Bluetooth: Split sending for HCI raw and control sockets
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / mgmt.c
index bc8e59dda78e2bf72f81c3eeacea748d5cbd78ae..1695d04d927d3291cde81ef9a0c200b2daf6467f 100644 (file)
@@ -1,6 +1,8 @@
 /*
    BlueZ - Bluetooth protocol stack for Linux
+
    Copyright (C) 2010  Nokia Corporation
+   Copyright (C) 2011-2012 Intel Corporation
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License version 2 as
 #include <net/bluetooth/mgmt.h>
 #include <net/bluetooth/smp.h>
 
-#define MGMT_VERSION   0
-#define MGMT_REVISION  1
+#define MGMT_VERSION   1
+#define MGMT_REVISION  0
+
+static const u16 mgmt_commands[] = {
+       MGMT_OP_READ_INDEX_LIST,
+       MGMT_OP_READ_INFO,
+       MGMT_OP_SET_POWERED,
+       MGMT_OP_SET_DISCOVERABLE,
+       MGMT_OP_SET_CONNECTABLE,
+       MGMT_OP_SET_FAST_CONNECTABLE,
+       MGMT_OP_SET_PAIRABLE,
+       MGMT_OP_SET_LINK_SECURITY,
+       MGMT_OP_SET_SSP,
+       MGMT_OP_SET_HS,
+       MGMT_OP_SET_LE,
+       MGMT_OP_SET_DEV_CLASS,
+       MGMT_OP_SET_LOCAL_NAME,
+       MGMT_OP_ADD_UUID,
+       MGMT_OP_REMOVE_UUID,
+       MGMT_OP_LOAD_LINK_KEYS,
+       MGMT_OP_LOAD_LONG_TERM_KEYS,
+       MGMT_OP_DISCONNECT,
+       MGMT_OP_GET_CONNECTIONS,
+       MGMT_OP_PIN_CODE_REPLY,
+       MGMT_OP_PIN_CODE_NEG_REPLY,
+       MGMT_OP_SET_IO_CAPABILITY,
+       MGMT_OP_PAIR_DEVICE,
+       MGMT_OP_CANCEL_PAIR_DEVICE,
+       MGMT_OP_UNPAIR_DEVICE,
+       MGMT_OP_USER_CONFIRM_REPLY,
+       MGMT_OP_USER_CONFIRM_NEG_REPLY,
+       MGMT_OP_USER_PASSKEY_REPLY,
+       MGMT_OP_USER_PASSKEY_NEG_REPLY,
+       MGMT_OP_READ_LOCAL_OOB_DATA,
+       MGMT_OP_ADD_REMOTE_OOB_DATA,
+       MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+       MGMT_OP_START_DISCOVERY,
+       MGMT_OP_STOP_DISCOVERY,
+       MGMT_OP_CONFIRM_NAME,
+       MGMT_OP_BLOCK_DEVICE,
+       MGMT_OP_UNBLOCK_DEVICE,
+};
+
+static const u16 mgmt_events[] = {
+       MGMT_EV_CONTROLLER_ERROR,
+       MGMT_EV_INDEX_ADDED,
+       MGMT_EV_INDEX_REMOVED,
+       MGMT_EV_NEW_SETTINGS,
+       MGMT_EV_CLASS_OF_DEV_CHANGED,
+       MGMT_EV_LOCAL_NAME_CHANGED,
+       MGMT_EV_NEW_LINK_KEY,
+       MGMT_EV_NEW_LONG_TERM_KEY,
+       MGMT_EV_DEVICE_CONNECTED,
+       MGMT_EV_DEVICE_DISCONNECTED,
+       MGMT_EV_CONNECT_FAILED,
+       MGMT_EV_PIN_CODE_REQUEST,
+       MGMT_EV_USER_CONFIRM_REQUEST,
+       MGMT_EV_USER_PASSKEY_REQUEST,
+       MGMT_EV_AUTH_FAILED,
+       MGMT_EV_DEVICE_FOUND,
+       MGMT_EV_DISCOVERING,
+       MGMT_EV_DEVICE_BLOCKED,
+       MGMT_EV_DEVICE_UNBLOCKED,
+       MGMT_EV_DEVICE_UNPAIRED,
+};
 
-#define INQUIRY_LEN_BREDR 0x08 /* TGAP(100) */
+/*
+ * These LE scan and inquiry parameters were chosen according to LE General
+ * Discovery Procedure specification.
+ */
+#define LE_SCAN_TYPE                   0x01
+#define LE_SCAN_WIN                    0x12
+#define LE_SCAN_INT                    0x12
+#define LE_SCAN_TIMEOUT_LE_ONLY                10240   /* TGAP(gen_disc_scan_min) */
+#define LE_SCAN_TIMEOUT_BREDR_LE       5120    /* TGAP(100)/2 */
+
+#define INQUIRY_LEN_BREDR              0x08    /* TGAP(100) */
+#define INQUIRY_LEN_BREDR_LE           0x04    /* TGAP(100)/2 */
 
 #define SERVICE_CACHE_TIMEOUT (5 * 1000)
 
@@ -151,8 +227,8 @@ static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
        return err;
 }
 
-static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
-                                                               size_t rp_len)
+static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
+                                               void *rp, size_t rp_len)
 {
        struct sk_buff *skb;
        struct mgmt_hdr *hdr;
@@ -173,6 +249,7 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp,
 
        ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
        put_unaligned_le16(cmd, &ev->opcode);
+       ev->status = status;
 
        if (rp)
                memcpy(ev->data, rp, rp_len);
@@ -193,10 +270,43 @@ static int read_version(struct sock *sk)
        rp.version = MGMT_VERSION;
        put_unaligned_le16(MGMT_REVISION, &rp.revision);
 
-       return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, &rp,
+       return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
                                                                sizeof(rp));
 }
 
+static int read_commands(struct sock *sk)
+{
+       struct mgmt_rp_read_commands *rp;
+       u16 num_commands = ARRAY_SIZE(mgmt_commands);
+       u16 num_events = ARRAY_SIZE(mgmt_events);
+       u16 *opcode;
+       size_t rp_size;
+       int i, err;
+
+       BT_DBG("sock %p", sk);
+
+       rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
+
+       rp = kmalloc(rp_size, GFP_KERNEL);
+       if (!rp)
+               return -ENOMEM;
+
+       put_unaligned_le16(num_commands, &rp->num_commands);
+       put_unaligned_le16(num_events, &rp->num_events);
+
+       for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
+               put_unaligned_le16(mgmt_commands[i], opcode);
+
+       for (i = 0; i < num_events; i++, opcode++)
+               put_unaligned_le16(mgmt_events[i], opcode);
+
+       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
+                                                               rp_size);
+       kfree(rp);
+
+       return err;
+}
+
 static int read_index_list(struct sock *sk)
 {
        struct mgmt_rp_read_index_list *rp;
@@ -226,10 +336,10 @@ static int read_index_list(struct sock *sk)
 
        i = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
-               if (test_and_clear_bit(HCI_AUTO_OFF, &d->flags))
+               if (test_and_clear_bit(HCI_AUTO_OFF, &d->dev_flags))
                        cancel_delayed_work(&d->power_off);
 
-               if (test_bit(HCI_SETUP, &d->flags))
+               if (test_bit(HCI_SETUP, &d->dev_flags))
                        continue;
 
                put_unaligned_le16(d->id, &rp->index[i++]);
@@ -238,7 +348,7 @@ static int read_index_list(struct sock *sk)
 
        read_unlock(&hci_dev_list_lock);
 
-       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, rp,
+       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
                                                                        rp_len);
 
        kfree(rp);
@@ -285,7 +395,7 @@ static u32 get_current_settings(struct hci_dev *hdev)
        if (test_bit(HCI_ISCAN, &hdev->flags))
                settings |= MGMT_SETTING_DISCOVERABLE;
 
-       if (test_bit(HCI_PAIRABLE, &hdev->flags))
+       if (test_bit(HCI_PAIRABLE, &hdev->dev_flags))
                settings |= MGMT_SETTING_PAIRABLE;
 
        if (!(hdev->features[4] & LMP_NO_BREDR))
@@ -297,24 +407,12 @@ static u32 get_current_settings(struct hci_dev *hdev)
        if (test_bit(HCI_AUTH, &hdev->flags))
                settings |= MGMT_SETTING_LINK_SECURITY;
 
-       if (hdev->ssp_mode > 0)
+       if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
                settings |= MGMT_SETTING_SSP;
 
        return settings;
 }
 
-#define EIR_FLAGS              0x01 /* flags */
-#define EIR_UUID16_SOME                0x02 /* 16-bit UUID, more available */
-#define EIR_UUID16_ALL         0x03 /* 16-bit UUID, all listed */
-#define EIR_UUID32_SOME                0x04 /* 32-bit UUID, more available */
-#define EIR_UUID32_ALL         0x05 /* 32-bit UUID, all listed */
-#define EIR_UUID128_SOME       0x06 /* 128-bit UUID, more available */
-#define EIR_UUID128_ALL                0x07 /* 128-bit UUID, all listed */
-#define EIR_NAME_SHORT         0x08 /* shortened local name */
-#define EIR_NAME_COMPLETE      0x09 /* complete local name */
-#define EIR_TX_POWER           0x0A /* transmit power level */
-#define EIR_DEVICE_ID          0x10 /* device ID */
-
 #define PNP_INFO_SVCLASS_ID            0x1200
 
 static u8 bluetooth_base_uuid[] = {
@@ -428,10 +526,10 @@ static int update_eir(struct hci_dev *hdev)
        if (!(hdev->features[6] & LMP_EXT_INQ))
                return 0;
 
-       if (hdev->ssp_mode == 0)
+       if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
                return 0;
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                return 0;
 
        memset(&cp, 0, sizeof(cp));
@@ -463,7 +561,7 @@ static int update_class(struct hci_dev *hdev)
 
        BT_DBG("%s", hdev->name);
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->flags))
+       if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                return 0;
 
        cod[0] = hdev->minor_class;
@@ -481,7 +579,7 @@ static void service_cache_off(struct work_struct *work)
        struct hci_dev *hdev = container_of(work, struct hci_dev,
                                                        service_cache.work);
 
-       if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
+       if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                return;
 
        hci_dev_lock(hdev);
@@ -494,10 +592,10 @@ static void service_cache_off(struct work_struct *work)
 
 static void mgmt_init_hdev(struct hci_dev *hdev)
 {
-       if (!test_and_set_bit(HCI_MGMT, &hdev->flags))
+       if (!test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
                INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
 
-       if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->flags))
+       if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
                schedule_delayed_work(&hdev->service_cache,
                                msecs_to_jiffies(SERVICE_CACHE_TIMEOUT));
 }
@@ -514,7 +612,7 @@ static int read_controller_info(struct sock *sk, u16 index)
                return cmd_status(sk, index, MGMT_OP_READ_INFO,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
+       if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
                cancel_delayed_work_sync(&hdev->power_off);
 
        hci_dev_lock(hdev);
@@ -540,7 +638,7 @@ static int read_controller_info(struct sock *sk, u16 index)
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
-       return cmd_complete(sk, index, MGMT_OP_READ_INFO, &rp, sizeof(rp));
+       return cmd_complete(sk, index, MGMT_OP_READ_INFO, 0, &rp, sizeof(rp));
 }
 
 static void mgmt_pending_free(struct pending_cmd *cmd)
@@ -620,18 +718,17 @@ static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
        __le32 settings = cpu_to_le32(get_current_settings(hdev));
 
-       return cmd_complete(sk, hdev->id, opcode, &settings, sizeof(settings));
+       return cmd_complete(sk, hdev->id, opcode, 0, &settings,
+                                                       sizeof(settings));
 }
 
-static int set_powered(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int set_powered(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_mode *cp;
+       struct mgmt_mode *cp = data;
        struct hci_dev *hdev;
        struct pending_cmd *cmd;
        int err, up;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -676,17 +773,14 @@ failed:
        return err;
 }
 
-static int set_discoverable(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int set_discoverable(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_cp_set_discoverable *cp;
+       struct mgmt_cp_set_discoverable *cp = data;
        struct hci_dev *hdev;
        struct pending_cmd *cmd;
        u8 scan;
        int err;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -746,17 +840,14 @@ failed:
        return err;
 }
 
-static int set_connectable(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int set_connectable(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_mode *cp;
+       struct mgmt_mode *cp = data;
        struct hci_dev *hdev;
        struct pending_cmd *cmd;
        u8 scan;
        int err;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -833,22 +924,19 @@ static int mgmt_event(u16 event, struct hci_dev *hdev, void *data,
        if (data)
                memcpy(skb_put(skb, data_len), data, data_len);
 
-       hci_send_to_sock(NULL, skb, skip_sk);
+       hci_send_to_control(skb, skip_sk);
        kfree_skb(skb);
 
        return 0;
 }
 
-static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int set_pairable(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_mode *cp;
+       struct mgmt_mode *cp = data;
        struct hci_dev *hdev;
        __le32 ev;
        int err;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -863,9 +951,9 @@ static int set_pairable(struct sock *sk, u16 index, unsigned char *data,
        hci_dev_lock(hdev);
 
        if (cp->val)
-               set_bit(HCI_PAIRABLE, &hdev->flags);
+               set_bit(HCI_PAIRABLE, &hdev->dev_flags);
        else
-               clear_bit(HCI_PAIRABLE, &hdev->flags);
+               clear_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
        err = send_settings_rsp(sk, MGMT_OP_SET_PAIRABLE, hdev);
        if (err < 0)
@@ -882,14 +970,129 @@ failed:
        return err;
 }
 
-static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int set_link_security(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_cp_add_uuid *cp;
+       struct mgmt_mode *cp = data;
+       struct pending_cmd *cmd;
        struct hci_dev *hdev;
-       struct bt_uuid *uuid;
+       uint8_t val;
        int err;
 
-       cp = (void *) data;
+       BT_DBG("request for hci%u", index);
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       if (!test_bit(HCI_UP, &hdev->flags)) {
+               err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
+                                               MGMT_STATUS_NOT_POWERED);
+               goto failed;
+       }
+
+       if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
+               err = cmd_status(sk, index, MGMT_OP_SET_LINK_SECURITY,
+                                                       MGMT_STATUS_BUSY);
+               goto failed;
+       }
+
+       val = !!cp->val;
+
+       if (test_bit(HCI_AUTH, &hdev->flags) == val) {
+               err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev);
+               goto failed;
+       }
+
+       cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto failed;
+       }
+
+       err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val);
+       if (err < 0) {
+               mgmt_pending_remove(cmd);
+               goto failed;
+       }
+
+failed:
+       hci_dev_unlock(hdev);
+       hci_dev_put(hdev);
+
+       return err;
+}
+
+static int set_ssp(struct sock *sk, u16 index, void *data, u16 len)
+{
+       struct mgmt_mode *cp = data;
+       struct pending_cmd *cmd;
+       struct hci_dev *hdev;
+       uint8_t val;
+       int err;
+
+       BT_DBG("request for hci%u", index);
+
+       if (len != sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_SET_SSP,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_SET_SSP,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       if (!test_bit(HCI_UP, &hdev->flags)) {
+               err = cmd_status(sk, index, MGMT_OP_SET_SSP,
+                                               MGMT_STATUS_NOT_POWERED);
+               goto failed;
+       }
+
+       if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+               err = cmd_status(sk, index, MGMT_OP_SET_SSP, MGMT_STATUS_BUSY);
+               goto failed;
+       }
+
+       val = !!cp->val;
+
+       if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) == val) {
+               err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
+               goto failed;
+       }
+
+       cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto failed;
+       }
+
+       err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(val), &val);
+       if (err < 0) {
+               mgmt_pending_remove(cmd);
+               goto failed;
+       }
+
+failed:
+       hci_dev_unlock(hdev);
+       hci_dev_put(hdev);
+
+       return err;
+}
+
+static int add_uuid(struct sock *sk, u16 index, void *data, u16 len)
+{
+       struct mgmt_cp_add_uuid *cp = data;
+       struct hci_dev *hdev;
+       struct bt_uuid *uuid;
+       int err;
 
        BT_DBG("request for hci%u", index);
 
@@ -923,7 +1126,7 @@ static int add_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
        if (err < 0)
                goto failed;
 
-       err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, NULL, 0);
+       err = cmd_complete(sk, index, MGMT_OP_ADD_UUID, 0, NULL, 0);
 
 failed:
        hci_dev_unlock(hdev);
@@ -932,16 +1135,14 @@ failed:
        return err;
 }
 
-static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int remove_uuid(struct sock *sk, u16 index, void *data, u16 len)
 {
+       struct mgmt_cp_remove_uuid *cp = data;
        struct list_head *p, *n;
-       struct mgmt_cp_remove_uuid *cp;
        struct hci_dev *hdev;
        u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
        int err, found;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -986,7 +1187,7 @@ static int remove_uuid(struct sock *sk, u16 index, unsigned char *data, u16 len)
        if (err < 0)
                goto unlock;
 
-       err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, NULL, 0);
+       err = cmd_complete(sk, index, MGMT_OP_REMOVE_UUID, 0, NULL, 0);
 
 unlock:
        hci_dev_unlock(hdev);
@@ -995,15 +1196,12 @@ unlock:
        return err;
 }
 
-static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int set_dev_class(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_set_dev_class *cp;
+       struct mgmt_cp_set_dev_class *cp = data;
        int err;
 
-       cp = (void *) data;
-
        BT_DBG("request for hci%u", index);
 
        if (len != sizeof(*cp))
@@ -1020,7 +1218,7 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
        hdev->major_class = cp->major;
        hdev->minor_class = cp->minor;
 
-       if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags)) {
+       if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
                hci_dev_unlock(hdev);
                cancel_delayed_work_sync(&hdev->service_cache);
                hci_dev_lock(hdev);
@@ -1030,7 +1228,8 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
        err = update_class(hdev);
 
        if (err == 0)
-               err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, NULL, 0);
+               err = cmd_complete(sk, index, MGMT_OP_SET_DEV_CLASS, 0,
+                                                               NULL, 0);
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -1038,16 +1237,13 @@ static int set_dev_class(struct sock *sk, u16 index, unsigned char *data,
        return err;
 }
 
-static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
-                                                               u16 len)
+static int load_link_keys(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_load_link_keys *cp;
+       struct mgmt_cp_load_link_keys *cp = data;
        u16 key_count, expected_len;
        int i;
 
-       cp = (void *) data;
-
        if (len < sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_LOAD_LINK_KEYS,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1075,21 +1271,21 @@ static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
 
        hci_link_keys_clear(hdev);
 
-       set_bit(HCI_LINK_KEYS, &hdev->flags);
+       set_bit(HCI_LINK_KEYS, &hdev->dev_flags);
 
        if (cp->debug_keys)
-               set_bit(HCI_DEBUG_KEYS, &hdev->flags);
+               set_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
        else
-               clear_bit(HCI_DEBUG_KEYS, &hdev->flags);
+               clear_bit(HCI_DEBUG_KEYS, &hdev->dev_flags);
 
        for (i = 0; i < key_count; i++) {
                struct mgmt_link_key_info *key = &cp->keys[i];
 
-               hci_add_link_key(hdev, NULL, 0, &key->bdaddr, key->val, key->type,
-                                                               key->pin_len);
+               hci_add_link_key(hdev, NULL, 0, &key->addr.bdaddr, key->val,
+                                               key->type, key->pin_len);
        }
 
-       cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, NULL, 0);
+       cmd_complete(sk, index, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -1097,54 +1293,77 @@ static int load_link_keys(struct sock *sk, u16 index, unsigned char *data,
        return 0;
 }
 
-static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
-                                                               u16 len)
+static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                       u8 addr_type, struct sock *skip_sk)
+{
+       struct mgmt_ev_device_unpaired ev;
+
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = addr_type;
+
+       return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev),
+                                                               skip_sk);
+}
+
+static int unpair_device(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_remove_keys *cp;
-       struct mgmt_rp_remove_keys rp;
+       struct mgmt_cp_unpair_device *cp = data;
+       struct mgmt_rp_unpair_device rp;
        struct hci_cp_disconnect dc;
        struct pending_cmd *cmd;
        struct hci_conn *conn;
+       u8 status = 0;
        int err;
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
-               return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
+               return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
        hdev = hci_dev_get(index);
        if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_REMOVE_KEYS,
+               return cmd_status(sk, index, MGMT_OP_UNPAIR_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        memset(&rp, 0, sizeof(rp));
-       bacpy(&rp.bdaddr, &cp->bdaddr);
-       rp.status = MGMT_STATUS_FAILED;
+       bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+       rp.addr.type = cp->addr.type;
+
+       if (cp->addr.type == MGMT_ADDR_BREDR)
+               err = hci_remove_link_key(hdev, &cp->addr.bdaddr);
+       else
+               err = hci_remove_ltk(hdev, &cp->addr.bdaddr);
 
-       err = hci_remove_link_key(hdev, &cp->bdaddr);
        if (err < 0) {
-               rp.status = MGMT_STATUS_NOT_PAIRED;
+               status = MGMT_STATUS_NOT_PAIRED;
                goto unlock;
        }
 
        if (!test_bit(HCI_UP, &hdev->flags) || !cp->disconnect) {
-               err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                               sizeof(rp));
+               err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
+                                                       &rp, sizeof(rp));
+               device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
                goto unlock;
        }
 
-       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+       if (cp->addr.type == MGMT_ADDR_BREDR)
+               conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
+                                                       &cp->addr.bdaddr);
+       else
+               conn = hci_conn_hash_lookup_ba(hdev, LE_LINK,
+                                                       &cp->addr.bdaddr);
+
        if (!conn) {
-               err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                               sizeof(rp));
+               err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
+                                                       &rp, sizeof(rp));
+               device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
                goto unlock;
        }
 
-       cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_KEYS, hdev, cp, sizeof(*cp));
+       cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp,
+                                                               sizeof(*cp));
        if (!cmd) {
                err = -ENOMEM;
                goto unlock;
@@ -1158,18 +1377,18 @@ static int remove_keys(struct sock *sk, u16 index, unsigned char *data,
 
 unlock:
        if (err < 0)
-               err = cmd_complete(sk, index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                               sizeof(rp));
+               err = cmd_complete(sk, index, MGMT_OP_UNPAIR_DEVICE, status,
+                                                       &rp, sizeof(rp));
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
 }
 
-static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int disconnect(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_disconnect *cp;
+       struct mgmt_cp_disconnect *cp = data;
        struct hci_cp_disconnect dc;
        struct pending_cmd *cmd;
        struct hci_conn *conn;
@@ -1177,8 +1396,6 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_DISCONNECT,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1202,9 +1419,10 @@ static int disconnect(struct sock *sk, u16 index, unsigned char *data, u16 len)
                goto failed;
        }
 
-       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
-       if (!conn)
-               conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->bdaddr);
+       if (cp->addr.type == MGMT_ADDR_BREDR)
+               conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
+       else
+               conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
        if (!conn) {
                err = cmd_status(sk, index, MGMT_OP_DISCONNECT,
@@ -1256,7 +1474,6 @@ static int get_connections(struct sock *sk, u16 index)
        struct mgmt_rp_get_connections *rp;
        struct hci_dev *hdev;
        struct hci_conn *c;
-       struct list_head *p;
        size_t rp_len;
        u16 count;
        int i, err;
@@ -1271,8 +1488,9 @@ static int get_connections(struct sock *sk, u16 index)
        hci_dev_lock(hdev);
 
        count = 0;
-       list_for_each(p, &hdev->conn_hash.list) {
-               count++;
+       list_for_each_entry(c, &hdev->conn_hash.list, list) {
+               if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
+                       count++;
        }
 
        rp_len = sizeof(*rp) + (count * sizeof(struct mgmt_addr_info));
@@ -1286,6 +1504,8 @@ static int get_connections(struct sock *sk, u16 index)
 
        i = 0;
        list_for_each_entry(c, &hdev->conn_hash.list, list) {
+               if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags))
+                       continue;
                bacpy(&rp->addr[i].bdaddr, &c->dst);
                rp->addr[i].type = link_to_mgmt(c->type, c->dst_type);
                if (rp->addr[i].type == MGMT_ADDR_INVALID)
@@ -1296,7 +1516,7 @@ static int get_connections(struct sock *sk, u16 index)
        /* Recalculate length in case of filtered SCO connections, etc */
        rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
 
-       err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, rp, rp_len);
+       err = cmd_complete(sk, index, MGMT_OP_GET_CONNECTIONS, 0, rp, rp_len);
 
 unlock:
        kfree(rp);
@@ -1316,29 +1536,25 @@ static int send_pin_code_neg_reply(struct sock *sk, u16 index,
        if (!cmd)
                return -ENOMEM;
 
-       err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, sizeof(cp->bdaddr),
-                                                               &cp->bdaddr);
+       err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
+                               sizeof(cp->addr.bdaddr), &cp->addr.bdaddr);
        if (err < 0)
                mgmt_pending_remove(cmd);
 
        return err;
 }
 
-static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int pin_code_reply(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
        struct hci_conn *conn;
-       struct mgmt_cp_pin_code_reply *cp;
-       struct mgmt_cp_pin_code_neg_reply ncp;
+       struct mgmt_cp_pin_code_reply *cp = data;
        struct hci_cp_pin_code_reply reply;
        struct pending_cmd *cmd;
        int err;
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1356,7 +1572,7 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                goto failed;
        }
 
-       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
+       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
        if (!conn) {
                err = cmd_status(sk, index, MGMT_OP_PIN_CODE_REPLY,
                                                MGMT_STATUS_NOT_CONNECTED);
@@ -1364,7 +1580,9 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
        }
 
        if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) {
-               bacpy(&ncp.bdaddr, &cp->bdaddr);
+               struct mgmt_cp_pin_code_neg_reply ncp;
+
+               memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr));
 
                BT_ERR("PIN code is not 16 bytes long");
 
@@ -1376,13 +1594,14 @@ static int pin_code_reply(struct sock *sk, u16 index, unsigned char *data,
                goto failed;
        }
 
-       cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len);
+       cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data,
+                                                                       len);
        if (!cmd) {
                err = -ENOMEM;
                goto failed;
        }
 
-       bacpy(&reply.bdaddr, &cp->bdaddr);
+       bacpy(&reply.bdaddr, &cp->addr.bdaddr);
        reply.pin_len = cp->pin_len;
        memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code));
 
@@ -1397,17 +1616,14 @@ failed:
        return err;
 }
 
-static int pin_code_neg_reply(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int pin_code_neg_reply(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_pin_code_neg_reply *cp;
+       struct mgmt_cp_pin_code_neg_reply *cp = data;
        int err;
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_PIN_CODE_NEG_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1434,16 +1650,13 @@ failed:
        return err;
 }
 
-static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int set_io_capability(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_set_io_capability *cp;
+       struct mgmt_cp_set_io_capability *cp = data;
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_SET_IO_CAPABILITY,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1463,7 +1676,7 @@ static int set_io_capability(struct sock *sk, u16 index, unsigned char *data,
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
-       return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, NULL, 0);
+       return cmd_complete(sk, index, MGMT_OP_SET_IO_CAPABILITY, 0, NULL, 0);
 }
 
 static inline struct pending_cmd *find_pairing(struct hci_conn *conn)
@@ -1491,9 +1704,9 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
 
        bacpy(&rp.addr.bdaddr, &conn->dst);
        rp.addr.type = link_to_mgmt(conn->type, conn->dst_type);
-       rp.status = status;
 
-       cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, &rp, sizeof(rp));
+       cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
+                                                       &rp, sizeof(rp));
 
        /* So we don't get further callbacks for this connection */
        conn->connect_cfm_cb = NULL;
@@ -1515,13 +1728,13 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
        if (!cmd)
                BT_DBG("Unable to find a pending command");
        else
-               pairing_complete(cmd, status);
+               pairing_complete(cmd, mgmt_status(status));
 }
 
-static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
+static int pair_device(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_pair_device *cp;
+       struct mgmt_cp_pair_device *cp = data;
        struct mgmt_rp_pair_device rp;
        struct pending_cmd *cmd;
        u8 sec_level, auth_type;
@@ -1530,8 +1743,6 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
 
        BT_DBG("");
 
-       cp = (void *) data;
-
        if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_PAIR_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
@@ -1561,17 +1772,16 @@ static int pair_device(struct sock *sk, u16 index, unsigned char *data, u16 len)
        rp.addr.type = cp->addr.type;
 
        if (IS_ERR(conn)) {
-               rp.status = -PTR_ERR(conn);
                err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                       &rp, sizeof(rp));
+                                               MGMT_STATUS_CONNECT_FAILED,
+                                               &rp, sizeof(rp));
                goto unlock;
        }
 
        if (conn->connect_cfm_cb) {
                hci_conn_put(conn);
-               rp.status = EBUSY;
                err = cmd_complete(sk, index, MGMT_OP_PAIR_DEVICE,
-                                                       &rp, sizeof(rp));
+                                       MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto unlock;
        }
 
@@ -1604,8 +1814,57 @@ unlock:
        return err;
 }
 
+static int cancel_pair_device(struct sock *sk, u16 index,
+                                               unsigned char *data, u16 len)
+{
+       struct mgmt_addr_info *addr = (void *) data;
+       struct hci_dev *hdev;
+       struct pending_cmd *cmd;
+       struct hci_conn *conn;
+       int err;
+
+       BT_DBG("");
+
+       if (len != sizeof(*addr))
+               return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
+       if (!cmd) {
+               err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS);
+               goto unlock;
+       }
+
+       conn = cmd->user_data;
+
+       if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
+               err = cmd_status(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS);
+               goto unlock;
+       }
+
+       pairing_complete(cmd, MGMT_STATUS_CANCELLED);
+
+       err = cmd_complete(sk, index, MGMT_OP_CANCEL_PAIR_DEVICE, 0, addr,
+                                                               sizeof(*addr));
+unlock:
+       hci_dev_unlock(hdev);
+       hci_dev_put(hdev);
+
+       return err;
+}
+
 static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
-                                       u16 mgmt_op, u16 hci_op, __le32 passkey)
+                                       u8 type, u16 mgmt_op, u16 hci_op,
+                                       __le32 passkey)
 {
        struct pending_cmd *cmd;
        struct hci_dev *hdev;
@@ -1624,24 +1883,18 @@ static int user_pairing_resp(struct sock *sk, u16 index, bdaddr_t *bdaddr,
                goto done;
        }
 
-       /*
-        * Check for an existing ACL link, if present pair via
-        * HCI commands.
-        *
-        * If no ACL link is present, check for an LE link and if
-        * present, pair via the SMP engine.
-        *
-        * If neither ACL nor LE links are present, fail with error.
-        */
-       conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
-       if (!conn) {
+       if (type == MGMT_ADDR_BREDR)
+               conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, bdaddr);
+       else
                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
-               if (!conn) {
-                       err = cmd_status(sk, index, mgmt_op,
+
+       if (!conn) {
+               err = cmd_status(sk, index, mgmt_op,
                                                MGMT_STATUS_NOT_CONNECTED);
-                       goto done;
-               }
+               goto done;
+       }
 
+       if (type == MGMT_ADDR_LE_PUBLIC || type == MGMT_ADDR_LE_RANDOM) {
                /* Continue with pairing via SMP */
                err = smp_user_confirm_reply(conn, mgmt_op, passkey);
 
@@ -1683,7 +1936,7 @@ done:
 
 static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_cp_user_confirm_reply *cp = (void *) data;
+       struct mgmt_cp_user_confirm_reply *cp = data;
 
        BT_DBG("");
 
@@ -1691,9 +1944,9 @@ static int user_confirm_reply(struct sock *sk, u16 index, void *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       return user_pairing_resp(sk, index, &cp->bdaddr,
-                       MGMT_OP_USER_CONFIRM_REPLY,
-                       HCI_OP_USER_CONFIRM_REPLY, 0);
+       return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
+                                               MGMT_OP_USER_CONFIRM_REPLY,
+                                               HCI_OP_USER_CONFIRM_REPLY, 0);
 }
 
 static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
@@ -1707,14 +1960,14 @@ static int user_confirm_neg_reply(struct sock *sk, u16 index, void *data,
                return cmd_status(sk, index, MGMT_OP_USER_CONFIRM_NEG_REPLY,
                                                MGMT_STATUS_INVALID_PARAMS);
 
-       return user_pairing_resp(sk, index, &cp->bdaddr,
-                       MGMT_OP_USER_CONFIRM_NEG_REPLY,
-                       HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
+       return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
+                                       MGMT_OP_USER_CONFIRM_NEG_REPLY,
+                                       HCI_OP_USER_CONFIRM_NEG_REPLY, 0);
 }
 
 static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
 {
-       struct mgmt_cp_user_passkey_reply *cp = (void *) data;
+       struct mgmt_cp_user_passkey_reply *cp = data;
 
        BT_DBG("");
 
@@ -1722,15 +1975,16 @@ static int user_passkey_reply(struct sock *sk, u16 index, void *data, u16 len)
                return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_REPLY,
                                                                        EINVAL);
 
-       return user_pairing_resp(sk, index, &cp->bdaddr,
-                       MGMT_OP_USER_PASSKEY_REPLY,
-                       HCI_OP_USER_PASSKEY_REPLY, cp->passkey);
+       return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
+                                               MGMT_OP_USER_PASSKEY_REPLY,
+                                               HCI_OP_USER_PASSKEY_REPLY,
+                                               cp->passkey);
 }
 
 static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
                                                                        u16 len)
 {
-       struct mgmt_cp_user_passkey_neg_reply *cp = (void *) data;
+       struct mgmt_cp_user_passkey_neg_reply *cp = data;
 
        BT_DBG("");
 
@@ -1738,15 +1992,15 @@ static int user_passkey_neg_reply(struct sock *sk, u16 index, void *data,
                return cmd_status(sk, index, MGMT_OP_USER_PASSKEY_NEG_REPLY,
                                                                        EINVAL);
 
-       return user_pairing_resp(sk, index, &cp->bdaddr,
-                       MGMT_OP_USER_PASSKEY_NEG_REPLY,
-                       HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
+       return user_pairing_resp(sk, index, &cp->addr.bdaddr, cp->addr.type,
+                                       MGMT_OP_USER_PASSKEY_NEG_REPLY,
+                                       HCI_OP_USER_PASSKEY_NEG_REPLY, 0);
 }
 
-static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
+static int set_local_name(struct sock *sk, u16 index, void *data,
                                                                u16 len)
 {
-       struct mgmt_cp_set_local_name *mgmt_cp = (void *) data;
+       struct mgmt_cp_set_local_name *mgmt_cp = data;
        struct hci_cp_write_local_name hci_cp;
        struct hci_dev *hdev;
        struct pending_cmd *cmd;
@@ -1765,7 +2019,8 @@ static int set_local_name(struct sock *sk, u16 index, unsigned char *data,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len);
+       cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data,
+                                                                       len);
        if (!cmd) {
                err = -ENOMEM;
                goto failed;
@@ -1834,11 +2089,12 @@ unlock:
        return err;
 }
 
-static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
-                                                                       u16 len)
+static int add_remote_oob_data(struct sock *sk, u16 index, void *data,
+                                                               u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_add_remote_oob_data *cp = (void *) data;
+       struct mgmt_cp_add_remote_oob_data *cp = data;
+       u8 status;
        int err;
 
        BT_DBG("hci%u ", index);
@@ -1849,19 +2105,21 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
 
        hdev = hci_dev_get(index);
        if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               return cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                               MGMT_STATUS_INVALID_PARAMS,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
-       err = hci_add_remote_oob_data(hdev, &cp->bdaddr, cp->hash,
+       err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, cp->hash,
                                                                cp->randomizer);
        if (err < 0)
-               err = cmd_status(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                                       MGMT_STATUS_FAILED);
+               status = MGMT_STATUS_FAILED;
        else
-               err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, NULL,
-                                                                       0);
+               status = 0;
+
+       err = cmd_complete(sk, index, MGMT_OP_ADD_REMOTE_OOB_DATA, status,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -1870,10 +2128,11 @@ static int add_remote_oob_data(struct sock *sk, u16 index, unsigned char *data,
 }
 
 static int remove_remote_oob_data(struct sock *sk, u16 index,
-                                               unsigned char *data, u16 len)
+                                               void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_remove_remote_oob_data *cp = (void *) data;
+       struct mgmt_cp_remove_remote_oob_data *cp = data;
+       u8 status;
        int err;
 
        BT_DBG("hci%u ", index);
@@ -1884,18 +2143,20 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
 
        hdev = hci_dev_get(index);
        if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               return cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                               MGMT_STATUS_INVALID_PARAMS,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
-       err = hci_remove_remote_oob_data(hdev, &cp->bdaddr);
+       err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr);
        if (err < 0)
-               err = cmd_status(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               status = MGMT_STATUS_INVALID_PARAMS;
        else
-               err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                                               NULL, 0);
+               status = 0;
+
+       err = cmd_complete(sk, index, MGMT_OP_REMOVE_REMOTE_OOB_DATA, status,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -1903,10 +2164,50 @@ static int remove_remote_oob_data(struct sock *sk, u16 index,
        return err;
 }
 
+static int discovery(struct hci_dev *hdev)
+{
+       int err;
+
+       if (lmp_host_le_capable(hdev)) {
+               if (lmp_bredr_capable(hdev)) {
+                       err = hci_le_scan(hdev, LE_SCAN_TYPE,
+                                               LE_SCAN_INT, LE_SCAN_WIN,
+                                               LE_SCAN_TIMEOUT_BREDR_LE);
+               } else {
+                       hdev->discovery.type = DISCOV_TYPE_LE;
+                       err = hci_le_scan(hdev, LE_SCAN_TYPE,
+                                               LE_SCAN_INT, LE_SCAN_WIN,
+                                               LE_SCAN_TIMEOUT_LE_ONLY);
+               }
+       } else {
+               hdev->discovery.type = DISCOV_TYPE_BREDR;
+               err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+       }
+
+       return err;
+}
+
+int mgmt_interleaved_discovery(struct hci_dev *hdev)
+{
+       int err;
+
+       BT_DBG("%s", hdev->name);
+
+       hci_dev_lock(hdev);
+
+       err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR_LE);
+       if (err < 0)
+               hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+
+       hci_dev_unlock(hdev);
+
+       return err;
+}
+
 static int start_discovery(struct sock *sk, u16 index,
-                                               unsigned char *data, u16 len)
+                                               void *data, u16 len)
 {
-       struct mgmt_cp_start_discovery *cp = (void *) data;
+       struct mgmt_cp_start_discovery *cp = data;
        struct pending_cmd *cmd;
        struct hci_dev *hdev;
        int err;
@@ -1930,15 +2231,42 @@ static int start_discovery(struct sock *sk, u16 index,
                goto failed;
        }
 
+       if (hdev->discovery.state != DISCOVERY_STOPPED) {
+               err = cmd_status(sk, index, MGMT_OP_START_DISCOVERY,
+                                               MGMT_STATUS_BUSY);
+               goto failed;
+       }
+
        cmd = mgmt_pending_add(sk, MGMT_OP_START_DISCOVERY, hdev, NULL, 0);
        if (!cmd) {
                err = -ENOMEM;
                goto failed;
        }
 
-       err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+       hdev->discovery.type = cp->type;
+
+       switch (hdev->discovery.type) {
+       case DISCOV_TYPE_BREDR:
+               err = hci_do_inquiry(hdev, INQUIRY_LEN_BREDR);
+               break;
+
+       case DISCOV_TYPE_LE:
+               err = hci_le_scan(hdev, LE_SCAN_TYPE, LE_SCAN_INT,
+                                       LE_SCAN_WIN, LE_SCAN_TIMEOUT_LE_ONLY);
+               break;
+
+       case DISCOV_TYPE_INTERLEAVED:
+               err = discovery(hdev);
+               break;
+
+       default:
+               err = -EINVAL;
+       }
+
        if (err < 0)
                mgmt_pending_remove(cmd);
+       else
+               hci_discovery_set_state(hdev, DISCOVERY_STARTING);
 
 failed:
        hci_dev_unlock(hdev);
@@ -1951,6 +2279,8 @@ static int stop_discovery(struct sock *sk, u16 index)
 {
        struct hci_dev *hdev;
        struct pending_cmd *cmd;
+       struct hci_cp_remote_name_req_cancel cp;
+       struct inquiry_entry *e;
        int err;
 
        BT_DBG("hci%u", index);
@@ -1962,50 +2292,129 @@ static int stop_discovery(struct sock *sk, u16 index)
 
        hci_dev_lock(hdev);
 
+       if (!hci_discovery_active(hdev)) {
+               err = cmd_status(sk, index, MGMT_OP_STOP_DISCOVERY,
+                                               MGMT_STATUS_REJECTED);
+               goto unlock;
+       }
+
        cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, NULL, 0);
        if (!cmd) {
                err = -ENOMEM;
-               goto failed;
+               goto unlock;
+       }
+
+       if (hdev->discovery.state == DISCOVERY_FINDING) {
+               err = hci_cancel_inquiry(hdev);
+               if (err < 0)
+                       mgmt_pending_remove(cmd);
+               else
+                       hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
+               goto unlock;
+       }
+
+       e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_PENDING);
+       if (!e) {
+               mgmt_pending_remove(cmd);
+               err = cmd_complete(sk, index, MGMT_OP_STOP_DISCOVERY, 0,
+                                                               NULL, 0);
+               hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+               goto unlock;
        }
 
-       err = hci_cancel_inquiry(hdev);
+       bacpy(&cp.bdaddr, &e->data.bdaddr);
+       err = hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
+                                                       sizeof(cp), &cp);
        if (err < 0)
                mgmt_pending_remove(cmd);
+       else
+               hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
 
-failed:
+unlock:
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
 
        return err;
 }
 
-static int block_device(struct sock *sk, u16 index, unsigned char *data,
-                                                               u16 len)
+static int confirm_name(struct sock *sk, u16 index, void *data, u16 len)
 {
+       struct mgmt_cp_confirm_name *cp = data;
+       struct inquiry_entry *e;
        struct hci_dev *hdev;
-       struct mgmt_cp_block_device *cp = (void *) data;
        int err;
 
        BT_DBG("hci%u", index);
 
        if (len != sizeof(*cp))
-               return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
+                               MGMT_STATUS_INVALID_PARAMS);
 
        hdev = hci_dev_get(index);
        if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
+                               MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       if (!hci_discovery_active(hdev)) {
+               err = cmd_status(sk, index, MGMT_OP_CONFIRM_NAME,
+                                                       MGMT_STATUS_FAILED);
+               goto failed;
+       }
+
+       e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
+       if (!e) {
+               err = cmd_status (sk, index, MGMT_OP_CONFIRM_NAME,
+                               MGMT_STATUS_INVALID_PARAMS);
+               goto failed;
+       }
+
+       if (cp->name_known) {
+               e->name_state = NAME_KNOWN;
+               list_del(&e->list);
+       } else {
+               e->name_state = NAME_NEEDED;
+               hci_inquiry_cache_update_resolve(hdev, e);
+       }
+
+       err = 0;
+
+failed:
+       hci_dev_unlock(hdev);
+
+       return err;
+}
+
+static int block_device(struct sock *sk, u16 index, void *data, u16 len)
+{
+       struct hci_dev *hdev;
+       struct mgmt_cp_block_device *cp = data;
+       u8 status;
+       int err;
+
+       BT_DBG("hci%u", index);
+
+       if (len != sizeof(*cp))
                return cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
                                                MGMT_STATUS_INVALID_PARAMS);
 
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS,
+                                               &cp->addr, sizeof(cp->addr));
+
        hci_dev_lock(hdev);
 
-       err = hci_blacklist_add(hdev, &cp->bdaddr);
+       err = hci_blacklist_add(hdev, &cp->addr.bdaddr, cp->addr.type);
        if (err < 0)
-               err = cmd_status(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                       MGMT_STATUS_FAILED);
+               status = MGMT_STATUS_FAILED;
        else
-               err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE,
-                                                       NULL, 0);
+               status = 0;
+
+       err = cmd_complete(sk, index, MGMT_OP_BLOCK_DEVICE, status,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -2013,11 +2422,11 @@ static int block_device(struct sock *sk, u16 index, unsigned char *data,
        return err;
 }
 
-static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
-                                                               u16 len)
+static int unblock_device(struct sock *sk, u16 index, void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_cp_unblock_device *cp = (void *) data;
+       struct mgmt_cp_unblock_device *cp = data;
+       u8 status;
        int err;
 
        BT_DBG("hci%u", index);
@@ -2028,19 +2437,20 @@ static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
 
        hdev = hci_dev_get(index);
        if (!hdev)
-               return cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               return cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
+                                               MGMT_STATUS_INVALID_PARAMS,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
-       err = hci_blacklist_del(hdev, &cp->bdaddr);
-
+       err = hci_blacklist_del(hdev, &cp->addr.bdaddr, cp->addr.type);
        if (err < 0)
-               err = cmd_status(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                               MGMT_STATUS_INVALID_PARAMS);
+               status = MGMT_STATUS_INVALID_PARAMS;
        else
-               err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE,
-                                                               NULL, 0);
+               status = 0;
+
+       err = cmd_complete(sk, index, MGMT_OP_UNBLOCK_DEVICE, status,
+                                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -2049,10 +2459,10 @@ static int unblock_device(struct sock *sk, u16 index, unsigned char *data,
 }
 
 static int set_fast_connectable(struct sock *sk, u16 index,
-                                       unsigned char *data, u16 len)
+                                       void *data, u16 len)
 {
        struct hci_dev *hdev;
-       struct mgmt_mode *cp = (void *) data;
+       struct mgmt_mode *cp = data;
        struct hci_cp_write_page_scan_activity acp;
        u8 type;
        int err;
@@ -2095,8 +2505,8 @@ static int set_fast_connectable(struct sock *sk, u16 index,
                goto done;
        }
 
-       err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE,
-                                                       NULL, 0);
+       err = cmd_complete(sk, index, MGMT_OP_SET_FAST_CONNECTABLE, 0,
+                                                               NULL, 0);
 done:
        hci_dev_unlock(hdev);
        hci_dev_put(hdev);
@@ -2104,9 +2514,64 @@ done:
        return err;
 }
 
+static int load_long_term_keys(struct sock *sk, u16 index,
+                                       void *cp_data, u16 len)
+{
+       struct hci_dev *hdev;
+       struct mgmt_cp_load_long_term_keys *cp = cp_data;
+       u16 key_count, expected_len;
+       int i;
+
+       if (len < sizeof(*cp))
+               return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                                               EINVAL);
+
+       key_count = get_unaligned_le16(&cp->key_count);
+
+       expected_len = sizeof(*cp) + key_count *
+                                       sizeof(struct mgmt_ltk_info);
+       if (expected_len != len) {
+               BT_ERR("load_keys: expected %u bytes, got %u bytes",
+                                                       len, expected_len);
+               return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                                               EINVAL);
+       }
+
+       hdev = hci_dev_get(index);
+       if (!hdev)
+               return cmd_status(sk, index, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                                               ENODEV);
+
+       BT_DBG("hci%u key_count %u", index, key_count);
+
+       hci_dev_lock(hdev);
+
+       hci_smp_ltks_clear(hdev);
+
+       for (i = 0; i < key_count; i++) {
+               struct mgmt_ltk_info *key = &cp->keys[i];
+               u8 type;
+
+               if (key->master)
+                       type = HCI_SMP_LTK;
+               else
+                       type = HCI_SMP_LTK_SLAVE;
+
+               hci_add_ltk(hdev, &key->addr.bdaddr, key->addr.type,
+                                       type, 0, key->authenticated, key->val,
+                                       key->enc_size, key->ediv, key->rand);
+       }
+
+       hci_dev_unlock(hdev);
+       hci_dev_put(hdev);
+
+       return 0;
+}
+
 int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
 {
-       unsigned char *buf;
+       void *buf;
+       u8 *cp;
        struct mgmt_hdr *hdr;
        u16 opcode, index, len;
        int err;
@@ -2125,7 +2590,7 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                goto done;
        }
 
-       hdr = (struct mgmt_hdr *) buf;
+       hdr = buf;
        opcode = get_unaligned_le16(&hdr->opcode);
        index = get_unaligned_le16(&hdr->index);
        len = get_unaligned_le16(&hdr->len);
@@ -2135,10 +2600,15 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                goto done;
        }
 
+       cp = buf + sizeof(*hdr);
+
        switch (opcode) {
        case MGMT_OP_READ_VERSION:
                err = read_version(sk);
                break;
+       case MGMT_OP_READ_COMMANDS:
+               err = read_commands(sk);
+               break;
        case MGMT_OP_READ_INDEX_LIST:
                err = read_index_list(sk);
                break;
@@ -2146,92 +2616,103 @@ int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
                err = read_controller_info(sk, index);
                break;
        case MGMT_OP_SET_POWERED:
-               err = set_powered(sk, index, buf + sizeof(*hdr), len);
+               err = set_powered(sk, index, cp, len);
                break;
        case MGMT_OP_SET_DISCOVERABLE:
-               err = set_discoverable(sk, index, buf + sizeof(*hdr), len);
+               err = set_discoverable(sk, index, cp, len);
                break;
        case MGMT_OP_SET_CONNECTABLE:
-               err = set_connectable(sk, index, buf + sizeof(*hdr), len);
+               err = set_connectable(sk, index, cp, len);
                break;
        case MGMT_OP_SET_FAST_CONNECTABLE:
-               err = set_fast_connectable(sk, index, buf + sizeof(*hdr),
-                                                               len);
+               err = set_fast_connectable(sk, index, cp, len);
                break;
        case MGMT_OP_SET_PAIRABLE:
-               err = set_pairable(sk, index, buf + sizeof(*hdr), len);
+               err = set_pairable(sk, index, cp, len);
+               break;
+       case MGMT_OP_SET_LINK_SECURITY:
+               err = set_link_security(sk, index, cp, len);
+               break;
+       case MGMT_OP_SET_SSP:
+               err = set_ssp(sk, index, cp, len);
                break;
        case MGMT_OP_ADD_UUID:
-               err = add_uuid(sk, index, buf + sizeof(*hdr), len);
+               err = add_uuid(sk, index, cp, len);
                break;
        case MGMT_OP_REMOVE_UUID:
-               err = remove_uuid(sk, index, buf + sizeof(*hdr), len);
+               err = remove_uuid(sk, index, cp, len);
                break;
        case MGMT_OP_SET_DEV_CLASS:
-               err = set_dev_class(sk, index, buf + sizeof(*hdr), len);
+               err = set_dev_class(sk, index, cp, len);
                break;
        case MGMT_OP_LOAD_LINK_KEYS:
-               err = load_link_keys(sk, index, buf + sizeof(*hdr), len);
-               break;
-       case MGMT_OP_REMOVE_KEYS:
-               err = remove_keys(sk, index, buf + sizeof(*hdr), len);
+               err = load_link_keys(sk, index, cp, len);
                break;
        case MGMT_OP_DISCONNECT:
-               err = disconnect(sk, index, buf + sizeof(*hdr), len);
+               err = disconnect(sk, index, cp, len);
                break;
        case MGMT_OP_GET_CONNECTIONS:
                err = get_connections(sk, index);
                break;
        case MGMT_OP_PIN_CODE_REPLY:
-               err = pin_code_reply(sk, index, buf + sizeof(*hdr), len);
+               err = pin_code_reply(sk, index, cp, len);
                break;
        case MGMT_OP_PIN_CODE_NEG_REPLY:
-               err = pin_code_neg_reply(sk, index, buf + sizeof(*hdr), len);
+               err = pin_code_neg_reply(sk, index, cp, len);
                break;
        case MGMT_OP_SET_IO_CAPABILITY:
-               err = set_io_capability(sk, index, buf + sizeof(*hdr), len);
+               err = set_io_capability(sk, index, cp, len);
                break;
        case MGMT_OP_PAIR_DEVICE:
-               err = pair_device(sk, index, buf + sizeof(*hdr), len);
+               err = pair_device(sk, index, cp, len);
+               break;
+       case MGMT_OP_CANCEL_PAIR_DEVICE:
+               err = cancel_pair_device(sk, index, buf + sizeof(*hdr), len);
+               break;
+       case MGMT_OP_UNPAIR_DEVICE:
+               err = unpair_device(sk, index, cp, len);
                break;
        case MGMT_OP_USER_CONFIRM_REPLY:
-               err = user_confirm_reply(sk, index, buf + sizeof(*hdr), len);
+               err = user_confirm_reply(sk, index, cp, len);
                break;
        case MGMT_OP_USER_CONFIRM_NEG_REPLY:
-               err = user_confirm_neg_reply(sk, index, buf + sizeof(*hdr),
-                                                                       len);
+               err = user_confirm_neg_reply(sk, index, cp, len);
                break;
        case MGMT_OP_USER_PASSKEY_REPLY:
-               err = user_passkey_reply(sk, index, buf + sizeof(*hdr), len);
+               err = user_passkey_reply(sk, index, cp, len);
                break;
        case MGMT_OP_USER_PASSKEY_NEG_REPLY:
-               err = user_passkey_neg_reply(sk, index, buf + sizeof(*hdr),
-                                                                       len);
+               err = user_passkey_neg_reply(sk, index, cp, len);
                break;
        case MGMT_OP_SET_LOCAL_NAME:
-               err = set_local_name(sk, index, buf + sizeof(*hdr), len);
+               err = set_local_name(sk, index, cp, len);
                break;
        case MGMT_OP_READ_LOCAL_OOB_DATA:
                err = read_local_oob_data(sk, index);
                break;
        case MGMT_OP_ADD_REMOTE_OOB_DATA:
-               err = add_remote_oob_data(sk, index, buf + sizeof(*hdr), len);
+               err = add_remote_oob_data(sk, index, cp, len);
                break;
        case MGMT_OP_REMOVE_REMOTE_OOB_DATA:
-               err = remove_remote_oob_data(sk, index, buf + sizeof(*hdr),
-                                                                       len);
+               err = remove_remote_oob_data(sk, index, cp, len);
                break;
        case MGMT_OP_START_DISCOVERY:
-               err = start_discovery(sk, index, buf + sizeof(*hdr), len);
+               err = start_discovery(sk, index, cp, len);
                break;
        case MGMT_OP_STOP_DISCOVERY:
                err = stop_discovery(sk, index);
                break;
+       case MGMT_OP_CONFIRM_NAME:
+               err = confirm_name(sk, index, cp, len);
+               break;
        case MGMT_OP_BLOCK_DEVICE:
-               err = block_device(sk, index, buf + sizeof(*hdr), len);
+               err = block_device(sk, index, cp, len);
                break;
        case MGMT_OP_UNBLOCK_DEVICE:
-               err = unblock_device(sk, index, buf + sizeof(*hdr), len);
+               err = unblock_device(sk, index, cp, len);
+               break;
+       case MGMT_OP_LOAD_LONG_TERM_KEYS:
+               err = load_long_term_keys(sk, index, cp, len);
                break;
        default:
                BT_DBG("Unknown op %u", opcode);
@@ -2273,7 +2754,6 @@ int mgmt_index_removed(struct hci_dev *hdev)
 }
 
 struct cmd_lookup {
-       u8 val;
        struct sock *sk;
        struct hci_dev *hdev;
 };
@@ -2296,9 +2776,9 @@ static void settings_rsp(struct pending_cmd *cmd, void *data)
 
 int mgmt_powered(struct hci_dev *hdev, u8 powered)
 {
-       struct cmd_lookup match = { powered, NULL, hdev };
+       struct cmd_lookup match = { NULL, hdev };
        __le32 ev;
-       int ret;
+       int err;
 
        mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
 
@@ -2309,50 +2789,50 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
 
        ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
                                                                match.sk);
 
        if (match.sk)
                sock_put(match.sk);
 
-       return ret;
+       return err;
 }
 
 int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable)
 {
-       struct cmd_lookup match = { discoverable, NULL, hdev };
+       struct cmd_lookup match = { NULL, hdev };
        __le32 ev;
-       int ret;
+       int err;
 
        mgmt_pending_foreach(MGMT_OP_SET_DISCOVERABLE, hdev, settings_rsp, &match);
 
        ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev),
                                                                match.sk);
        if (match.sk)
                sock_put(match.sk);
 
-       return ret;
+       return err;
 }
 
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable)
 {
        __le32 ev;
-       struct cmd_lookup match = { connectable, NULL, hdev };
-       int ret;
+       struct cmd_lookup match = { NULL, hdev };
+       int err;
 
        mgmt_pending_foreach(MGMT_OP_SET_CONNECTABLE, hdev, settings_rsp,
                                                                &match);
 
        ev = cpu_to_le32(get_current_settings(hdev));
 
-       ret = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
 
        if (match.sk)
                sock_put(match.sk);
 
-       return ret;
+       return err;
 }
 
 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
@@ -2378,7 +2858,8 @@ int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
        memset(&ev, 0, sizeof(ev));
 
        ev.store_hint = persistent;
-       bacpy(&ev.key.bdaddr, &key->bdaddr);
+       bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
+       ev.key.addr.type = MGMT_ADDR_BREDR;
        ev.key.type = key->type;
        memcpy(ev.key.val, key->val, 16);
        ev.key.pin_len = key->pin_len;
@@ -2386,15 +2867,52 @@ int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
        return mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL);
 }
 
-int mgmt_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                               u8 addr_type)
+int mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, u8 persistent)
 {
-       struct mgmt_addr_info ev;
+       struct mgmt_ev_new_long_term_key ev;
 
-       bacpy(&ev.bdaddr, bdaddr);
-       ev.type = link_to_mgmt(link_type, addr_type);
+       memset(&ev, 0, sizeof(ev));
 
-       return mgmt_event(MGMT_EV_CONNECTED, hdev, &ev, sizeof(ev), NULL);
+       ev.store_hint = persistent;
+       bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
+       ev.key.addr.type = key->bdaddr_type;
+       ev.key.authenticated = key->authenticated;
+       ev.key.enc_size = key->enc_size;
+       ev.key.ediv = key->ediv;
+
+       if (key->type == HCI_SMP_LTK)
+               ev.key.master = 1;
+
+       memcpy(ev.key.rand, key->rand, sizeof(key->rand));
+       memcpy(ev.key.val, key->val, sizeof(key->val));
+
+       return mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev,
+                                               &ev, sizeof(ev), NULL);
+}
+
+int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                                       u8 addr_type, u8 *name, u8 name_len,
+                                       u8 *dev_class)
+{
+       char buf[512];
+       struct mgmt_ev_device_connected *ev = (void *) buf;
+       u16 eir_len = 0;
+
+       bacpy(&ev->addr.bdaddr, bdaddr);
+       ev->addr.type = link_to_mgmt(link_type, addr_type);
+
+       if (name_len > 0)
+               eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE,
+                                                               name, name_len);
+
+       if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
+               eir_len = eir_append_data(&ev->eir[eir_len], eir_len,
+                                       EIR_CLASS_OF_DEV, dev_class, 3);
+
+       put_unaligned_le16(eir_len, &ev->eir_len);
+
+       return mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf,
+                                               sizeof(*ev) + eir_len, NULL);
 }
 
 static void disconnect_rsp(struct pending_cmd *cmd, void *data)
@@ -2403,10 +2921,11 @@ static void disconnect_rsp(struct pending_cmd *cmd, void *data)
        struct sock **sk = data;
        struct mgmt_rp_disconnect rp;
 
-       bacpy(&rp.bdaddr, &cp->bdaddr);
-       rp.status = 0;
+       bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+       rp.addr.type = cp->addr.type;
 
-       cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, &rp, sizeof(rp));
+       cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT, 0, &rp,
+                                                               sizeof(rp));
 
        *sk = cmd->sk;
        sock_hold(*sk);
@@ -2414,25 +2933,25 @@ static void disconnect_rsp(struct pending_cmd *cmd, void *data)
        mgmt_pending_remove(cmd);
 }
 
-static void remove_keys_rsp(struct pending_cmd *cmd, void *data)
+static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
 {
-       u8 *status = data;
-       struct mgmt_cp_remove_keys *cp = cmd->param;
-       struct mgmt_rp_remove_keys rp;
+       struct hci_dev *hdev = data;
+       struct mgmt_cp_unpair_device *cp = cmd->param;
+       struct mgmt_rp_unpair_device rp;
 
        memset(&rp, 0, sizeof(rp));
-       bacpy(&rp.bdaddr, &cp->bdaddr);
-       if (status != NULL)
-               rp.status = *status;
+       bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr);
+       rp.addr.type = cp->addr.type;
 
-       cmd_complete(cmd->sk, cmd->index, MGMT_OP_REMOVE_KEYS, &rp,
-                                                               sizeof(rp));
+       device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk);
+
+       cmd_complete(cmd->sk, cmd->index, cmd->opcode, 0, &rp, sizeof(rp));
 
        mgmt_pending_remove(cmd);
 }
 
-int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                                                               u8 addr_type)
+int mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                               u8 link_type, u8 addr_type)
 {
        struct mgmt_addr_info ev;
        struct sock *sk = NULL;
@@ -2443,40 +2962,39 @@ int mgmt_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
        bacpy(&ev.bdaddr, bdaddr);
        ev.type = link_to_mgmt(link_type, addr_type);
 
-       err = mgmt_event(MGMT_EV_DISCONNECTED, hdev, &ev, sizeof(ev), sk);
+       err = mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev),
+                                                                       sk);
 
        if (sk)
                sock_put(sk);
 
-       mgmt_pending_foreach(MGMT_OP_REMOVE_KEYS, hdev, remove_keys_rsp, NULL);
+       mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
+                                                                       hdev);
 
        return err;
 }
 
-int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
+int mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                       u8 link_type, u8 addr_type, u8 status)
 {
+       struct mgmt_rp_disconnect rp;
        struct pending_cmd *cmd;
-       u8 mgmt_err = mgmt_status(status);
        int err;
 
        cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
        if (!cmd)
                return -ENOENT;
 
-       if (bdaddr) {
-               struct mgmt_rp_disconnect rp;
+       bacpy(&rp.addr.bdaddr, bdaddr);
+       rp.addr.type = link_to_mgmt(link_type, addr_type);
 
-               bacpy(&rp.bdaddr, bdaddr);
-               rp.status = status;
-
-               err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
-                                                       &rp, sizeof(rp));
-       } else
-               err = cmd_status(cmd->sk, hdev->id, MGMT_OP_DISCONNECT,
-                                                               mgmt_err);
+       err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_DISCONNECT,
+                                       mgmt_status(status), &rp, sizeof(rp));
 
        mgmt_pending_remove(cmd);
 
+       mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
+                                                                       hdev);
        return err;
 }
 
@@ -2496,7 +3014,8 @@ int mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
 {
        struct mgmt_ev_pin_code_request ev;
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = MGMT_ADDR_BREDR;
        ev.secure = secure;
 
        return mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev),
@@ -2514,11 +3033,11 @@ int mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
        if (!cmd)
                return -ENOENT;
 
-       bacpy(&rp.bdaddr, bdaddr);
-       rp.status = mgmt_status(status);
+       bacpy(&rp.addr.bdaddr, bdaddr);
+       rp.addr.type = MGMT_ADDR_BREDR;
 
-       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, &rp,
-                                                               sizeof(rp));
+       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                       mgmt_status(status), &rp, sizeof(rp));
 
        mgmt_pending_remove(cmd);
 
@@ -2536,11 +3055,11 @@ int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
        if (!cmd)
                return -ENOENT;
 
-       bacpy(&rp.bdaddr, bdaddr);
-       rp.status = mgmt_status(status);
+       bacpy(&rp.addr.bdaddr, bdaddr);
+       rp.addr.type = MGMT_ADDR_BREDR;
 
-       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY, &rp,
-                                                               sizeof(rp));
+       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_PIN_CODE_NEG_REPLY,
+                                       mgmt_status(status), &rp, sizeof(rp));
 
        mgmt_pending_remove(cmd);
 
@@ -2548,13 +3067,15 @@ int mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                               __le32 value, u8 confirm_hint)
+                               u8 link_type, u8 addr_type, __le32 value,
+                               u8 confirm_hint)
 {
        struct mgmt_ev_user_confirm_request ev;
 
        BT_DBG("%s", hdev->name);
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = link_to_mgmt(link_type, addr_type);
        ev.confirm_hint = confirm_hint;
        put_unaligned_le32(value, &ev.value);
 
@@ -2562,20 +3083,23 @@ int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                                                        NULL);
 }
 
-int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                               u8 link_type, u8 addr_type)
 {
        struct mgmt_ev_user_passkey_request ev;
 
        BT_DBG("%s", hdev->name);
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = link_to_mgmt(link_type, addr_type);
 
        return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev),
                                                                        NULL);
 }
 
 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                       u8 status, u8 opcode)
+                                       u8 link_type, u8 addr_type, u8 status,
+                                       u8 opcode)
 {
        struct pending_cmd *cmd;
        struct mgmt_rp_user_confirm_reply rp;
@@ -2585,9 +3109,10 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
        if (!cmd)
                return -ENOENT;
 
-       bacpy(&rp.bdaddr, bdaddr);
-       rp.status = mgmt_status(status);
-       err = cmd_complete(cmd->sk, hdev->id, opcode, &rp, sizeof(rp));
+       bacpy(&rp.addr.bdaddr, bdaddr);
+       rp.addr.type = link_to_mgmt(link_type, addr_type);
+       err = cmd_complete(cmd->sk, hdev->id, opcode, mgmt_status(status),
+                                                       &rp, sizeof(rp));
 
        mgmt_pending_remove(cmd);
 
@@ -2595,43 +3120,94 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 }
 
 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                               u8 status)
+                                       u8 link_type, u8 addr_type, u8 status)
 {
-       return user_pairing_resp_complete(hdev, bdaddr, status,
-                                               MGMT_OP_USER_CONFIRM_REPLY);
+       return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                       status, MGMT_OP_USER_CONFIRM_REPLY);
 }
 
-int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev,
-                                               bdaddr_t *bdaddr, u8 status)
+int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                       u8 link_type, u8 addr_type, u8 status)
 {
-       return user_pairing_resp_complete(hdev, bdaddr, status,
-                                       MGMT_OP_USER_CONFIRM_NEG_REPLY);
+       return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                       status, MGMT_OP_USER_CONFIRM_NEG_REPLY);
 }
 
 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
-                                                               u8 status)
+                                       u8 link_type, u8 addr_type, u8 status)
 {
-       return user_pairing_resp_complete(hdev, bdaddr, status,
-                                               MGMT_OP_USER_PASSKEY_REPLY);
+       return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                       status, MGMT_OP_USER_PASSKEY_REPLY);
 }
 
-int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev,
-                                               bdaddr_t *bdaddr, u8 status)
+int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
+                                       u8 link_type, u8 addr_type, u8 status)
 {
-       return user_pairing_resp_complete(hdev, bdaddr, status,
-                                       MGMT_OP_USER_PASSKEY_NEG_REPLY);
+       return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type,
+                                       status, MGMT_OP_USER_PASSKEY_NEG_REPLY);
 }
 
-int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 status)
+int mgmt_auth_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                                               u8 addr_type, u8 status)
 {
        struct mgmt_ev_auth_failed ev;
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = link_to_mgmt(link_type, addr_type);
        ev.status = mgmt_status(status);
 
        return mgmt_event(MGMT_EV_AUTH_FAILED, hdev, &ev, sizeof(ev), NULL);
 }
 
+int mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
+{
+       struct cmd_lookup match = { NULL, hdev };
+       __le32 ev;
+       int err;
+
+       if (status) {
+               u8 mgmt_err = mgmt_status(status);
+               mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev,
+                                               cmd_status_rsp, &mgmt_err);
+               return 0;
+       }
+
+       mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
+                                                               &match);
+
+       ev = cpu_to_le32(get_current_settings(hdev));
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
+
+       if (match.sk)
+               sock_put(match.sk);
+
+       return err;
+}
+
+int mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 status)
+{
+       struct cmd_lookup match = { NULL, hdev };
+       __le32 ev;
+       int err;
+
+       if (status) {
+               u8 mgmt_err = mgmt_status(status);
+               mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev,
+                                               cmd_status_rsp, &mgmt_err);
+               return 0;
+       }
+
+       mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
+
+       ev = cpu_to_le32(get_current_settings(hdev));
+       err = mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), match.sk);
+
+       if (match.sk)
+               sock_put(match.sk);
+
+       return err;
+}
+
 int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
 {
        struct pending_cmd *cmd;
@@ -2653,7 +3229,7 @@ int mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
 
        update_eir(hdev);
 
-       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, &ev,
+       err = cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, &ev,
                                                                sizeof(ev));
        if (err < 0)
                goto failed;
@@ -2692,7 +3268,7 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
 
                err = cmd_complete(cmd->sk, hdev->id,
                                                MGMT_OP_READ_LOCAL_OOB_DATA,
-                                               &rp, sizeof(rp));
+                                               0, &rp, sizeof(rp));
        }
 
        mgmt_pending_remove(cmd);
@@ -2701,47 +3277,78 @@ int mgmt_read_local_oob_data_reply_complete(struct hci_dev *hdev, u8 *hash,
 }
 
 int mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
-                               u8 addr_type, u8 *dev_class, s8 rssi, u8 *eir)
+                               u8 addr_type, u8 *dev_class, s8 rssi,
+                               u8 cfm_name, u8 *eir, u16 eir_len)
 {
-       struct mgmt_ev_device_found ev;
+       char buf[512];
+       struct mgmt_ev_device_found *ev = (void *) buf;
+       size_t ev_size;
 
-       memset(&ev, 0, sizeof(ev));
+       /* Leave 5 bytes for a potential CoD field */
+       if (sizeof(*ev) + eir_len + 5 > sizeof(buf))
+               return -EINVAL;
 
-       bacpy(&ev.addr.bdaddr, bdaddr);
-       ev.addr.type = link_to_mgmt(link_type, addr_type);
-       ev.rssi = rssi;
+       memset(buf, 0, sizeof(buf));
+
+       bacpy(&ev->addr.bdaddr, bdaddr);
+       ev->addr.type = link_to_mgmt(link_type, addr_type);
+       ev->rssi = rssi;
+       ev->confirm_name = cfm_name;
+
+       if (eir_len > 0)
+               memcpy(ev->eir, eir, eir_len);
+
+       if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
+               eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
+                                                               dev_class, 3);
 
-       if (eir)
-               memcpy(ev.eir, eir, sizeof(ev.eir));
+       put_unaligned_le16(eir_len, &ev->eir_len);
 
-       if (dev_class)
-               memcpy(ev.dev_class, dev_class, sizeof(ev.dev_class));
+       ev_size = sizeof(*ev) + eir_len;
 
-       return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, &ev, sizeof(ev), NULL);
+       return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL);
 }
 
-int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *name)
+int mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+                               u8 addr_type, s8 rssi, u8 *name, u8 name_len)
 {
-       struct mgmt_ev_remote_name ev;
+       struct mgmt_ev_device_found *ev;
+       char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2];
+       u16 eir_len;
 
-       memset(&ev, 0, sizeof(ev));
+       ev = (struct mgmt_ev_device_found *) buf;
 
-       bacpy(&ev.bdaddr, bdaddr);
-       memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
+       memset(buf, 0, sizeof(buf));
 
-       return mgmt_event(MGMT_EV_REMOTE_NAME, hdev, &ev, sizeof(ev), NULL);
+       bacpy(&ev->addr.bdaddr, bdaddr);
+       ev->addr.type = link_to_mgmt(link_type, addr_type);
+       ev->rssi = rssi;
+
+       eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name,
+                                                               name_len);
+
+       put_unaligned_le16(eir_len, &ev->eir_len);
+
+       return mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev,
+                                               sizeof(*ev) + eir_len, NULL);
 }
 
 int mgmt_start_discovery_failed(struct hci_dev *hdev, u8 status)
 {
        struct pending_cmd *cmd;
+       u8 type;
        int err;
 
+       hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
+
        cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
        if (!cmd)
                return -ENOENT;
 
-       err = cmd_status(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status));
+       type = hdev->discovery.type;
+
+       err = cmd_complete(cmd->sk, hdev->id, cmd->opcode, mgmt_status(status),
+                                                       &type, sizeof(type));
        mgmt_pending_remove(cmd);
 
        return err;
@@ -2766,13 +3373,22 @@ int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
 {
        struct pending_cmd *cmd;
 
+       BT_DBG("%s discovering %u", hdev->name, discovering);
+
        if (discovering)
                cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
        else
                cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
 
        if (cmd != NULL) {
-               cmd_complete(cmd->sk, hdev->id, cmd->opcode, NULL, 0);
+               u8 type = hdev->discovery.type;
+
+               if (discovering)
+                       cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
+                                                       &type, sizeof(type));
+               else
+                       cmd_complete(cmd->sk, hdev->id, cmd->opcode, 0,
+                                                               NULL, 0);
                mgmt_pending_remove(cmd);
        }
 
@@ -2780,27 +3396,29 @@ int mgmt_discovering(struct hci_dev *hdev, u8 discovering)
                                                sizeof(discovering), NULL);
 }
 
-int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_device_blocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
        struct pending_cmd *cmd;
        struct mgmt_ev_device_blocked ev;
 
        cmd = mgmt_pending_find(MGMT_OP_BLOCK_DEVICE, hdev);
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = type;
 
        return mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &ev, sizeof(ev),
                                                        cmd ? cmd->sk : NULL);
 }
 
-int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr)
+int mgmt_device_unblocked(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 {
        struct pending_cmd *cmd;
        struct mgmt_ev_device_unblocked ev;
 
        cmd = mgmt_pending_find(MGMT_OP_UNBLOCK_DEVICE, hdev);
 
-       bacpy(&ev.bdaddr, bdaddr);
+       bacpy(&ev.addr.bdaddr, bdaddr);
+       ev.addr.type = type;
 
        return mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &ev, sizeof(ev),
                                                        cmd ? cmd->sk : NULL);