_lookup match = { connectable, NULL, hdev };
        int ret;
 
-       mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
+                                                               &match);
 
-       ev.val = connectable;
+       ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
 
        if (match.sk)
                sock_put(match.sk);
@@ -2429,7 +2554,19 @@ int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                                        NULL);
 }
 
-static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
+{
+       struct mgmt_ev_user_passkey_request ev;
+
+       BT_DBG("%s", hdev->name);
+
+       bacpy(&ev.bdaddr, bdaddr);
+
+       return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
+                                                                       NULL);
+}
+
+static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                        u8 status, u8 opcode)
 {
        struct pending_cmd *cmd;
@@ -2452,17 +2589,31 @@ static int confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                                u8 status)
 {
-       return confirm_reply_complete(hdev, bdaddr, mgmt_status(status),
+       return user_pairing_resp_complete(hdev, bdaddr, status,
                                                MGMT_OP_USER_CONFIRM_REPLY);
 }
 
 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
                                                bdaddr_t *bdaddr, u8 status)
 {
-       return confirm_reply_complete(hdev, bdaddr, mgmt_status(status),
+       return user_pairing_resp_complete(hdev, bdaddr, status,
                                        MGMT_OP_USER_CONFIRM_NEG_REPLY);
 }
 
+int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                                               u8 status)
+{
+       return user_pairing_resp_complete(hdev, bdaddr, status,
+                                               MGMT_OP_USER_PASSKEY_REPLY);
+}
+
+int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
+                                               bdaddr_t *bdaddr, u8 status)
+{
+       return user_pairing_resp_complete(hdev, bdaddr, status,
+                                       MGMT_OP_USER_PASSKEY_NEG_REPLY);
+}
+
 int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
 {
        struct mgmt_ev_auth_failed ev;