Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/blueto...

diff --combined include/net/bluetooth/hci_core.h
index ea4395f,74f8356..25c161a
--- 1/include/net/bluetooth/hci_core.h
--- 2/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@@ -61,18 -61,11 +61,11 @@@ struct inquiry_cache 
  
  struct hci_conn_hash {
        struct list_head list;
-       spinlock_t       lock;
        unsigned int     acl_num;
        unsigned int     sco_num;
        unsigned int     le_num;
  };
  
- struct hci_chan_hash {
-       struct list_head list;
-       spinlock_t       lock;
-       unsigned int     num;
- };
- 
  struct bdaddr_list {
        struct list_head list;
        bdaddr_t bdaddr;
@@@ -124,7 -117,7 +117,7 @@@ struct adv_entry 
  #define NUM_REASSEMBLY 4
  struct hci_dev {
        struct list_head list;
-       spinlock_t      lock;
+       struct mutex    lock;
        atomic_t        refcnt;
  
        char            name[8];
@@@ -188,6 -181,11 +181,11 @@@
        unsigned int    sco_pkts;
        unsigned int    le_pkts;
  
+       __u16           block_len;
+       __u16           block_mtu;
+       __u16           num_blocks;
+       __u16           block_cnt;
+ 
        unsigned long   acl_last_tx;
        unsigned long   sco_last_tx;
        unsigned long   le_last_tx;
@@@ -200,10 -198,13 +198,13 @@@
        __u16                   discov_timeout;
        struct delayed_work     discov_off;
  
+       struct delayed_work     service_cache;
+ 
        struct timer_list       cmd_timer;
-       struct tasklet_struct   cmd_task;
-       struct tasklet_struct   rx_task;
-       struct tasklet_struct   tx_task;
+ 
+       struct work_struct      rx_work;
+       struct work_struct      cmd_work;
+       struct work_struct      tx_work;
  
        struct sk_buff_head     rx_q;
        struct sk_buff_head     raw_q;
@@@ -232,7 -233,7 +233,7 @@@
        struct list_head        remote_oob_data;
  
        struct list_head        adv_entries;
-       struct timer_list       adv_timer;
+       struct delayed_work     adv_work;
  
        struct hci_dev_stats    stat;
  
@@@ -301,15 -302,12 +302,12 @@@ struct hci_conn 
        unsigned int    sent;
  
        struct sk_buff_head data_q;
-       struct hci_chan_hash chan_hash;
+       struct list_head chan_list;
  
-       struct timer_list disc_timer;
+       struct delayed_work disc_work;
        struct timer_list idle_timer;
        struct timer_list auto_accept_timer;
  
-       struct work_struct work_add;
-       struct work_struct work_del;
- 
        struct device   dev;
        atomic_t        devref;
  
@@@ -390,15 -388,15 +388,15 @@@ static inline void hci_conn_hash_init(s
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
        INIT_LIST_HEAD(&h->list);
-       spin_lock_init(&h->lock);
        h->acl_num = 0;
        h->sco_num = 0;
+       h->le_num = 0;
  }
  
  static inline void hci_conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
-       list_add(&c->list, &h->list);
+       list_add_rcu(&c->list, &h->list);
        switch (c->type) {
        case ACL_LINK:
                h->acl_num++;
@@@ -416,7 -414,10 +414,10 @@@
  static inline void hci_conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
-       list_del(&c->list);
+ 
+       list_del_rcu(&c->list);
+       synchronize_rcu();
+ 
        switch (c->type) {
        case ACL_LINK:
                h->acl_num--;
@@@ -451,14 -452,18 +452,18 @@@ static inline struct hci_conn *hci_conn
                                                                __u16 handle)
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
-       struct list_head *p;
        struct hci_conn  *c;
  
-       list_for_each(p, &h->list) {
-               c = list_entry(p, struct hci_conn, list);
-               if (c->handle == handle)
+       rcu_read_lock();
+ 
+       list_for_each_entry_rcu(c, &h->list, list) {
+               if (c->handle == handle) {
+                       rcu_read_unlock();
                        return c;
+               }
        }
+       rcu_read_unlock();
+ 
        return NULL;
  }
  
@@@ -466,14 -471,19 +471,19 @@@ static inline struct hci_conn *hci_conn
                                                        __u8 type, bdaddr_t *ba)
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
-       struct list_head *p;
        struct hci_conn  *c;
  
-       list_for_each(p, &h->list) {
-               c = list_entry(p, struct hci_conn, list);
-               if (c->type == type && !bacmp(&c->dst, ba))
+       rcu_read_lock();
+ 
+       list_for_each_entry_rcu(c, &h->list, list) {
+               if (c->type == type && !bacmp(&c->dst, ba)) {
+                       rcu_read_unlock();
                        return c;
+               }
        }
+ 
+       rcu_read_unlock();
+ 
        return NULL;
  }
  
@@@ -481,37 -491,20 +491,20 @@@ static inline struct hci_conn *hci_conn
                                                        __u8 type, __u16 state)
  {
        struct hci_conn_hash *h = &hdev->conn_hash;
-       struct list_head *p;
        struct hci_conn  *c;
  
-       list_for_each(p, &h->list) {
-               c = list_entry(p, struct hci_conn, list);
-               if (c->type == type && c->state == state)
+       rcu_read_lock();
+ 
+       list_for_each_entry_rcu(c, &h->list, list) {
+               if (c->type == type && c->state == state) {
+                       rcu_read_unlock();
                        return c;
+               }
        }
-       return NULL;
- }
- 
- static inline void hci_chan_hash_init(struct hci_conn *c)
- {
-       struct hci_chan_hash *h = &c->chan_hash;
-       INIT_LIST_HEAD(&h->list);
-       spin_lock_init(&h->lock);
-       h->num = 0;
- }
  
- static inline void hci_chan_hash_add(struct hci_conn *c, struct hci_chan *chan)
- {
-       struct hci_chan_hash *h = &c->chan_hash;
-       list_add(&chan->list, &h->list);
-       h->num++;
- }
+       rcu_read_unlock();
  
- static inline void hci_chan_hash_del(struct hci_conn *c, struct hci_chan *chan)
- {
-       struct hci_chan_hash *h = &c->chan_hash;
-       list_del(&chan->list);
-       h->num--;
+       return NULL;
  }
  
  void hci_acl_connect(struct hci_conn *conn);
@@@ -527,7 -520,7 +520,7 @@@ void hci_conn_check_pending(struct hci_
  
  struct hci_chan *hci_chan_create(struct hci_conn *conn);
  int hci_chan_del(struct hci_chan *chan);
- void hci_chan_hash_flush(struct hci_conn *conn);
+ void hci_chan_list_flush(struct hci_conn *conn);
  
  struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst,
                                                __u8 sec_level, __u8 auth_type);
@@@ -538,7 -531,6 +531,6 @@@ int hci_conn_change_link_key(struct hci
  int hci_conn_switch_role(struct hci_conn *conn, __u8 role);
  
  void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active);
- void hci_conn_enter_sniff_mode(struct hci_conn *conn);
  
  void hci_conn_hold_device(struct hci_conn *conn);
  void hci_conn_put_device(struct hci_conn *conn);
@@@ -546,7 -538,7 +538,7 @@@
  static inline void hci_conn_hold(struct hci_conn *conn)
  {
        atomic_inc(&conn->refcnt);
-       del_timer(&conn->disc_timer);
+       cancel_delayed_work_sync(&conn->disc_work);
  }
  
  static inline void hci_conn_put(struct hci_conn *conn)
@@@ -565,7 -557,9 +557,9 @@@
                } else {
                        timeo = msecs_to_jiffies(10);
                }
-               mod_timer(&conn->disc_timer, jiffies + timeo);
+               cancel_delayed_work_sync(&conn->disc_work);
+               queue_delayed_work(conn->hdev->workqueue,
+                                       &conn->disc_work, jiffies + timeo);
        }
  }
  
@@@ -576,15 -570,11 +570,15 @@@ static inline void __hci_dev_put(struc
                d->destruct(d);
  }
  
 -static inline void hci_dev_put(struct hci_dev *d)
 -{
 -      __hci_dev_put(d);
 -      module_put(d->owner);
 -}
 +/*
 + * hci_dev_put and hci_dev_hold are macros to avoid dragging all the
 + * overhead of all the modular infrastructure into this header.
 + */
 +#define hci_dev_put(d)                \
 +do {                          \
 +      __hci_dev_put(d);       \
 +      module_put(d->owner);   \
 +} while (0)
  
  static inline struct hci_dev *__hci_dev_hold(struct hci_dev *d)
  {
@@@ -592,15 -582,15 +586,13 @@@
        return d;
  }
  
 -static inline struct hci_dev *hci_dev_hold(struct hci_dev *d)
 -{
 -      if (try_module_get(d->owner))
 -              return __hci_dev_hold(d);
 -      return NULL;
 -}
 +#define hci_dev_hold(d)                                               \
 +({                                                            \
 +      try_module_get(d->owner) ? __hci_dev_hold(d) : NULL;    \
 +})
  
- #define hci_dev_lock(d)               spin_lock(&d->lock)
- #define hci_dev_unlock(d)     spin_unlock(&d->lock)
- #define hci_dev_lock_bh(d)    spin_lock_bh(&d->lock)
- #define hci_dev_unlock_bh(d)  spin_unlock_bh(&d->lock)
+ #define hci_dev_lock(d)               mutex_lock(&d->lock)
+ #define hci_dev_unlock(d)     mutex_unlock(&d->lock)
  
  struct hci_dev *hci_dev_get(int index);
  struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
@@@ -960,12 -950,16 +952,16 @@@ int mgmt_device_unblocked(struct hci_de
  /* HCI info for socket */
  #define hci_pi(sk) ((struct hci_pinfo *) sk)
  
+ /* HCI socket flags */
+ #define HCI_PI_MGMT_INIT      0
+ 
  struct hci_pinfo {
        struct bt_sock    bt;
        struct hci_dev    *hdev;
        struct hci_filter filter;
        __u32             cmsg_mask;
        unsigned short   channel;
+       unsigned long     flags;
  };
  
  /* HCI security filter */

diff --combined net/bluetooth/hci_sysfs.c
index c62d254,db6af70..5210956
--- 1/net/bluetooth/hci_sysfs.c
--- 2/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@@ -5,7 -5,6 +5,7 @@@
  #include <linux/init.h>
  #include <linux/debugfs.h>
  #include <linux/seq_file.h>
 +#include <linux/module.h>
  
  #include <net/bluetooth/bluetooth.h>
  #include <net/bluetooth/hci_core.h>
@@@ -89,11 -88,35 +89,35 @@@ static struct device_type bt_link = 
        .release = bt_link_release,
  };
  
- static void add_conn(struct work_struct *work)
+ /*
+  * The rfcomm tty device will possibly retain even when conn
+  * is down, and sysfs doesn't support move zombie device,
+  * so we should move the device before conn device is destroyed.
+  */
+ static int __match_tty(struct device *dev, void *data)
+ {
+       return !strncmp(dev_name(dev), "rfcomm", 6);
+ }
+ 
+ void hci_conn_init_sysfs(struct hci_conn *conn)
+ {
+       struct hci_dev *hdev = conn->hdev;
+ 
+       BT_DBG("conn %p", conn);
+ 
+       conn->dev.type = &bt_link;
+       conn->dev.class = bt_class;
+       conn->dev.parent = &hdev->dev;
+ 
+       device_initialize(&conn->dev);
+ }
+ 
+ void hci_conn_add_sysfs(struct hci_conn *conn)
  {
-       struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
        struct hci_dev *hdev = conn->hdev;
  
+       BT_DBG("conn %p", conn);
+ 
        dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
  
        dev_set_drvdata(&conn->dev, conn);
@@@ -106,19 -129,8 +130,8 @@@
        hci_dev_hold(hdev);
  }
  
- /*
-  * The rfcomm tty device will possibly retain even when conn
-  * is down, and sysfs doesn't support move zombie device,
-  * so we should move the device before conn device is destroyed.
-  */
- static int __match_tty(struct device *dev, void *data)
- {
-       return !strncmp(dev_name(dev), "rfcomm", 6);
- }
- 
- static void del_conn(struct work_struct *work)
+ void hci_conn_del_sysfs(struct hci_conn *conn)
  {
-       struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
        struct hci_dev *hdev = conn->hdev;
  
        if (!device_is_registered(&conn->dev))
@@@ -140,36 -152,6 +153,6 @@@
        hci_dev_put(hdev);
  }
  
- void hci_conn_init_sysfs(struct hci_conn *conn)
- {
-       struct hci_dev *hdev = conn->hdev;
- 
-       BT_DBG("conn %p", conn);
- 
-       conn->dev.type = &bt_link;
-       conn->dev.class = bt_class;
-       conn->dev.parent = &hdev->dev;
- 
-       device_initialize(&conn->dev);
- 
-       INIT_WORK(&conn->work_add, add_conn);
-       INIT_WORK(&conn->work_del, del_conn);
- }
- 
- void hci_conn_add_sysfs(struct hci_conn *conn)
- {
-       BT_DBG("conn %p", conn);
- 
-       queue_work(conn->hdev->workqueue, &conn->work_add);
- }
- 
- void hci_conn_del_sysfs(struct hci_conn *conn)
- {
-       BT_DBG("conn %p", conn);
- 
-       queue_work(conn->hdev->workqueue, &conn->work_del);
- }
- 
  static inline char *host_bustostr(int bus)
  {
        switch (bus) {
@@@ -403,7 -385,7 +386,7 @@@ static int inquiry_cache_show(struct se
        struct inquiry_cache *cache = &hdev->inq_cache;
        struct inquiry_entry *e;
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        for (e = cache->list; e; e = e->next) {
                struct inquiry_data *data = &e->data;
@@@ -416,7 -398,7 +399,7 @@@
                           data->rssi, data->ssp_mode, e->timestamp);
        }
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
  
        return 0;
  }
@@@ -438,12 -420,12 +421,12 @@@ static int blacklist_show(struct seq_fi
        struct hci_dev *hdev = f->private;
        struct bdaddr_list *b;
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        list_for_each_entry(b, &hdev->blacklist, list)
                seq_printf(f, "%s\n", batostr(&b->bdaddr));
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
  
        return 0;
  }
@@@ -482,12 -464,12 +465,12 @@@ static int uuids_show(struct seq_file *
        struct hci_dev *hdev = f->private;
        struct bt_uuid *uuid;
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        list_for_each_entry(uuid, &hdev->uuids, list)
                print_bt_uuid(f, uuid->uuid);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
  
        return 0;
  }
@@@ -508,11 -490,11 +491,11 @@@ static int auto_accept_delay_set(void *
  {
        struct hci_dev *hdev = data;
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        hdev->auto_accept_delay = val;
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
  
        return 0;
  }
@@@ -521,11 -503,11 +504,11 @@@ static int auto_accept_delay_get(void *
  {
        struct hci_dev *hdev = data;
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        *val = hdev->auto_accept_delay;
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
  
        return 0;
  }

diff --combined net/bluetooth/l2cap_sock.c
index f737043,5e09766..9ca5616
--- 1/net/bluetooth/l2cap_sock.c
--- 2/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@@ -3,6 -3,7 +3,7 @@@
     Copyright (C) 2000-2001 Qualcomm Incorporated
     Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
     Copyright (C) 2010 Google Inc.
+    Copyright (C) 2011 ProFUSION Embedded Systems
  
     Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  
@@@ -27,7 -28,6 +28,7 @@@
  /* Bluetooth L2CAP sockets. */
  
  #include <linux/security.h>
 +#include <linux/export.h>
  
  #include <net/bluetooth/bluetooth.h>
  #include <net/bluetooth/hci_core.h>
@@@ -122,70 -122,15 +123,15 @@@ static int l2cap_sock_connect(struct so
        if (la.l2_cid && la.l2_psm)
                return -EINVAL;
  
-       lock_sock(sk);
- 
-       if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED
-                       && !(la.l2_psm || la.l2_cid)) {
-               err = -EINVAL;
-               goto done;
-       }
- 
-       switch (chan->mode) {
-       case L2CAP_MODE_BASIC:
-               break;
-       case L2CAP_MODE_ERTM:
-       case L2CAP_MODE_STREAMING:
-               if (!disable_ertm)
-                       break;
-               /* fall through */
-       default:
-               err = -ENOTSUPP;
-               goto done;
-       }
- 
-       switch (sk->sk_state) {
-       case BT_CONNECT:
-       case BT_CONNECT2:
-       case BT_CONFIG:
-               /* Already connecting */
-               goto wait;
- 
-       case BT_CONNECTED:
-               /* Already connected */
-               err = -EISCONN;
-               goto done;
- 
-       case BT_OPEN:
-       case BT_BOUND:
-               /* Can connect */
-               break;
- 
-       default:
-               err = -EBADFD;
-               goto done;
-       }
- 
-       /* PSM must be odd and lsb of upper byte must be 0 */
-       if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && !la.l2_cid &&
-                                       chan->chan_type != L2CAP_CHAN_RAW) {
-               err = -EINVAL;
-               goto done;
-       }
- 
-       /* Set destination address and psm */
-       bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
-       chan->psm = la.l2_psm;
-       chan->dcid = la.l2_cid;
- 
-       err = l2cap_chan_connect(l2cap_pi(sk)->chan);
+       err = l2cap_chan_connect(chan, la.l2_psm, la.l2_cid, &la.l2_bdaddr);
        if (err)
                goto done;
  
- wait:
        err = bt_sock_wait_state(sk, BT_CONNECTED,
                        sock_sndtimeo(sk, flags & O_NONBLOCK));
  done:
-       release_sock(sk);
+       if (sock_owned_by_user(sk))
+               release_sock(sk);
        return err;
  }
  

diff --combined net/bluetooth/mgmt.c
index 1ce549b,8413f55..fbcbef6
--- 1/net/bluetooth/mgmt.c
--- 2/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@@ -24,7 -24,6 +24,7 @@@
  
  #include <linux/kernel.h>
  #include <linux/uaccess.h>
 +#include <linux/module.h>
  #include <asm/unaligned.h>
  
  #include <net/bluetooth/bluetooth.h>
@@@ -36,6 -35,8 +36,8 @@@
  
  #define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
  
+ #define SERVICE_CACHE_TIMEOUT (5 * 1000)
+ 
  struct pending_cmd {
        struct list_head list;
        u16 opcode;
@@@ -243,6 -244,262 +245,262 @@@ static int read_index_list(struct sock 
        return err;
  }
  
+ static u32 get_supported_settings(struct hci_dev *hdev)
+ {
+       u32 settings = 0;
+ 
+       settings |= MGMT_SETTING_POWERED;
+       settings |= MGMT_SETTING_CONNECTABLE;
+       settings |= MGMT_SETTING_FAST_CONNECTABLE;
+       settings |= MGMT_SETTING_DISCOVERABLE;
+       settings |= MGMT_SETTING_PAIRABLE;
+ 
+       if (hdev->features[6] & LMP_SIMPLE_PAIR)
+               settings |= MGMT_SETTING_SSP;
+ 
+       if (!(hdev->features[4] & LMP_NO_BREDR)) {
+               settings |= MGMT_SETTING_BREDR;
+               settings |= MGMT_SETTING_LINK_SECURITY;
+       }
+ 
+       if (hdev->features[4] & LMP_LE)
+               settings |= MGMT_SETTING_LE;
+ 
+       return settings;
+ }
+ 
+ static u32 get_current_settings(struct hci_dev *hdev)
+ {
+       u32 settings = 0;
+ 
+       if (test_bit(HCI_UP, &hdev->flags))
+               settings |= MGMT_SETTING_POWERED;
+       else
+               return settings;
+ 
+       if (test_bit(HCI_PSCAN, &hdev->flags))
+               settings |= MGMT_SETTING_CONNECTABLE;
+ 
+       if (test_bit(HCI_ISCAN, &hdev->flags))
+               settings |= MGMT_SETTING_DISCOVERABLE;
+ 
+       if (test_bit(HCI_PAIRABLE, &hdev->flags))
+               settings |= MGMT_SETTING_PAIRABLE;
+ 
+       if (!(hdev->features[4] & LMP_NO_BREDR))
+               settings |= MGMT_SETTING_BREDR;
+ 
+       if (hdev->extfeatures[0] & LMP_HOST_LE)
+               settings |= MGMT_SETTING_LE;
+ 
+       if (test_bit(HCI_AUTH, &hdev->flags))
+               settings |= MGMT_SETTING_LINK_SECURITY;
+ 
+       if (hdev->ssp_mode > 0)
+               settings |= MGMT_SETTING_SSP;
+ 
+       return settings;
+ }
+ 
+ #define EIR_FLAGS             0x01 /* flags */
+ #define EIR_UUID16_SOME               0x02 /* 16-bit UUID, more available */
+ #define EIR_UUID16_ALL                0x03 /* 16-bit UUID, all listed */
+ #define EIR_UUID32_SOME               0x04 /* 32-bit UUID, more available */
+ #define EIR_UUID32_ALL                0x05 /* 32-bit UUID, all listed */
+ #define EIR_UUID128_SOME      0x06 /* 128-bit UUID, more available */
+ #define EIR_UUID128_ALL               0x07 /* 128-bit UUID, all listed */
+ #define EIR_NAME_SHORT                0x08 /* shortened local name */
+ #define EIR_NAME_COMPLETE     0x09 /* complete local name */
+ #define EIR_TX_POWER          0x0A /* transmit power level */
+ #define EIR_DEVICE_ID         0x10 /* device ID */
+ 
+ #define PNP_INFO_SVCLASS_ID           0x1200
+ 
+ static u8 bluetooth_base_uuid[] = {
+                       0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
+                       0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+ };
+ 
+ static u16 get_uuid16(u8 *uuid128)
+ {
+       u32 val;
+       int i;
+ 
+       for (i = 0; i < 12; i++) {
+               if (bluetooth_base_uuid[i] != uuid128[i])
+                       return 0;
+       }
+ 
+       memcpy(&val, &uuid128[12], 4);
+ 
+       val = le32_to_cpu(val);
+       if (val > 0xffff)
+               return 0;
+ 
+       return (u16) val;
+ }
+ 
+ static void create_eir(struct hci_dev *hdev, u8 *data)
+ {
+       u8 *ptr = data;
+       u16 eir_len = 0;
+       u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
+       int i, truncated = 0;
+       struct bt_uuid *uuid;
+       size_t name_len;
+ 
+       name_len = strlen(hdev->dev_name);
+ 
+       if (name_len > 0) {
+               /* EIR Data type */
+               if (name_len > 48) {
+                       name_len = 48;
+                       ptr[1] = EIR_NAME_SHORT;
+               } else
+                       ptr[1] = EIR_NAME_COMPLETE;
+ 
+               /* EIR Data length */
+               ptr[0] = name_len + 1;
+ 
+               memcpy(ptr + 2, hdev->dev_name, name_len);
+ 
+               eir_len += (name_len + 2);
+               ptr += (name_len + 2);
+       }
+ 
+       memset(uuid16_list, 0, sizeof(uuid16_list));
+ 
+       /* Group all UUID16 types */
+       list_for_each_entry(uuid, &hdev->uuids, list) {
+               u16 uuid16;
+ 
+               uuid16 = get_uuid16(uuid->uuid);
+               if (uuid16 == 0)
+                       return;
+ 
+               if (uuid16 < 0x1100)
+                       continue;
+ 
+               if (uuid16 == PNP_INFO_SVCLASS_ID)
+                       continue;
+ 
+               /* Stop if not enough space to put next UUID */
+               if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
+                       truncated = 1;
+                       break;
+               }
+ 
+               /* Check for duplicates */
+               for (i = 0; uuid16_list[i] != 0; i++)
+                       if (uuid16_list[i] == uuid16)
+                               break;
+ 
+               if (uuid16_list[i] == 0) {
+                       uuid16_list[i] = uuid16;
+                       eir_len += sizeof(u16);
+               }
+       }
+ 
+       if (uuid16_list[0] != 0) {
+               u8 *length = ptr;
+ 
+               /* EIR Data type */
+               ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
+ 
+               ptr += 2;
+               eir_len += 2;
+ 
+               for (i = 0; uuid16_list[i] != 0; i++) {
+                       *ptr++ = (uuid16_list[i] & 0x00ff);
+                       *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
+               }
+ 
+               /* EIR Data length */
+               *length = (i * sizeof(u16)) + 1;
+       }
+ }
+ 
+ static int update_eir(struct hci_dev *hdev)
+ {
+       struct hci_cp_write_eir cp;
+ 
+       if (!(hdev->features[6] & LMP_EXT_INQ))
+               return 0;
+ 
+       if (hdev->ssp_mode == 0)
+               return 0;
+ 
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return 0;
+ 
+       memset(&cp, 0, sizeof(cp));
+ 
+       create_eir(hdev, cp.data);
+ 
+       if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
+               return 0;
+ 
+       memcpy(hdev->eir, cp.data, sizeof(cp.data));
+ 
+       return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
+ }
+ 
+ static u8 get_service_classes(struct hci_dev *hdev)
+ {
+       struct bt_uuid *uuid;
+       u8 val = 0;
+ 
+       list_for_each_entry(uuid, &hdev->uuids, list)
+               val |= uuid->svc_hint;
+ 
+       return val;
+ }
+ 
+ static int update_class(struct hci_dev *hdev)
+ {
+       u8 cod[3];
+ 
+       BT_DBG("%s", hdev->name);
+ 
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return 0;
+ 
+       cod[0] = hdev->minor_class;
+       cod[1] = hdev->major_class;
+       cod[2] = get_service_classes(hdev);
+ 
+       if (memcmp(cod, hdev->dev_class, 3) == 0)
+               return 0;
+ 
+       return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
+ }
+ 
+ static void service_cache_off(struct work_struct *work)
+ {
+       struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                                       service_cache.work);
+ 
+       if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               return;
+ 
+       hci_dev_lock(hdev);
+ 
+       update_eir(hdev);
+       update_class(hdev);
+ 
+       hci_dev_unlock(hdev);
+ }
+ 
+ static void mgmt_init_hdev(struct hci_dev *hdev)
+ {
+       if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
+               INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
+ 
+       if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
+               schedule_delayed_work(&hdev->service_cache,
+                               msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
+ }
+ 
  static int read_controller_info(struct sock *sk, u16 index)
  {
        struct mgmt_rp_read_info rp;
@@@ -258,36 -515,27 +516,27 @@@
        if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
                cancel_delayed_work_sync(&hdev->power_off);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
-       set_bit(HCI_MGMT, &hdev->flags);
+       if (test_and_clear_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags))
+               mgmt_init_hdev(hdev);
  
        memset(&rp, 0, sizeof(rp));
  
-       rp.type = hdev->dev_type;
+       bacpy(&rp.bdaddr, &hdev->bdaddr);
  
-       rp.powered = test_bit(HCI_UP, &hdev->flags);
-       rp.connectable = test_bit(HCI_PSCAN, &hdev->flags);
-       rp.discoverable = test_bit(HCI_ISCAN, &hdev->flags);
-       rp.pairable = test_bit(HCI_PSCAN, &hdev->flags);
+       rp.version = hdev->hci_ver;
  
-       if (test_bit(HCI_AUTH, &hdev->flags))
-               rp.sec_mode = 3;
-       else if (hdev->ssp_mode > 0)
-               rp.sec_mode = 4;
-       else
-               rp.sec_mode = 2;
+       put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
+ 
+       rp.supported_settings = cpu_to_le32(get_supported_settings(hdev));
+       rp.current_settings = cpu_to_le32(get_current_settings(hdev));
  
-       bacpy(&rp.bdaddr, &hdev->bdaddr);
-       memcpy(rp.features, hdev->features, 8);
        memcpy(rp.dev_class, hdev->dev_class, 3);
-       put_unaligned_le16(hdev->manufacturer, &rp.manufacturer);
-       rp.hci_ver = hdev->hci_ver;
-       put_unaligned_le16(hdev->hci_rev, &rp.hci_rev);
  
        memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name));
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
@@@ -366,13 -614,11 +615,11 @@@ static void mgmt_pending_remove(struct 
        mgmt_pending_free(cmd);
  }
  
- static int send_mode_rsp(struct sock *sk, u16 opcode, u16 index, u8 val)
+ static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
  {
-       struct mgmt_mode rp;
- 
-       rp.val = val;
+       __le32 settings = cpu_to_le32(get_current_settings(hdev));
  
-       return cmd_complete(sk, index, opcode, &rp, sizeof(rp));
+       return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
  }
  
  static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
@@@ -395,11 -641,11 +642,11 @@@
                return cmd_status(sk, index, MGMT_OP_SET_POWERED,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        up = test_bit(HCI_UP, &hdev->flags);
        if ((cp->val && up) || (!cp->val && !up)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_POWERED, cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev);
                goto failed;
        }
  
@@@ -416,14 -662,14 +663,14 @@@
        }
  
        if (cp->val)
-               queue_work(hdev->workqueue, &hdev->power_on);
+               schedule_work(&hdev->power_on);
        else
-               queue_work(hdev->workqueue, &hdev->power_off.work);
+               schedule_work(&hdev->power_off.work);
  
        err = 0;
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
        return err;
  }
@@@ -450,7 -696,7 +697,7 @@@ static int set_discoverable(struct soc
                return cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_SET_DISCOVERABLE,
@@@ -467,8 -713,7 +714,7 @@@
  
        if (cp->val == test_bit(HCI_ISCAN, &hdev->flags) &&
                                        test_bit(HCI_PSCAN, &hdev->flags)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_DISCOVERABLE,
-                                                               cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev);
                goto failed;
        }
  
@@@ -493,7 -738,7 +739,7 @@@
                hdev->discov_timeout = get_unaligned_le16(&cp->timeout);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -521,7 -766,7 +767,7 @@@ static int set_connectable(struct sock 
                return cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_SET_CONNECTABLE,
@@@ -537,8 -782,7 +783,7 @@@
        }
  
        if (cp->val == test_bit(HCI_PSCAN, &hdev->flags)) {
-               err = send_mode_rsp(sk, index, MGMT_OP_SET_CONNECTABLE,
-                                                               cp->val);
+               err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
                goto failed;
        }
  
@@@ -558,7 -802,7 +803,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -596,8 -840,9 +841,9 @@@ static int mgmt_event(u16 event, struc
  static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
                                                                        u16 len)
  {
-       struct mgmt_mode *cp, ev;
+       struct mgmt_mode *cp;
        struct hci_dev *hdev;
+       __le32 ev;
        int err;
  
        cp = (void *) data;
@@@ -613,201 -858,28 +859,28 @@@
                return cmd_status(sk, index, MGMT_OP_SET_PAIRABLE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (cp->val)
                set_bit(HCI_PAIRABLE, &hdev->flags);
        else
                clear_bit(HCI_PAIRABLE, &hdev->flags);
  
-       err = send_mode_rsp(sk, MGMT_OP_SET_PAIRABLE, index, cp->val);
+       err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
        if (err < 0)
                goto failed;
  
-       ev.val = cp->val;
+       ev = cpu_to_le32(get_current_settings(hdev));
  
-       err = mgmt_event(MGMT_EV_PAIRABLE, hdev, &ev, sizeof(ev), sk);
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), sk);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
  }
  
- #define EIR_FLAGS             0x01 /* flags */
- #define EIR_UUID16_SOME               0x02 /* 16-bit UUID, more available */
- #define EIR_UUID16_ALL                0x03 /* 16-bit UUID, all listed */
- #define EIR_UUID32_SOME               0x04 /* 32-bit UUID, more available */
- #define EIR_UUID32_ALL                0x05 /* 32-bit UUID, all listed */
- #define EIR_UUID128_SOME      0x06 /* 128-bit UUID, more available */
- #define EIR_UUID128_ALL               0x07 /* 128-bit UUID, all listed */
- #define EIR_NAME_SHORT                0x08 /* shortened local name */
- #define EIR_NAME_COMPLETE     0x09 /* complete local name */
- #define EIR_TX_POWER          0x0A /* transmit power level */
- #define EIR_DEVICE_ID         0x10 /* device ID */
- 
- #define PNP_INFO_SVCLASS_ID           0x1200
- 
- static u8 bluetooth_base_uuid[] = {
-                       0xFB, 0x34, 0x9B, 0x5F, 0x80, 0x00, 0x00, 0x80,
-                       0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
- };
- 
- static u16 get_uuid16(u8 *uuid128)
- {
-       u32 val;
-       int i;
- 
-       for (i = 0; i < 12; i++) {
-               if (bluetooth_base_uuid[i] != uuid128[i])
-                       return 0;
-       }
- 
-       memcpy(&val, &uuid128[12], 4);
- 
-       val = le32_to_cpu(val);
-       if (val > 0xffff)
-               return 0;
- 
-       return (u16) val;
- }
- 
- static void create_eir(struct hci_dev *hdev, u8 *data)
- {
-       u8 *ptr = data;
-       u16 eir_len = 0;
-       u16 uuid16_list[HCI_MAX_EIR_LENGTH / sizeof(u16)];
-       int i, truncated = 0;
-       struct bt_uuid *uuid;
-       size_t name_len;
- 
-       name_len = strlen(hdev->dev_name);
- 
-       if (name_len > 0) {
-               /* EIR Data type */
-               if (name_len > 48) {
-                       name_len = 48;
-                       ptr[1] = EIR_NAME_SHORT;
-               } else
-                       ptr[1] = EIR_NAME_COMPLETE;
- 
-               /* EIR Data length */
-               ptr[0] = name_len + 1;
- 
-               memcpy(ptr + 2, hdev->dev_name, name_len);
- 
-               eir_len += (name_len + 2);
-               ptr += (name_len + 2);
-       }
- 
-       memset(uuid16_list, 0, sizeof(uuid16_list));
- 
-       /* Group all UUID16 types */
-       list_for_each_entry(uuid, &hdev->uuids, list) {
-               u16 uuid16;
- 
-               uuid16 = get_uuid16(uuid->uuid);
-               if (uuid16 == 0)
-                       return;
- 
-               if (uuid16 < 0x1100)
-                       continue;
- 
-               if (uuid16 == PNP_INFO_SVCLASS_ID)
-                       continue;
- 
-               /* Stop if not enough space to put next UUID */
-               if (eir_len + 2 + sizeof(u16) > HCI_MAX_EIR_LENGTH) {
-                       truncated = 1;
-                       break;
-               }
- 
-               /* Check for duplicates */
-               for (i = 0; uuid16_list[i] != 0; i++)
-                       if (uuid16_list[i] == uuid16)
-                               break;
- 
-               if (uuid16_list[i] == 0) {
-                       uuid16_list[i] = uuid16;
-                       eir_len += sizeof(u16);
-               }
-       }
- 
-       if (uuid16_list[0] != 0) {
-               u8 *length = ptr;
- 
-               /* EIR Data type */
-               ptr[1] = truncated ? EIR_UUID16_SOME : EIR_UUID16_ALL;
- 
-               ptr += 2;
-               eir_len += 2;
- 
-               for (i = 0; uuid16_list[i] != 0; i++) {
-                       *ptr++ = (uuid16_list[i] & 0x00ff);
-                       *ptr++ = (uuid16_list[i] & 0xff00) >> 8;
-               }
- 
-               /* EIR Data length */
-               *length = (i * sizeof(u16)) + 1;
-       }
- }
- 
- static int update_eir(struct hci_dev *hdev)
- {
-       struct hci_cp_write_eir cp;
- 
-       if (!(hdev->features[6] & LMP_EXT_INQ))
-               return 0;
- 
-       if (hdev->ssp_mode == 0)
-               return 0;
- 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
-               return 0;
- 
-       memset(&cp, 0, sizeof(cp));
- 
-       create_eir(hdev, cp.data);
- 
-       if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
-               return 0;
- 
-       memcpy(hdev->eir, cp.data, sizeof(cp.data));
- 
-       return hci_send_cmd(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
- }
- 
- static u8 get_service_classes(struct hci_dev *hdev)
- {
-       struct bt_uuid *uuid;
-       u8 val = 0;
- 
-       list_for_each_entry(uuid, &hdev->uuids, list)
-               val |= uuid->svc_hint;
- 
-       return val;
- }
- 
- static int update_class(struct hci_dev *hdev)
- {
-       u8 cod[3];
- 
-       BT_DBG("%s", hdev->name);
- 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
-               return 0;
- 
-       cod[0] = hdev->minor_class;
-       cod[1] = hdev->major_class;
-       cod[2] = get_service_classes(hdev);
- 
-       if (memcmp(cod, hdev->dev_class, 3) == 0)
-               return 0;
- 
-       return hci_send_cmd(hdev, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
- }
- 
  static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
  {
        struct mgmt_cp_add_uuid *cp;
@@@ -828,7 -900,7 +901,7 @@@
                return cmd_status(sk, index, MGMT_OP_ADD_UUID,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        uuid = kmalloc(sizeof(*uuid), GFP_ATOMIC);
        if (!uuid) {
@@@ -852,7 -924,7 +925,7 @@@
        err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -879,7 -951,7 +952,7 @@@ static int remove_uuid(struct sock *sk
                return cmd_status(sk, index, MGMT_OP_REMOVE_UUID,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) {
                err = hci_uuids_clear(hdev);
@@@ -915,7 -987,7 +988,7 @@@
        err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
  
  unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -941,62 -1013,24 +1014,24 @@@ static int set_dev_class(struct sock *s
                return cmd_status(sk, index, MGMT_OP_SET_DEV_CLASS,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        hdev->major_class = cp->major;
        hdev->minor_class = cp->minor;
  
+       if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
+               hci_dev_unlock(hdev);
+               cancel_delayed_work_sync(&hdev->service_cache);
+               hci_dev_lock(hdev);
+               update_eir(hdev);
+       }
+ 
        err = update_class(hdev);
  
        if (err == 0)
                err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
  
-       hci_dev_unlock_bh(hdev);
-       hci_dev_put(hdev);
- 
-       return err;
- }
- 
- static int set_service_cache(struct sock *sk, u16 index,  unsigned char *data,
-                                                                       u16 len)
- {
-       struct hci_dev *hdev;
-       struct mgmt_cp_set_service_cache *cp;
-       int err;
- 
-       cp = (void *) data;
- 
-       if (len != sizeof(*cp))
-               return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
-                                               MGMT_STATUS_INVALID_PARAMS);
- 
-       hdev = hci_dev_get(index);
-       if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE,
-                                               MGMT_STATUS_INVALID_PARAMS);
- 
-       hci_dev_lock_bh(hdev);
- 
-       BT_DBG("hci%u enable %d", index, cp->enable);
- 
-       if (cp->enable) {
-               set_bit(HCI_SERVICE_CACHE, &hdev->flags);
-               err = 0;
-       } else {
-               clear_bit(HCI_SERVICE_CACHE, &hdev->flags);
-               err = update_class(hdev);
-               if (err == 0)
-                       err = update_eir(hdev);
-       }
- 
-       if (err == 0)
-               err = cmd_complete(sk, index, MGMT_OP_SET_SERVICE_CACHE, NULL,
-                                                                       0);
-       else
-               cmd_status(sk, index, MGMT_OP_SET_SERVICE_CACHE, -err);
- 
- 
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1035,7 -1069,7 +1070,7 @@@ static int load_link_keys(struct sock *
        BT_DBG("hci%u debug_keys %u key_count %u", index, cp->debug_keys,
                                                                key_count);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        hci_link_keys_clear(hdev);
  
@@@ -1055,7 -1089,7 +1090,7 @@@
  
        cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return 0;
@@@ -1083,7 -1117,7 +1118,7 @@@ static int remove_keys(struct sock *sk
                return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        memset(&rp, 0, sizeof(rp));
        bacpy(&rp.bdaddr, &cp->bdaddr);
@@@ -1124,7 -1158,7 +1159,7 @@@ unlock
        if (err < 0)
                err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
                                                                sizeof(rp));
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1152,7 -1186,7 +1187,7 @@@ static int disconnect(struct sock *sk, 
                return cmd_status(sk, index, MGMT_OP_DISCONNECT,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
@@@ -1190,7 -1224,7 +1225,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1232,7 -1266,7 +1267,7 @@@ static int get_connections(struct sock 
                return cmd_status(sk, index, MGMT_OP_GET_CONNECTIONS,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        count = 0;
        list_for_each(p, &hdev->conn_hash.list) {
@@@ -1264,7 -1298,7 +1299,7 @@@
  
  unlock:
        kfree(rp);
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
        return err;
  }
@@@ -1312,7 -1346,7 +1347,7 @@@ static int pin_code_reply(struct sock *
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
@@@ -1355,7 -1389,7 +1390,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1381,7 -1415,7 +1416,7 @@@ static int pin_code_neg_reply(struct so
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
@@@ -1392,7 -1426,7 +1427,7 @@@
        err = send_pin_code_neg_reply(sk, index, hdev, cp);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1417,14 -1451,14 +1452,14 @@@ static int set_io_capability(struct soc
                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        hdev->io_capability = cp->io_capability;
  
        BT_DBG("%s IO capability set to 0x%02x", hdev->name,
                                                        hdev->io_capability);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
@@@ -1505,7 -1539,7 +1540,7 @@@ static int pair_device(struct sock *sk
                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        sec_level = BT_SECURITY_MEDIUM;
        if (cp->io_cap == 0x03)
@@@ -1562,7 -1596,7 +1597,7 @@@
        err = 0;
  
  unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1581,7 -1615,7 +1616,7 @@@ static int user_pairing_resp(struct soc
                return cmd_status(sk, index, mgmt_op,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, mgmt_op, MGMT_STATUS_NOT_POWERED);
@@@ -1632,7 -1666,7 +1667,7 @@@
                mgmt_pending_remove(cmd);
  
  done:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1656,7 -1690,7 +1691,7 @@@ static int user_confirm_reply(struct so
  static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
                                                                        u16 len)
  {
-       struct mgmt_cp_user_confirm_reply *cp = (void *) data;
+       struct mgmt_cp_user_confirm_neg_reply *cp = data;
  
        BT_DBG("");
  
@@@ -1720,7 -1754,7 +1755,7 @@@ static int set_local_name(struct sock *
                return cmd_status(sk, index, MGMT_OP_SET_LOCAL_NAME,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
        if (!cmd) {
@@@ -1735,7 -1769,7 +1770,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1754,7 -1788,7 +1789,7 @@@ static int read_local_oob_data(struct s
                return cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_READ_LOCAL_OOB_DATA,
@@@ -1785,7 -1819,7 +1820,7 @@@
                mgmt_pending_remove(cmd);
  
  unlock:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1809,7 -1843,7 +1844,7 @@@ static int add_remote_oob_data(struct s
                return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
                                                                cp->randomizer);
@@@ -1820,7 -1854,7 +1855,7 @@@
                err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
                                                                        0);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1844,7 -1878,7 +1879,7 @@@ static int remove_remote_oob_data(struc
                return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
        if (err < 0)
@@@ -1854,7 -1888,7 +1889,7 @@@
                err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
                                                                NULL, 0);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1879,7 -1913,7 +1914,7 @@@ static int start_discovery(struct sock 
                return cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        if (!test_bit(HCI_UP, &hdev->flags)) {
                err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
@@@ -1898,7 -1932,7 +1933,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1917,7 -1951,7 +1952,7 @@@ static int stop_discovery(struct sock *
                return cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
        if (!cmd) {
@@@ -1930,7 -1964,7 +1965,7 @@@
                mgmt_pending_remove(cmd);
  
  failed:
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1954,7 -1988,7 +1989,7 @@@ static int block_device(struct sock *sk
                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        err = hci_blacklist_add(hdev, &cp->bdaddr);
        if (err < 0)
@@@ -1964,7 -1998,7 +1999,7 @@@
                err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
                                                        NULL, 0);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -1988,7 -2022,7 +2023,7 @@@ static int unblock_device(struct sock *
                return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
  
-       hci_dev_lock_bh(hdev);
+       hci_dev_lock(hdev);
  
        err = hci_blacklist_del(hdev, &cp->bdaddr);
  
@@@ -1999,7 -2033,7 +2034,7 @@@
                err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
                                                                NULL, 0);
  
-       hci_dev_unlock_bh(hdev);
+       hci_dev_unlock(hdev);
        hci_dev_put(hdev);
  
        return err;
@@@ -2009,7 -2043,7 +2044,7 @@@ static int set_fast_connectable(struct 
                                        unsigned char *data, u16 len)
  {
        struct hci_dev *hdev;
-       struct mgmt_cp_set_fast_connectable *cp = (void *) data;
+       struct mgmt_mode *cp = (void *) data;
        struct hci_cp_write_page_scan_activity acp;
        u8 type;
        int err;
@@@ -2027,7 -2061,7 +2062,7 @@@
  
        hci_dev_lock(hdev);
  
-       if (cp->enable) {
+       if (cp->val) {
                type = PAGE_SCAN_TYPE_INTERLACED;
                acp.interval = 0x0024;  /* 22.5 msec page scan interval */
        } else {
@@@ -2111,6 -2145,10 +2146,10 @@@ int mgmt_control(struct sock *sk, struc
        case MGMT_OP_SET_CONNECTABLE:
                err = set_connectable(sk, index, buf + sizeof(*hdr), len);
                break;
+       case MGMT_OP_SET_FAST_CONNECTABLE:
+               err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
+                                                               len);
+               break;
        case MGMT_OP_SET_PAIRABLE:
                err = set_pairable(sk, index, buf + sizeof(*hdr), len);
                break;
@@@ -2123,9 -2161,6 +2162,6 @@@
        case MGMT_OP_SET_DEV_CLASS:
                err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
                break;
-       case MGMT_OP_SET_SERVICE_CACHE:
-               err = set_service_cache(sk, index, buf + sizeof(*hdr), len);
-               break;
        case MGMT_OP_LOAD_LINK_KEYS:
                err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
                break;
@@@ -2189,10 -2224,6 +2225,6 @@@
        case MGMT_OP_UNBLOCK_DEVICE:
                err = unblock_device(sk, index, buf + sizeof(*hdr), len);
                break;
-       case MGMT_OP_SET_FAST_CONNECTABLE:
-               err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
-                                                               len);
-               break;
        default:
                BT_DBG("Unknown op %u", opcode);
                err = cmd_status(sk, index, opcode,
@@@ -2235,17 -2266,14 +2267,14 @@@ int mgmt_index_removed(struct hci_dev *
  struct cmd_lookup {
        u8 val;
        struct sock *sk;
+       struct hci_dev *hdev;
  };
  
- static void mode_rsp(struct pending_cmd *cmd, void *data)
+ static void settings_rsp(struct pending_cmd *cmd, void *data)
  {
-       struct mgmt_mode *cp = cmd->param;
        struct cmd_lookup *match = data;
  
-       if (cp->val != match->val)
-               return;
- 
-       send_mode_rsp(cmd->sk, cmd->opcode, cmd->index, cp->val);
+       send_settings_rsp(cmd->sk, cmd->opcode, match->hdev);
  
        list_del(&cmd->list);
  
@@@ -2259,20 -2287,21 +2288,21 @@@
  
  int mgmt_powered(struct hci_dev *hdev, u8 powered)
  {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { powered, NULL };
+       struct cmd_lookup match = { powered, NULL, hdev };
+       __le32 ev;
        int ret;
  
-       mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
  
        if (!powered) {
                u8 status = ENETDOWN;
                mgmt_pending_foreach(0, hdev, cmd_status_rsp, &status);
        }
  
-       ev.val = powered;
+       ev = cpu_to_le32(get_current_settings(hdev));
  
-       ret = mgmt_event(MGMT_EV_POWERED, hdev, &ev, sizeof(ev), match.sk);
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
+                                                               match.sk);
  
        if (match.sk)
                sock_put(match.sk);
@@@ -2282,17 -2311,16 +2312,16 @@@
  
  int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
  {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { discoverable, NULL };
+       struct cmd_lookup match = { discoverable, NULL, hdev };
+       __le32 ev;
        int ret;
  
-       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
  
-       ev.val = discoverable;
+       ev = cpu_to_le32(get_current_settings(hdev));
  
-       ret = mgmt_event(MGMT_EV_DISCOVERABLE, hdev, &ev, sizeof(ev),
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
                                                                match.sk);
- 
        if (match.sk)
                sock_put(match.sk);
  
@@@ -2301,15 -2329,16 +2330,16 @@@
  
  int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
  {
-       struct mgmt_mode ev;
-       struct cmd_lookup match = { connectable, NULL };
+       __le32 ev;
+       struct cmd_lookup match = { connectable, NULL, hdev };
        int ret;
  
-       mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, mode_rsp, &match);
+       mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
+                                                               &match);
  
-       ev.val = connectable;
+       ev = cpu_to_le32(get_current_settings(hdev));
  
-       ret = mgmt_event(MGMT_EV_CONNECTABLE, hdev, &ev, sizeof(ev), match.sk);
+       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
  
        if (match.sk)
                sock_put(match.sk);