Merge lp:~morphis/bluez/vivid-5.36-upgrade into lp:~bluetooth/bluez/vivid-phone-overlay

[Simon Fels]

Upgrade to upstream release 5.36

[lp:~morphis/bluez/vivid-5.36-upgrade]

10. By Simon Fels on 2015-11-23

Fix changelog to work better with citrain

Unmerged revisions

10. By Simon Fels on 2015-11-23

Fix changelog to work better with citrain

9. By Simon Fels on 2015-11-23

Prevent citrain from rewriting our version number

8. By Simon Fels on 2015-11-23

Update changelog

7. By Simon Fels on 2015-11-23

Drop upstreamed PBAP patch

6. By Simon Fels on 2015-11-23

Import upstream release 5.36

=== modified file 'ChangeLog'
--- ChangeLog	2015-10-06 11:46:27 +0000
+++ ChangeLog	2015-11-23 18:34:05 +0000
@@ -1,3 +1,11 @@
+ver 5.36:
+	Fix issue with PBAP headers for size query.
+	Fix issue with AVRCP current player handling.
+	Fix issue with device information handling.
+	Fix issue with device disconnect handling.
+	Fix issue with duplicate connect handling.
+	Fix issue with attribute claiming for drivers.
+
 ver 5.35:
 	Fix issue with connected devices after discovery.
 	Fix issue with profile support and LTK loading.

=== modified file 'Makefile.am'
--- Makefile.am	2015-10-06 11:46:27 +0000
+++ Makefile.am	2015-11-23 18:34:05 +0000
@@ -80,7 +80,7 @@
 lib_LTLIBRARIES += lib/libbluetooth.la
 
 lib_libbluetooth_la_SOURCES = $(lib_headers) $(lib_sources)
-lib_libbluetooth_la_LDFLAGS = $(AM_LDFLAGS) -version-info 21:8:18
+lib_libbluetooth_la_LDFLAGS = $(AM_LDFLAGS) -version-info 21:9:18
 lib_libbluetooth_la_DEPENDENCIES = $(local_headers)
 endif
 

=== modified file 'Makefile.in'
--- Makefile.in	2015-10-06 11:46:27 +0000
+++ Makefile.in	2015-11-23 18:34:05 +0000
@@ -747,7 +747,8 @@
 	monitor/rfcomm.h monitor/rfcomm.c monitor/bnep.h \
 	monitor/bnep.c monitor/uuid.h monitor/uuid.c monitor/hwdb.h \
 	monitor/hwdb.c monitor/keys.h monitor/keys.c monitor/analyze.h \
-	monitor/analyze.c
+	monitor/analyze.c monitor/intel.h monitor/intel.c \
+	monitor/broadcom.h monitor/broadcom.c
 @MONITOR_TRUE@am_monitor_btmon_OBJECTS = monitor/main.$(OBJEXT) \
 @MONITOR_TRUE@	monitor/display.$(OBJEXT) \
 @MONITOR_TRUE@	monitor/hcidump.$(OBJEXT) \
@@ -760,7 +761,9 @@
 @MONITOR_TRUE@	monitor/avctp.$(OBJEXT) monitor/rfcomm.$(OBJEXT) \
 @MONITOR_TRUE@	monitor/bnep.$(OBJEXT) monitor/uuid.$(OBJEXT) \
 @MONITOR_TRUE@	monitor/hwdb.$(OBJEXT) monitor/keys.$(OBJEXT) \
-@MONITOR_TRUE@	monitor/analyze.$(OBJEXT)
+@MONITOR_TRUE@	monitor/analyze.$(OBJEXT) \
+@MONITOR_TRUE@	monitor/intel.$(OBJEXT) \
+@MONITOR_TRUE@	monitor/broadcom.$(OBJEXT)
 monitor_btmon_OBJECTS = $(am_monitor_btmon_OBJECTS)
 @MONITOR_TRUE@monitor_btmon_DEPENDENCIES =  \
 @MONITOR_TRUE@	lib/libbluetooth-internal.la \
@@ -2237,7 +2240,7 @@
 local_headers = $(foreach file,$(lib_headers), lib/bluetooth/$(notdir $(file)))
 BUILT_SOURCES = $(local_headers) src/builtin.h obexd/src/builtin.h
 @LIBRARY_TRUE@lib_libbluetooth_la_SOURCES = $(lib_headers) $(lib_sources)
-@LIBRARY_TRUE@lib_libbluetooth_la_LDFLAGS = $(AM_LDFLAGS) -version-info 21:8:18
+@LIBRARY_TRUE@lib_libbluetooth_la_LDFLAGS = $(AM_LDFLAGS) -version-info 21:9:18
 @LIBRARY_TRUE@lib_libbluetooth_la_DEPENDENCIES = $(local_headers)
 lib_libbluetooth_internal_la_SOURCES = $(lib_headers) $(lib_sources) \
 					$(extra_headers) $(extra_sources)
@@ -2427,7 +2430,9 @@
 @MONITOR_TRUE@				monitor/uuid.h monitor/uuid.c \
 @MONITOR_TRUE@				monitor/hwdb.h monitor/hwdb.c \
 @MONITOR_TRUE@				monitor/keys.h monitor/keys.c \
-@MONITOR_TRUE@				monitor/analyze.h monitor/analyze.c
+@MONITOR_TRUE@				monitor/analyze.h monitor/analyze.c \
+@MONITOR_TRUE@				monitor/intel.h monitor/intel.c \
+@MONITOR_TRUE@				monitor/broadcom.h monitor/broadcom.c
 
 @MONITOR_TRUE@monitor_btmon_LDADD = lib/libbluetooth-internal.la \
 @MONITOR_TRUE@				src/libshared-mainloop.la @UDEV_LIBS@
@@ -3999,6 +4004,10 @@
 	monitor/$(DEPDIR)/$(am__dirstamp)
 monitor/analyze.$(OBJEXT): monitor/$(am__dirstamp) \
 	monitor/$(DEPDIR)/$(am__dirstamp)
+monitor/intel.$(OBJEXT): monitor/$(am__dirstamp) \
+	monitor/$(DEPDIR)/$(am__dirstamp)
+monitor/broadcom.$(OBJEXT): monitor/$(am__dirstamp) \
+	monitor/$(DEPDIR)/$(am__dirstamp)
 
 monitor/btmon$(EXEEXT): $(monitor_btmon_OBJECTS) $(monitor_btmon_DEPENDENCIES) $(EXTRA_monitor_btmon_DEPENDENCIES) monitor/$(am__dirstamp)
 	@rm -f monitor/btmon$(EXEEXT)
@@ -5275,12 +5284,14 @@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/analyze.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/avctp.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/bnep.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/broadcom.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/control.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/crc.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/display.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/ellisys.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/hcidump.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/hwdb.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/intel.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/keys.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/l2cap.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@monitor/$(DEPDIR)/ll.Po@am__quote@

=== modified file 'Makefile.tools'
--- Makefile.tools	2015-09-15 13:42:52 +0000
+++ Makefile.tools	2015-11-23 18:34:05 +0000
@@ -32,7 +32,9 @@
 				monitor/uuid.h monitor/uuid.c \
 				monitor/hwdb.h monitor/hwdb.c \
 				monitor/keys.h monitor/keys.c \
-				monitor/analyze.h monitor/analyze.c
+				monitor/analyze.h monitor/analyze.c \
+				monitor/intel.h monitor/intel.c \
+				monitor/broadcom.h monitor/broadcom.c
 monitor_btmon_LDADD = lib/libbluetooth-internal.la \
 				src/libshared-mainloop.la @UDEV_LIBS@
 endif

=== modified file 'android/Android.mk'
--- android/Android.mk	2015-09-15 13:42:52 +0000
+++ android/Android.mk	2015-11-23 18:34:05 +0000
@@ -351,6 +351,8 @@
 	bluez/monitor/keys.c \
 	bluez/monitor/ellisys.c \
 	bluez/monitor/analyze.c \
+	bluez/monitor/intel.c \
+	bluez/monitor/broadcom.c \
 	bluez/src/shared/util.c \
 	bluez/src/shared/queue.c \
 	bluez/src/shared/crypto.c \

=== modified file 'android/README'
--- android/README	2015-09-15 13:42:52 +0000
+++ android/README	2015-11-23 18:34:05 +0000
@@ -9,7 +9,7 @@
 More details about BlueZ for Android architecture and components can be found
 in android/hal-ipc-api.txt file.
 
-Supported Android version: 4.4 KitKat and 5.0 Lollipop
+Supported Android version: 4.4 KitKat and 5.0, 5.1 Lollipop
 
 
 Building and running on Android
@@ -402,12 +402,16 @@
 recommended Android fixes that are not part of latest AOSP release supported by
 BlueZ.
 
+For Android 5.1 Lollipop:
+https://android-review.googlesource.com/177314
+
 For Android 5.0 Lollipop:
 https://android-review.googlesource.com/99761
 https://android-review.googlesource.com/100297
 https://android-review.googlesource.com/102882
 https://android-review.googlesource.com/132733
 https://android-review.googlesource.com/132763
+https://android-review.googlesource.com/177314
 
 For Android 4.4 KitKat:
 https://android-review.googlesource.com/82757
@@ -417,6 +421,7 @@
 https://android-review.googlesource.com/99850
 https://android-review.googlesource.com/100297
 https://android-review.googlesource.com/102882
+https://android-review.googlesource.com/177314
 
 Unimplemented Bluetooth features
 ================================

=== modified file 'android/bluetoothd-snoop.c'
--- android/bluetoothd-snoop.c	2015-09-15 13:42:52 +0000
+++ android/bluetoothd-snoop.c	2015-11-23 18:34:05 +0000
@@ -73,6 +73,9 @@
 	case BTSNOOP_OPCODE_SCO_TX_PKT:
 	case BTSNOOP_OPCODE_SCO_RX_PKT:
 		break;
+	case BTSNOOP_OPCODE_OPEN_INDEX:
+	case BTSNOOP_OPCODE_CLOSE_INDEX:
+		break;
 	}
 
 	return 0xff;

=== modified file 'configure'
--- configure	2015-10-06 11:46:27 +0000
+++ configure	2015-11-23 18:34:05 +0000
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for bluez 5.35.
+# Generated by GNU Autoconf 2.69 for bluez 5.36.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -587,8 +587,8 @@
 # Identity of this package.
 PACKAGE_NAME='bluez'
 PACKAGE_TARNAME='bluez'
-PACKAGE_VERSION='5.35'
-PACKAGE_STRING='bluez 5.35'
+PACKAGE_VERSION='5.36'
+PACKAGE_STRING='bluez 5.36'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -1420,7 +1420,7 @@
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures bluez 5.35 to adapt to many kinds of systems.
+\`configure' configures bluez 5.36 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1490,7 +1490,7 @@
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of bluez 5.35:";;
+     short | recursive ) echo "Configuration of bluez 5.36:";;
    esac
   cat <<\_ACEOF
 
@@ -1649,7 +1649,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-bluez configure 5.35
+bluez configure 5.36
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2014,7 +2014,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by bluez $as_me 5.35, which was
+It was created by bluez $as_me 5.36, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2878,7 +2878,7 @@
 
 # Define the identity of the package.
  PACKAGE='bluez'
- VERSION='5.35'
+ VERSION='5.36'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -14690,7 +14690,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by bluez $as_me 5.35, which was
+This file was extended by bluez $as_me 5.36, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -14756,7 +14756,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-bluez config.status 5.35
+bluez config.status 5.36
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

=== modified file 'configure.ac'
--- configure.ac	2015-10-06 11:46:27 +0000
+++ configure.ac	2015-11-23 18:34:05 +0000
@@ -1,5 +1,5 @@
 AC_PREREQ(2.60)
-AC_INIT(bluez, 5.35)
+AC_INIT(bluez, 5.36)
 
 AM_INIT_AUTOMAKE([foreign subdir-objects color-tests silent-rules
 					tar-pax no-dist-gzip dist-xz])

=== modified file 'debian/changelog'
--- debian/changelog	2015-10-23 14:34:31 +0000
+++ debian/changelog	2015-11-23 18:34:05 +0000
@@ -1,3 +1,11 @@
+bluez (5.36-0ubuntu2) UNRELEASED; urgency=medium
+
+  * New upstream release.
+  * debian/patches/0001-obexd-pbap-add-headers-correctly-for-size-query.patch:
+    - Drop patch as accepted upstream.
+
+ -- Simon Fels <[e-mail]>  Mon, 23 Nov 2015 07:11:59 +0100
+
 bluez (5.35+15.04.20151023-0ubuntu1) vivid; urgency=medium
 
   [ Simon Fels ]

=== modified file 'debian/control'
--- debian/control	2015-10-12 09:54:28 +0000
+++ debian/control	2015-11-23 18:34:05 +0000
@@ -26,6 +26,8 @@
 Homepage: http://www.bluez.org
 Standards-Version: 3.9.5
 XS-Testsuite: autopkgtest
+# Prevent citrain from rewriting the version number which we don't want
+X-Auto-Uploader: no-rewrite-version
 
 Package: libbluetooth3
 Section: libs

=== removed file 'debian/patches/0001-obexd-pbap-add-headers-correctly-for-size-query.patch'
--- debian/patches/0001-obexd-pbap-add-headers-correctly-for-size-query.patch	2015-10-19 12:06:57 +0000
+++ debian/patches/0001-obexd-pbap-add-headers-correctly-for-size-query.patch	1970-01-01 00:00:00 +0000
@@ -1,44 +0,0 @@
-From 08ae4f17e97df49af0c702d43a957cb6529ef0a4 Mon Sep 17 00:00:00 2001
-From: Simon Fels <[e-mail]>
-Date: Mon, 19 Oct 2015 13:58:15 +0200
-Subject: [PATCH] obexd: pbap: add headers correctly for size query
-
-When client queries for the size of a phonebook we fall into a
-indefinite loop as g_obex_apparam_encode always returns the same
-number of items added to the buffer regardless how often it is
-called. In former times where this code wasn't using GObexApparams
-a array was reduced each time the headers where added and so we could
-easily find out when we've added all headers. However today we need
-to solve this a bit differently by also setting the firstpacket flag
-when we receive the phonebook size result from the phonebook
-implementation which then lets us correctly go through without
-falling into a indefinite loop.
----
- obexd/plugins/pbap.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/obexd/plugins/pbap.c b/obexd/plugins/pbap.c
-index f2f9166..1ecf379 100644
---- a/obexd/plugins/pbap.c
-+++ b/obexd/plugins/pbap.c
-@@ -193,6 +193,8 @@ static void phonebook_size_result(const char *buffer, size_t bufsize,
- 	pbap->obj->apparam = g_obex_apparam_set_uint16(NULL, PHONEBOOKSIZE_TAG,
- 								phonebooksize);
- 
-+	pbap->obj->firstpacket = TRUE;
-+
- 	if (missed > 0)	{
- 		DBG("missed %d", missed);
- 
-@@ -833,7 +835,7 @@ static ssize_t vobject_pull_get_next_header(void *object, void *buf, size_t mtu,
- 
- 	*hi = G_OBEX_HDR_APPARAM;
- 
--	if (pbap->params->maxlistcount == 0 || obj->firstpacket) {
-+	if (obj->firstpacket) {
- 		obj->firstpacket = FALSE;
- 
- 		return g_obex_apparam_encode(obj->apparam, buf, mtu);
--- 
-2.5.0
-

=== modified file 'debian/patches/series'
--- debian/patches/series	2015-10-19 20:21:10 +0000
+++ debian/patches/series	2015-11-23 18:34:05 +0000
@@ -13,5 +13,4 @@
 # dropped with one of the next releases
 0001-core-device-expose-list-of-connected-profiles.patch
 0002-client-add-support-for-new-property-to-list-connecte.patch
-0001-obexd-pbap-add-headers-correctly-for-size-query.patch
 0001-tools-mpris-proxy-allow-user-to-specify-different-mp.patch

=== modified file 'doc/media-api.txt'
--- doc/media-api.txt	2015-09-15 13:42:52 +0000
+++ doc/media-api.txt	2015-11-23 18:34:05 +0000
@@ -71,43 +71,43 @@
 =======================
 
 Service		org.bluez
-Interface	org.bluez.MediaControl1 [Deprecated]
+Interface	org.bluez.MediaControl1
 Object path	[variable prefix]/{hci0,hci1,...}/dev_XX_XX_XX_XX_XX_XX
 
-Methods		void Play()
+Methods		void Play() [Deprecated]
 
 			Resume playback.
 
-		void Pause()
+		void Pause() [Deprecated]
 
 			Pause playback.
 
-		void Stop()
+		void Stop() [Deprecated]
 
 			Stop playback.
 
-		void Next()
+		void Next() [Deprecated]
 
 			Next item.
 
-		void Previous()
+		void Previous() [Deprecated]
 
 			Previous item.
 
-		void VolumeUp()
+		void VolumeUp() [Deprecated]
 
 			Adjust remote volume one step up
 
-		void VolumeDown()
+		void VolumeDown() [Deprecated]
 
 			Adjust remote volume one step down
 
-		void FastForward()
+		void FastForward() [Deprecated]
 
 			Fast forward playback, this action is only stopped
 			when another method in this interface is called.
 
-		void Rewind()
+		void Rewind() [Deprecated]
 
 			Rewind playback, this action is only stopped
 			when another method in this interface is called.
@@ -116,6 +116,10 @@
 
 		boolean Connected [readonly]
 
+		object Player [readonly, optional]
+
+			Addressed Player object path.
+
 
 MediaPlayer1 hierarchy
 ======================

=== modified file 'doc/mgmt-api.txt'
--- doc/mgmt-api.txt	2015-09-15 13:42:52 +0000
+++ doc/mgmt-api.txt	2015-11-23 18:34:05 +0000
@@ -24,6 +24,7 @@
 Linux kernel v3.17	Version 1.7
 Linux kernel v3.19	Version 1.8
 Linux kernel v4.1	Version 1.9
+Linux kernel v4.2	Version 1.10
 
 Version 1.1 introduces Set Device ID command.
 

=== modified file 'emulator/btdev.c'
--- emulator/btdev.c	2015-09-15 13:42:52 +0000
+++ emulator/btdev.c	2015-11-23 18:34:05 +0000
@@ -443,6 +443,10 @@
 	btdev->commands[28] |= 0x20;	/* LE Transmitter Test */
 	btdev->commands[28] |= 0x40;	/* LE Test End */
 
+	/* Extra LE commands for >= 4.1 adapters */
+	btdev->commands[33] |= 0x10;	/* LE Remote Conn Param Req Reply */
+	btdev->commands[33] |= 0x20;	/* LE Remote Conn Param Req Neg Reply */
+
 	/* Extra LE commands for >= 4.2 adapters */
 	btdev->commands[34] |= 0x02;	/* LE Read Local P-256 Public Key */
 	btdev->commands[34] |= 0x04;	/* LE Generate DHKey */
@@ -562,6 +566,8 @@
 	btdev->max_page = 1;
 
 	btdev->le_features[0] |= 0x01;	/* LE Encryption */
+	btdev->le_features[0] |= 0x02;	/* Connection Parameters Request */
+	btdev->le_features[0] |= 0x08;	/* Slave-initiated Features Exchange */
 }
 
 static void set_amp_features(struct btdev *btdev)
@@ -1095,8 +1101,8 @@
 }
 
 static void le_conn_complete(struct btdev *btdev,
-					const uint8_t *bdaddr, uint8_t bdaddr_type,
-					uint8_t status)
+				const struct bt_hci_cmd_le_create_conn *lecc,
+				uint8_t status)
 {
 	char buf[1 + sizeof(struct bt_hci_evt_le_conn_complete)];
 	struct bt_hci_evt_le_conn_complete *cc = (void *) &buf[1];
@@ -1106,8 +1112,10 @@
 	buf[0] = BT_HCI_EVT_LE_CONN_COMPLETE;
 
 	if (!status) {
-		struct btdev *remote = find_btdev_by_bdaddr_type(bdaddr,
-								bdaddr_type);
+		struct btdev *remote;
+
+		remote = find_btdev_by_bdaddr_type(lecc->peer_addr,
+							lecc->peer_addr_type);
 
 		btdev->conn = remote;
 		btdev->le_adv_enable = 0;
@@ -1123,15 +1131,16 @@
 
 		cc->role = 0x01;
 		cc->handle = cpu_to_le16(42);
+		cc->interval = lecc->max_interval;
+		cc->latency = lecc->latency;
+		cc->supv_timeout = lecc->supv_timeout;
 
 		send_event(remote, BT_HCI_EVT_LE_META_EVENT, buf, sizeof(buf));
-
-		cc->handle = cpu_to_le16(42);
 	}
 
 	cc->status = status;
-	cc->peer_addr_type = bdaddr_type;
-	memcpy(cc->peer_addr, bdaddr, 6);
+	cc->peer_addr_type = lecc->peer_addr_type;
+	memcpy(cc->peer_addr, lecc->peer_addr, 6);
 	cc->role = 0x00;
 
 	send_event(btdev, BT_HCI_EVT_LE_META_EVENT, buf, sizeof(buf));
@@ -1173,16 +1182,17 @@
 	return btdev->le_adv_type != 0x03;
 }
 
-static void le_conn_request(struct btdev *btdev, const uint8_t *bdaddr,
-							uint8_t bdaddr_type)
+static void le_conn_request(struct btdev *btdev,
+				const struct bt_hci_cmd_le_create_conn *lecc)
 {
-	struct btdev *remote = find_btdev_by_bdaddr_type(bdaddr, bdaddr_type);
+	struct btdev *remote = find_btdev_by_bdaddr_type(lecc->peer_addr,
+							lecc->peer_addr_type);
 
 	if (remote && adv_connectable(remote) && adv_match(btdev, remote) &&
-					remote->le_adv_own_addr == bdaddr_type)
-		le_conn_complete(btdev, bdaddr, bdaddr_type, 0);
+				remote->le_adv_own_addr == lecc->peer_addr_type)
+		le_conn_complete(btdev, lecc, 0);
 	else
-		le_conn_complete(btdev, bdaddr, bdaddr_type,
+		le_conn_complete(btdev, lecc,
 					BT_HCI_ERR_CONN_FAILED_TO_ESTABLISH);
 }
 
@@ -1203,6 +1213,25 @@
 	}
 }
 
+static void rej_le_conn_update(struct btdev *btdev, uint16_t handle,
+								uint8_t reason)
+{
+	struct btdev *remote = btdev->conn;
+	struct __packed {
+		uint8_t subevent;
+		struct bt_hci_evt_le_conn_update_complete ev;
+	} ev;
+
+	if (!remote)
+		return;
+
+	ev.subevent = BT_HCI_EVT_LE_CONN_UPDATE_COMPLETE;
+	ev.ev.handle = cpu_to_le16(handle);
+	ev.ev.status = cpu_to_le16(reason);
+
+	send_event(remote, BT_HCI_EVT_LE_META_EVENT, &ev, sizeof(ev));
+}
+
 static void le_conn_update(struct btdev *btdev, uint16_t handle,
 				uint16_t min_interval, uint16_t max_interval,
 				uint16_t latency, uint16_t supv_timeout,
@@ -1231,6 +1260,30 @@
 		send_event(remote, BT_HCI_EVT_LE_META_EVENT, &ev, sizeof(ev));
 }
 
+static void le_conn_param_req(struct btdev *btdev, uint16_t handle,
+				uint16_t min_interval, uint16_t max_interval,
+				uint16_t latency, uint16_t supv_timeout,
+				uint16_t min_length, uint16_t max_length)
+{
+	struct btdev *remote = btdev->conn;
+	struct __packed {
+		uint8_t subevent;
+		struct bt_hci_evt_le_conn_param_request ev;
+	} ev;
+
+	if (!remote)
+		return;
+
+	ev.subevent = BT_HCI_EVT_LE_CONN_PARAM_REQUEST;
+	ev.ev.handle = cpu_to_le16(handle);
+	ev.ev.min_interval = cpu_to_le16(min_interval);
+	ev.ev.max_interval = cpu_to_le16(max_interval);
+	ev.ev.latency = cpu_to_le16(latency);
+	ev.ev.supv_timeout = cpu_to_le16(supv_timeout);
+
+	send_event(remote, BT_HCI_EVT_LE_META_EVENT, &ev, sizeof(ev));
+}
+
 static void disconnect_complete(struct btdev *btdev, uint16_t handle,
 							uint8_t reason)
 {
@@ -2000,6 +2053,8 @@
 	const struct bt_hci_cmd_le_ltk_req_reply *llrr;
 	const struct bt_hci_cmd_le_encrypt *lenc_cmd;
 	const struct bt_hci_cmd_le_generate_dhkey *dh;
+	const struct bt_hci_cmd_le_conn_param_req_reply *lcprr_cmd;
+	const struct bt_hci_cmd_le_conn_param_req_neg_reply *lcprnr_cmd;
 	const struct bt_hci_cmd_read_local_amp_assoc *rlaa_cmd;
 	const struct bt_hci_cmd_read_rssi *rrssi;
 	const struct bt_hci_cmd_read_tx_power *rtxp;
@@ -2041,6 +2096,8 @@
 	struct bt_hci_rsp_read_local_amp_info rlai;
 	struct bt_hci_rsp_read_local_amp_assoc rlaa_rsp;
 	struct bt_hci_rsp_get_mws_transport_config *gmtc;
+	struct bt_hci_rsp_le_conn_param_req_reply lcprr_rsp;
+	struct bt_hci_rsp_le_conn_param_req_neg_reply lcprnr_rsp;
 	struct bt_hci_rsp_le_read_buffer_size lrbs;
 	struct bt_hci_rsp_le_read_local_features lrlf;
 	struct bt_hci_rsp_le_read_adv_tx_power lratp;
@@ -2948,8 +3005,6 @@
 			status = BT_HCI_ERR_SUCCESS;
 		}
 		cmd_complete(btdev, opcode, &status, sizeof(status));
-		if (status == BT_HCI_ERR_SUCCESS && btdev->le_scan_enable)
-			le_set_scan_enable_complete(btdev);
 		break;
 
 	case BT_HCI_CMD_LE_CREATE_CONN:
@@ -3145,6 +3200,22 @@
 		cmd_complete(btdev, opcode, &lte, sizeof(lte));
 		break;
 
+	case BT_HCI_CMD_LE_CONN_PARAM_REQ_REPLY:
+		if (btdev->type == BTDEV_TYPE_BREDR)
+			goto unsupported;
+		lcprr_cmd = data;
+		lcprr_rsp.handle = lcprr_cmd->handle;
+		lcprr_rsp.status = BT_HCI_ERR_SUCCESS;
+		cmd_complete(btdev, opcode, &lcprr_rsp, sizeof(lcprr_rsp));
+		break;
+	case BT_HCI_CMD_LE_CONN_PARAM_REQ_NEG_REPLY:
+		if (btdev->type == BTDEV_TYPE_BREDR)
+			goto unsupported;
+		lcprnr_cmd = data;
+		lcprnr_rsp.handle = lcprnr_cmd->handle;
+		lcprnr_rsp.status = BT_HCI_ERR_SUCCESS;
+		cmd_complete(btdev, opcode, &lcprnr_rsp, sizeof(lcprnr_rsp));
+		break;
 	default:
 		goto unsupported;
 	}
@@ -3179,6 +3250,9 @@
 	const struct bt_hci_cmd_read_clock_offset *rco;
 	const struct bt_hci_cmd_le_create_conn *lecc;
 	const struct bt_hci_cmd_le_conn_update *lecu;
+	const struct bt_hci_cmd_le_conn_param_req_reply *lcprr;
+	const struct bt_hci_cmd_le_conn_param_req_neg_reply *lcprnr;
+	const struct bt_hci_cmd_le_set_scan_enable *lsse;
 
 	switch (opcode) {
 	case BT_HCI_CMD_INQUIRY:
@@ -3323,21 +3397,57 @@
 			return;
 		lecc = data;
 		btdev->le_scan_own_addr_type = lecc->own_addr_type;
-		le_conn_request(btdev, lecc->peer_addr, lecc->peer_addr_type);
+		le_conn_request(btdev, lecc);
 		break;
 
 	case BT_HCI_CMD_LE_CONN_UPDATE:
 		if (btdev->type == BTDEV_TYPE_BREDR)
 			return;
 		lecu = data;
-		le_conn_update(btdev, le16_to_cpu(lecu->handle),
-				le16_to_cpu(lecu->min_interval),
-				le16_to_cpu(lecu->max_interval),
-				le16_to_cpu(lecu->latency),
-				le16_to_cpu(lecu->supv_timeout),
-				le16_to_cpu(lecu->min_length),
-				le16_to_cpu(lecu->max_length));
-		break;
+		if (btdev->le_features[0] & 0x02)
+			le_conn_param_req(btdev, le16_to_cpu(lecu->handle),
+					le16_to_cpu(lecu->min_interval),
+					le16_to_cpu(lecu->max_interval),
+					le16_to_cpu(lecu->latency),
+					le16_to_cpu(lecu->supv_timeout),
+					le16_to_cpu(lecu->min_length),
+					le16_to_cpu(lecu->max_length));
+		else
+			le_conn_update(btdev, le16_to_cpu(lecu->handle),
+					le16_to_cpu(lecu->min_interval),
+					le16_to_cpu(lecu->max_interval),
+					le16_to_cpu(lecu->latency),
+					le16_to_cpu(lecu->supv_timeout),
+					le16_to_cpu(lecu->min_length),
+					le16_to_cpu(lecu->max_length));
+		break;
+	case BT_HCI_CMD_LE_CONN_PARAM_REQ_REPLY:
+		if (btdev->type == BTDEV_TYPE_BREDR)
+			return;
+		lcprr = data;
+		le_conn_update(btdev, le16_to_cpu(lcprr->handle),
+				le16_to_cpu(lcprr->min_interval),
+				le16_to_cpu(lcprr->max_interval),
+				le16_to_cpu(lcprr->latency),
+				le16_to_cpu(lcprr->supv_timeout),
+				le16_to_cpu(lcprr->min_length),
+				le16_to_cpu(lcprr->max_length));
+		break;
+	case BT_HCI_CMD_LE_CONN_PARAM_REQ_NEG_REPLY:
+		if (btdev->type == BTDEV_TYPE_BREDR)
+			return;
+		lcprnr = data;
+		rej_le_conn_update(btdev, le16_to_cpu(lcprnr->handle),
+					le16_to_cpu(lcprnr->reason));
+		break;
+		break;
+	case BT_HCI_CMD_LE_SET_SCAN_ENABLE:
+		if (btdev->type == BTDEV_TYPE_BREDR)
+			return;
+		lsse = data;
+		if (btdev->le_scan_enable && lsse->enable)
+			le_set_scan_enable_complete(btdev);
+
 	}
 }
 

=== modified file 'lib/bluetooth.c'
--- lib/bluetooth.c	2015-10-06 11:46:27 +0000
+++ lib/bluetooth.c	2015-11-23 18:34:05 +0000
@@ -1579,6 +1579,62 @@
 		return "CliniCloud Inc";
 	case 658:
 		return "SwiftSensors";
+	case 659:
+		return "Blue Bite";
+	case 660:
+		return "ELIAS GmbH";
+	case 661:
+		return "Sivantos GmbH";
+	case 662:
+		return "Petzl";
+	case 663:
+		return "storm power ltd";
+	case 664:
+		return "EISST Ltd";
+	case 665:
+		return "Inexess Technology Simma KG";
+	case 666:
+		return "Currant, Inc.";
+	case 667:
+		return "C2 Development, Inc.";
+	case 668:
+		return "Blue Sky Scientific, LLC";
+	case 669:
+		return "ALOTTAZS LABS, LLC";
+	case 670:
+		return "Kupson spol. s r.o.";
+	case 671:
+		return "Areus Engineering GmbH";
+	case 672:
+		return "Impossible Camera GmbH";
+	case 673:
+		return "InventureTrack Systems";
+	case 674:
+		return "LockedUp";
+	case 675:
+		return "Itude";
+	case 676:
+		return "Pacific Lock Company";
+	case 677:
+		return "Tendyron Corporation ( 天地融科技股份有限公司 )";
+	case 678:
+		return "Robert Bosch GmbH";
+	case 679:
+		return "Illuxtron international B.V.";
+	case 680:
+		return "miSport Ltd.";
+	case 681:
+		return "Chargelib";
+	case 682:
+		return "Doppler Lab";
+	case 683:
+		return "BBPOS Limited";
+	case 684:
+		return "RTB Elektronik GmbH & Co. KG";
+	case 685:
+		return "Rx Networks, Inc.";
+	case 686:
+		return "WeatherFlow, Inc.";
 	case 65535:
 		return "internal use";
 	default:

=== modified file 'monitor/analyze.c'
--- monitor/analyze.c	2015-09-15 13:42:52 +0000
+++ monitor/analyze.c	2015-11-23 18:34:05 +0000
@@ -309,6 +309,9 @@
 		case BTSNOOP_OPCODE_SCO_RX_PKT:
 			sco_pkt(&tv, index, buf, pktlen);
 			break;
+		case BTSNOOP_OPCODE_OPEN_INDEX:
+		case BTSNOOP_OPCODE_CLOSE_INDEX:
+			break;
 		default:
 			fprintf(stderr, "Wrong opcode %u\n", opcode);
 			goto done;

=== modified file 'monitor/avctp.c'
--- monitor/avctp.c	2015-09-15 13:42:52 +0000
+++ monitor/avctp.c	2015-11-23 18:34:05 +0000
@@ -1813,6 +1813,45 @@
 	return true;
 }
 
+
+static struct {
+	const char *str;
+	bool reserved;
+} features_table[] = {
+	/* Ignore passthrough bits */
+	[58] = { "Advanced Control Player" },
+	[59] = { "Browsing" },
+	[60] = { "Searching" },
+	[61] = { "AddToNowPlaying" },
+	[62] = { "Unique UIDs" },
+	[63] = { "OnlyBrowsableWhenAddressed" },
+	[64] = { "OnlySearchableWhenAddressed" },
+	[65] = { "NowPlaying" },
+	[66] = { "UIDPersistency" },
+	/* 67-127 reserved */
+	[67 ... 127] = { .reserved = true },
+};
+
+static void print_features(uint8_t features[16], uint8_t indent)
+{
+	int i;
+
+	for (i = 0; i < 127; i++) {
+		if (!(features[i / 8] & (1 << (i % 8))))
+			continue;
+
+		if (features_table[i].reserved) {
+			print_text(COLOR_WHITE_BG, "Unknown bit %u", i);
+			continue;
+		}
+
+		if (!features_table[i].str)
+			continue;
+
+		print_field("%*c%s", indent, ' ', features_table[i].str);
+	}
+}
+
 static bool avrcp_media_player_item(struct avctp_frame *avctp_frame,
 							uint8_t indent)
 {
@@ -1856,6 +1895,8 @@
 
 	printf("\n");
 
+	print_features(features, indent + 2);
+
 	if (!l2cap_frame_get_be16(frame, &charset))
 		return false;
 

=== added file 'monitor/broadcom.c'
--- monitor/broadcom.c	1970-01-01 00:00:00 +0000
+++ monitor/broadcom.c	2015-11-23 18:34:05 +0000
@@ -0,0 +1,251 @@
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2011-2014  Intel Corporation
+ *  Copyright (C) 2002-2010  Marcel Holtmann <[e-mail]>
+ *
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+
+#include "src/shared/util.h"
+#include "display.h"
+#include "packet.h"
+#include "lmp.h"
+#include "ll.h"
+#include "vendor.h"
+#include "broadcom.h"
+
+static void print_status(uint8_t status)
+{
+	packet_print_error("Status", status);
+}
+
+static void null_cmd(const void *data, uint8_t size)
+{
+}
+
+static void status_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+
+	print_status(status);
+}
+
+static void write_bd_addr_cmd(const void *data, uint8_t size)
+{
+	packet_print_addr("Address", data, false);
+}
+
+static void enable_usb_hid_emulation_cmd(const void *data, uint8_t size)
+{
+	uint8_t enable = get_u8(data);
+	const char *str;
+
+	switch (enable) {
+	case 0x00:
+		str = "Bluetooth mode";
+		break;
+	case 0x01:
+		str = "HID Mode";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Enable: %s (0x%2.2x)", str, enable);
+}
+
+static void write_ram_cmd(const void *data, uint8_t size)
+{
+	uint32_t addr = get_le32(data);
+
+	print_field("Address: 0x%8.8x", addr);
+
+	packet_hexdump(data + 4, size - 4);
+}
+
+static void launch_ram_cmd(const void *data, uint8_t size)
+{
+	uint32_t addr = get_le32(data);
+
+	print_field("Address: 0x%8.8x", addr);
+}
+
+static void read_vid_pid_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+	uint16_t vid = get_le16(data + 1);
+	uint16_t pid = get_le16(data + 3);
+
+	print_status(status);
+	print_field("Product: %4.4x:%4.4x", vid, pid);
+}
+
+static void read_verbose_version_info_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+	uint8_t chip_id = get_u8(data + 1);
+	uint8_t target_id = get_u8(data + 2);
+	uint16_t build_base = get_le16(data + 3);
+	uint16_t build_num = get_le16(data + 5);
+	const char *str;
+
+	print_status(status);
+	print_field("Chip ID: %u (0x%2.2x)", chip_id, chip_id);
+
+	switch (target_id) {
+	case 254:
+		str = "Invalid";
+		break;
+	case 255:
+		str = "Undefined";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Build target: %s (%u)", str, target_id);
+	print_field("Build baseline: %u (0x%4.4x)", build_base, build_base);
+	print_field("Build number: %u (0x%4.4x)", build_num, build_num);
+}
+
+static const struct vendor_ocf vendor_ocf_table[] = {
+	{ 0x001, "Write BD ADDR",
+			write_bd_addr_cmd, 6, true,
+			status_rsp, 1, true },
+	{ 0x018, "Update UART Baud Rate" },
+	{ 0x027, "Set Sleepmode Param" },
+	{ 0x02e, "Download Minidriver",
+			null_cmd, 0, true,
+			status_rsp, 1, true },
+	{ 0x03b, "Enable USB HID Emulation",
+			enable_usb_hid_emulation_cmd, 1, true,
+			status_rsp, 1, true },
+	{ 0x045, "Write UART Clock Setting" },
+	{ 0x04c, "Write RAM",
+			write_ram_cmd, 4, false,
+			status_rsp, 1, true },
+	{ 0x04e, "Launch RAM",
+			launch_ram_cmd, 4, true,
+			status_rsp, 1, true },
+	{ 0x05a, "Read VID PID",
+			null_cmd, 0, true,
+			read_vid_pid_rsp, 5, true },
+	{ 0x079, "Read Verbose Config Version Info",
+			null_cmd, 0, true,
+			read_verbose_version_info_rsp, 7, true },
+	{ }
+};
+
+const struct vendor_ocf *broadcom_vendor_ocf(uint16_t ocf)
+{
+	int i;
+
+	for (i = 0; vendor_ocf_table[i].str; i++) {
+		if (vendor_ocf_table[i].ocf == ocf)
+			return &vendor_ocf_table[i];
+	}
+
+	return NULL;
+}
+
+void broadcom_lm_diag(const void *data, uint8_t size)
+{
+	uint8_t type;
+	uint32_t clock;
+	const uint8_t *addr;
+	const char *str;
+
+	if (size != 63) {
+		packet_hexdump(data, size);
+		return;
+	}
+
+	type = *((uint8_t *) data);
+	clock = get_be32(data + 1);
+
+	switch (type) {
+	case 0x00:
+		str = "LMP sent";
+		break;
+	case 0x01:
+		str = "LMP receive";
+		break;
+	case 0x80:
+		str = "LL sent";
+		break;
+	case 0x81:
+		str = "LL receive";
+		break;
+	default:
+		str = "Unknown";
+		break;
+	}
+
+	print_field("Type: %s (%u)", str, type);
+	print_field("Clock: 0x%8.8x", clock);
+
+	switch (type) {
+	case 0x00:
+		addr = data + 5;
+		print_field("Address: --:--:%2.2X:%2.2X:%2.2X:%2.2X",
+					addr[0], addr[1], addr[2], addr[3]);
+		packet_hexdump(data + 9, 1);
+		lmp_packet(data + 10, size - 10, true);
+		break;
+	case 0x01:
+		addr = data + 5;
+		print_field("Address: --:--:%2.2X:%2.2X:%2.2X:%2.2X",
+					addr[0], addr[1], addr[2], addr[3]);
+		packet_hexdump(data + 9, 4);
+		lmp_packet(data + 13, size - 13, true);
+		break;
+	case 0x80:
+	case 0x81:
+		packet_hexdump(data + 5, 7);
+		llcp_packet(data + 12, size - 12, true);
+		break;
+	default:
+		packet_hexdump(data + 9, size - 9);
+		break;
+	}
+}
+
+static const struct vendor_evt vendor_evt_table[] = {
+	{ }
+};
+
+const struct vendor_evt *broadcom_vendor_evt(uint8_t evt)
+{
+	int i;
+
+	for (i = 0; vendor_evt_table[i].str; i++) {
+		if (vendor_evt_table[i].evt == evt)
+			return &vendor_evt_table[i];
+	}
+
+	return NULL;
+}

=== added file 'monitor/broadcom.h'
--- monitor/broadcom.h	1970-01-01 00:00:00 +0000
+++ monitor/broadcom.h	2015-11-23 18:34:05 +0000
@@ -0,0 +1,32 @@
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2011-2014  Intel Corporation
+ *  Copyright (C) 2002-2010  Marcel Holtmann <[e-mail]>
+ *
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include <stdint.h>
+
+struct vendor_ocf;
+struct vendor_evt;
+
+const struct vendor_ocf *broadcom_vendor_ocf(uint16_t ocf);
+const struct vendor_evt *broadcom_vendor_evt(uint8_t evt);
+void broadcom_lm_diag(const void *data, uint8_t size);

=== modified file 'monitor/bt.h'
--- monitor/bt.h	2015-09-15 13:42:52 +0000
+++ monitor/bt.h	2015-11-23 18:34:05 +0000
@@ -99,8 +99,43 @@
 	uint8_t  error;
 } __attribute__ ((packed));
 
+#define BT_LL_SLAVE_FEATURE_REQ	0x0e
+struct bt_ll_slave_feature_req {
+	uint8_t  features[8];
+} __attribute__ ((packed));
+
+#define BT_LL_CONN_PARAM_REQ	0x0f
+
+#define BT_LL_CONN_PARAM_RSP	0x10
+
+#define BT_LL_REJECT_IND_EXT	0x11
+struct bt_ll_reject_ind_ext {
+	uint8_t  opcode;
+	uint8_t  error;
+} __attribute__ ((packed));
+
+#define BT_LL_PING_REQ		0x12
+
+#define BT_LL_PING_RSP		0x13
+
+#define BT_LL_LENGTH_REQ	0x14
+
+#define BT_LL_LENGTH_RSP	0x15
+
 #define LMP_ESC4(x) ((127 << 8) | (x))
 
+#define BT_LMP_NAME_REQ			1
+struct bt_lmp_name_req {
+	uint8_t  offset;
+} __attribute__ ((packed));
+
+#define BT_LMP_NAME_RSP			2
+struct bt_lmp_name_rsp {
+	uint8_t  offset;
+	uint8_t  length;
+	uint8_t  fragment[14];
+} __attribute__ ((packed));
+
 #define BT_LMP_ACCEPTED			3
 struct bt_lmp_accepted {
 	uint8_t  opcode;
@@ -114,6 +149,11 @@
 
 #define BT_LMP_CLKOFFSET_REQ		5
 
+#define BT_LMP_CLKOFFSET_RSP		6
+struct bt_lmp_clkoffset_rsp {
+	uint16_t offset;
+} __attribute__ ((packed));
+
 #define BT_LMP_DETACH			7
 struct bt_lmp_detach {
 	uint8_t  error;
@@ -146,6 +186,11 @@
 
 #define BT_LMP_STOP_ENCRYPTION_REQ	18
 
+#define BT_LMP_SWITCH_REQ		19
+struct bt_lmp_switch_req {
+	uint32_t instant;
+} __attribute__ ((packed));
+
 #define BT_LMP_UNSNIFF_REQ		24
 
 #define BT_LMP_MAX_POWER		33
@@ -154,6 +199,11 @@
 
 #define BT_LMP_AUTO_RATE		35
 
+#define BT_LMP_PREFERRED_RATE		36
+struct bt_lmp_preferred_rate {
+	uint8_t  rate;
+} __attribute__ ((packed));
+
 #define BT_LMP_VERSION_REQ		37
 struct bt_lmp_version_req {
 	uint8_t  version;
@@ -202,6 +252,12 @@
 
 #define BT_LMP_HOST_CONNECTION_REQ	51
 
+#define BT_LMP_SLOT_OFFSET		52
+struct bt_lmp_slot_offset {
+	uint16_t offset;
+	uint8_t  bdaddr[6];
+} __attribute__ ((packed));
+
 #define BT_LMP_PAGE_SCAN_MODE_REQ	54
 struct bt_lmp_page_scan_mode_req {
 	uint8_t  scheme;

=== modified file 'monitor/control.c'
--- monitor/control.c	2015-09-15 13:42:52 +0000
+++ monitor/control.c	2015-11-23 18:34:05 +0000
@@ -902,7 +902,7 @@
 static void data_callback(int fd, uint32_t events, void *user_data)
 {
 	struct control_data *data = user_data;
-	unsigned char control[32];
+	unsigned char control[64];
 	struct mgmt_hdr hdr;
 	struct msghdr msg;
 	struct iovec iov[2];
@@ -927,6 +927,8 @@
 		struct cmsghdr *cmsg;
 		struct timeval *tv = NULL;
 		struct timeval ctv;
+		struct ucred *cred = NULL;
+		struct ucred ccred;
 		uint16_t opcode, index, pktlen;
 		ssize_t len;
 
@@ -946,6 +948,11 @@
 				memcpy(&ctv, CMSG_DATA(cmsg), sizeof(ctv));
 				tv = &ctv;
 			}
+
+			if (cmsg->cmsg_type == SCM_CREDENTIALS) {
+				memcpy(&ccred, CMSG_DATA(cmsg), sizeof(ccred));
+				cred = &ccred;
+			}
 		}
 
 		opcode = le16_to_cpu(hdr.opcode);
@@ -954,14 +961,16 @@
 
 		switch (data->channel) {
 		case HCI_CHANNEL_CONTROL:
-			packet_control(tv, index, opcode, data->buf, pktlen);
+			packet_control(tv, cred, index, opcode,
+							data->buf, pktlen);
 			break;
 		case HCI_CHANNEL_MONITOR:
 			btsnoop_write_hci(btsnoop_file, tv, index, opcode,
 							data->buf, pktlen);
 			ellisys_inject_hci(tv, index, opcode,
 							data->buf, pktlen);
-			packet_monitor(tv, index, opcode, data->buf, pktlen);
+			packet_monitor(tv, cred, index, opcode,
+							data->buf, pktlen);
 			break;
 		}
 	}
@@ -1001,6 +1010,12 @@
 		return -1;
 	}
 
+	if (setsockopt(fd, SOL_SOCKET, SO_PASSCRED, &opt, sizeof(opt)) < 0) {
+		perror("Failed to enable credentials");
+		close(fd);
+		return -1;
+	}
+
 	return fd;
 }
 
@@ -1051,7 +1066,7 @@
 			uint16_t opcode = le16_to_cpu(hdr->opcode);
 			uint16_t index = le16_to_cpu(hdr->index);
 
-			packet_monitor(NULL, index, opcode,
+			packet_monitor(NULL, NULL, index, opcode,
 					data->buf + MGMT_HDR_SIZE, pktlen);
 
 			data->offset -= pktlen + MGMT_HDR_SIZE;
@@ -1190,7 +1205,7 @@
 			if (opcode == 0xffff)
 				continue;
 
-			packet_monitor(&tv, index, opcode, buf, pktlen);
+			packet_monitor(&tv, NULL, index, opcode, buf, pktlen);
 			ellisys_inject_hci(&tv, index, opcode, buf, pktlen);
 		}
 		break;

=== modified file 'monitor/display.h'
--- monitor/display.h	2015-09-15 13:42:52 +0000
+++ monitor/display.h	2015-11-23 18:34:05 +0000
@@ -38,6 +38,7 @@
 #define COLOR_WHITE_BG	"\x1B[0;47;30m"
 #define COLOR_HIGHLIGHT	"\x1B[1;39m"
 
+#define COLOR_WARN	"\x1B[1;30m"
 #define COLOR_ERROR	"\x1B[1;31m"
 
 #define FALLBACK_TERMINAL_WIDTH 80

=== modified file 'monitor/hcidump.c'
--- monitor/hcidump.c	2015-09-15 13:42:52 +0000
+++ monitor/hcidump.c	2015-11-23 18:34:05 +0000
@@ -160,17 +160,19 @@
 
 		switch (buf[0]) {
 		case HCI_COMMAND_PKT:
-			packet_hci_command(tv, data->index, buf + 1, len - 1);
+			packet_hci_command(tv, NULL, data->index,
+							buf + 1, len - 1);
 			break;
 		case HCI_EVENT_PKT:
-			packet_hci_event(tv, data->index, buf + 1, len - 1);
+			packet_hci_event(tv, NULL, data->index,
+							buf + 1, len - 1);
 			break;
 		case HCI_ACLDATA_PKT:
-			packet_hci_acldata(tv, data->index, !!dir,
+			packet_hci_acldata(tv, NULL, data->index, !!dir,
 							buf + 1, len - 1);
 			break;
 		case HCI_SCODATA_PKT:
-			packet_hci_scodata(tv, data->index, !!dir,
+			packet_hci_scodata(tv, NULL, data->index, !!dir,
 							buf + 1, len - 1);
 			break;
 		}

=== added file 'monitor/intel.c'
--- monitor/intel.c	1970-01-01 00:00:00 +0000
+++ monitor/intel.c	2015-11-23 18:34:05 +0000
@@ -0,0 +1,926 @@
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2011-2014  Intel Corporation
+ *  Copyright (C) 2002-2010  Marcel Holtmann <[e-mail]>
+ *
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <inttypes.h>
+
+#include "lib/bluetooth.h"
+#include "lib/hci.h"
+
+#include "src/shared/util.h"
+#include "display.h"
+#include "packet.h"
+#include "lmp.h"
+#include "ll.h"
+#include "vendor.h"
+#include "intel.h"
+
+#define COLOR_UNKNOWN_EVENT_MASK	COLOR_WHITE_BG
+#define COLOR_UNKNOWN_SCAN_STATUS	COLOR_WHITE_BG
+
+static void print_status(uint8_t status)
+{
+	packet_print_error("Status", status);
+}
+
+static void print_module(uint8_t module)
+{
+	const char *str;
+
+	switch (module) {
+	case 0x01:
+		str = "BC";
+		break;
+	case 0x02:
+		str = "HCI";
+		break;
+	case 0x03:
+		str = "LLC";
+		break;
+	case 0x04:
+		str = "OS";
+		break;
+	case 0x05:
+		str = "LM";
+		break;
+	case 0x06:
+		str = "SC";
+		break;
+	case 0x07:
+		str = "SP";
+		break;
+	case 0x08:
+		str = "OSAL";
+		break;
+	case 0x09:
+		str = "LC";
+		break;
+	case 0x0a:
+		str = "APP";
+		break;
+	case 0x0b:
+		str = "TLD";
+		break;
+	case 0xf0:
+		str = "Debug";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Module: %s (0x%2.2x)", str, module);
+}
+
+static void null_cmd(const void *data, uint8_t size)
+{
+}
+
+static void status_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+
+	print_status(status);
+}
+
+static void reset_cmd(const void *data, uint8_t size)
+{
+	uint8_t reset_type = get_u8(data);
+	uint8_t patch_enable = get_u8(data + 1);
+	uint8_t ddc_reload = get_u8(data + 2);
+	uint8_t boot_option = get_u8(data + 3);
+	uint32_t boot_addr = get_le32(data + 4);
+	const char *str;
+
+	switch (reset_type) {
+	case 0x00:
+		str = "Soft software reset";
+		break;
+	case 0x01:
+		str = "Hard software reset";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Reset type: %s (0x%2.2x)", str, reset_type);
+
+	switch (patch_enable) {
+	case 0x00:
+		str = "Do not enable";
+		break;
+	case 0x01:
+		str = "Enable";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Patch vectors: %s (0x%2.2x)", str, patch_enable);
+
+	switch (ddc_reload) {
+	case 0x00:
+		str = "Do not reload";
+		break;
+	case 0x01:
+		str = "Reload from OTP";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("DDC parameters: %s (0x%2.2x)", str, ddc_reload);
+
+	switch (boot_option) {
+	case 0x00:
+		str = "Current image";
+		break;
+	case 0x01:
+		str = "Specified address";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Boot option: %s (0x%2.2x)", str, boot_option);
+	print_field("Boot address: 0x%8.8x", boot_addr);
+}
+
+static void read_version_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+	uint8_t hw_platform = get_u8(data + 1);
+	uint8_t hw_variant = get_u8(data + 2);
+	uint8_t hw_revision = get_u8(data + 3);
+	uint8_t fw_variant = get_u8(data + 4);
+	uint8_t fw_revision = get_u8(data + 5);
+	uint8_t fw_build_nn = get_u8(data + 6);
+	uint8_t fw_build_cw = get_u8(data + 7);
+	uint8_t fw_build_yy = get_u8(data + 8);
+	uint8_t fw_patch = get_u8(data + 9);
+
+	print_status(status);
+	print_field("Hardware platform: 0x%2.2x", hw_platform);
+	print_field("Hardware variant: 0x%2.2x", hw_variant);
+	print_field("Hardware revision: %u.%u", hw_revision >> 4,
+						hw_revision & 0x0f);
+	print_field("Firmware variant: 0x%2.2x", fw_variant);
+	print_field("Firmware revision: %u.%u", fw_revision >> 4,
+						fw_revision & 0x0f);
+
+	print_field("Firmware build: %u-%u.%u", fw_build_nn,
+					fw_build_cw, 2000 + fw_build_yy);
+	print_field("Firmware patch: %u", fw_patch);
+}
+
+static void secure_send_cmd(const void *data, uint8_t size)
+{
+	uint8_t type = get_u8(data);
+	const char *str;
+
+	switch (type) {
+	case 0x00:
+		str = "Init";
+		break;
+	case 0x01:
+		str = "Data";
+		break;
+	case 0x02:
+		str = "Sign";
+		break;
+	case 0x03:
+		str = "PKey";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Type: %s fragment (0x%2.2x)", str, type);
+
+	packet_hexdump(data + 1, size - 1);
+}
+
+static void manufacturer_mode_cmd(const void *data, uint8_t size)
+{
+	uint8_t mode = get_u8(data);
+	uint8_t reset = get_u8(data + 1);
+	const char *str;
+
+	switch (mode) {
+	case 0x00:
+		str = "Disabled";
+		break;
+	case 0x01:
+		str = "Enabled";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Mode switch: %s (0x%2.2x)", str, mode);
+
+	switch (reset) {
+	case 0x00:
+		str = "No reset";
+		break;
+	case 0x01:
+		str = "Reset and deactivate patches";
+		break;
+	case 0x02:
+		str = "Reset and activate patches";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Reset behavior: %s (0x%2.2x)", str, reset);
+}
+
+static void write_bd_data_cmd(const void *data, uint8_t size)
+{
+	uint8_t features[8];
+
+	packet_print_addr("Address", data, false);
+	packet_hexdump(data + 6, 6);
+
+	memcpy(features, data + 12, 8);
+	packet_print_features_lmp(features, 0);
+
+	memcpy(features, data + 20, 1);
+	memset(features + 1, 0, 7);
+	packet_print_features_ll(features);
+
+	packet_hexdump(data + 21, size - 21);
+}
+
+static void read_bd_data_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+
+	print_status(status);
+	packet_print_addr("Address", data + 1, false);
+	packet_hexdump(data + 7, size - 7);
+}
+
+static void write_bd_address_cmd(const void *data, uint8_t size)
+{
+	packet_print_addr("Address", data, false);
+}
+
+static void act_deact_traces_cmd(const void *data, uint8_t size)
+{
+	uint8_t tx = get_u8(data);
+	uint8_t tx_arq = get_u8(data + 1);
+	uint8_t rx = get_u8(data + 2);
+
+	print_field("Transmit traces: 0x%2.2x", tx);
+	print_field("Transmit ARQ: 0x%2.2x", tx_arq);
+	print_field("Receive traces: 0x%2.2x", rx);
+}
+
+static void stimulate_exception_cmd(const void *data, uint8_t size)
+{
+	uint8_t type = get_u8(data);
+	const char *str;
+
+	switch (type) {
+	case 0x00:
+		str = "Fatal Exception";
+		break;
+	case 0x01:
+		str = "Debug Exception";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Type: %s (0x%2.2x)", str, type);
+}
+
+static const struct {
+	uint8_t bit;
+	const char *str;
+} events_table[] = {
+	{  0, "Bootup"			},
+	{  1, "SCO Rejected via LMP"	},
+	{  2, "PTT Switch Notification"	},
+	{  7, "Scan Status"		},
+	{  9, "Debug Exception"		},
+	{ 10, "Fatal Exception"		},
+	{ 11, "System Exception"	},
+	{ 13, "LE Link Established"	},
+	{ 14, "FW Trace String"		},
+	{ }
+};
+
+static void set_event_mask_cmd(const void *data, uint8_t size)
+{
+	const uint8_t *events_array = data;
+	uint64_t mask, events = 0;
+	int i;
+
+	for (i = 0; i < 8; i++)
+		events |= ((uint64_t) events_array[i]) << (i * 8);
+
+	print_field("Mask: 0x%16.16" PRIx64, events);
+
+	mask = events;
+
+	for (i = 0; events_table[i].str; i++) {
+		if (events & (((uint64_t) 1) << events_table[i].bit)) {
+			print_field("  %s", events_table[i].str);
+			mask &= ~(((uint64_t) 1) << events_table[i].bit);
+		}
+	}
+
+	if (mask)
+		print_text(COLOR_UNKNOWN_EVENT_MASK, "  Unknown mask "
+						"(0x%16.16" PRIx64 ")", mask);
+}
+
+static void ddc_config_write_cmd(const void *data, uint8_t size)
+{
+	while (size > 0) {
+		uint8_t param_len = get_u8(data);
+		uint16_t param_id = get_le16(data + 1);
+
+		print_field("Identifier: 0x%4.4x", param_id);
+		packet_hexdump(data + 2, param_len - 2);
+
+		data += param_len + 1;
+		size -= param_len + 1;
+	}
+}
+
+static void ddc_config_write_rsp(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+	uint16_t param_id = get_le16(data + 1);
+
+	print_status(status);
+	print_field("Identifier: 0x%4.4x", param_id);
+}
+
+static void memory_write_cmd(const void *data, uint8_t size)
+{
+	uint32_t addr = get_le32(data);
+	uint8_t mode = get_u8(data + 4);
+	uint8_t length = get_u8(data + 5);
+	const char *str;
+
+	print_field("Address: 0x%8.8x", addr);
+
+	switch (mode) {
+	case 0x00:
+		str = "Byte access";
+		break;
+	case 0x01:
+		str = "Half word access";
+		break;
+	case 0x02:
+		str = "Word access";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Mode: %s (0x%2.2x)", str, mode);
+	print_field("Length: %u", length);
+
+	packet_hexdump(data + 6, size - 6);
+}
+
+static const struct vendor_ocf vendor_ocf_table[] = {
+	{ 0x001, "Reset",
+			reset_cmd, 8, true,
+			status_rsp, 1, true },
+	{ 0x002, "No Operation" },
+	{ 0x005, "Read Version",
+			null_cmd, 0, true,
+			read_version_rsp, 10, true },
+	{ 0x006, "Set UART Baudrate" },
+	{ 0x007, "Enable LPM" },
+	{ 0x008, "PCM Write Configuration" },
+	{ 0x009, "Secure Send",
+			secure_send_cmd, 1, false,
+			status_rsp, 1, true },
+	{ 0x00d, "Read Secure Boot Params",
+			null_cmd, 0, true },
+	{ 0x00e, "Write Secure Boot Params" },
+	{ 0x00f, "Unlock" },
+	{ 0x010, "Change UART Baudrate" },
+	{ 0x011, "Manufacturer Mode",
+			manufacturer_mode_cmd, 2, true,
+			status_rsp, 1, true },
+	{ 0x012, "Read Link RSSI" },
+	{ 0x022, "Get Exception Info" },
+	{ 0x024, "Clear Exception Info" },
+	{ 0x02f, "Write BD Data",
+			write_bd_data_cmd, 6, false },
+	{ 0x030, "Read BD Data",
+			null_cmd, 0, true,
+			read_bd_data_rsp, 7, false },
+	{ 0x031, "Write BD Address",
+			write_bd_address_cmd, 6, true,
+			status_rsp, 1, true },
+	{ 0x032, "Flow Specification" },
+	{ 0x034, "Read Secure ID" },
+	{ 0x038, "Set Synchronous USB Interface Type" },
+	{ 0x039, "Config Synchronous Interface" },
+	{ 0x03f, "SW RF Kill",
+			null_cmd, 0, true,
+			status_rsp, 1, true },
+	{ 0x043, "Activate Deactivate Traces",
+			act_deact_traces_cmd, 3, true },
+	{ 0x04d, "Stimulate Exception",
+			stimulate_exception_cmd, 1, true,
+			status_rsp, 1, true },
+	{ 0x050, "Read HW Version" },
+	{ 0x052, "Set Event Mask",
+			set_event_mask_cmd, 8, true,
+			status_rsp, 1, true },
+	{ 0x053, "Config_Link_Controller" },
+	{ 0x089, "DDC Write" },
+	{ 0x08a, "DDC Read" },
+	{ 0x08b, "DDC Config Write",
+			ddc_config_write_cmd, 3, false,
+			ddc_config_write_rsp, 3, true },
+	{ 0x08c, "DDC Config Read" },
+	{ 0x08d, "Memory Read" },
+	{ 0x08e, "Memory Write",
+			memory_write_cmd, 6, false,
+			status_rsp, 1, true },
+	{ }
+};
+
+const struct vendor_ocf *intel_vendor_ocf(uint16_t ocf)
+{
+	int i;
+
+	for (i = 0; vendor_ocf_table[i].str; i++) {
+		if (vendor_ocf_table[i].ocf == ocf)
+			return &vendor_ocf_table[i];
+	}
+
+	return NULL;
+}
+
+static void fatal_exception_evt(const void *data, uint8_t size)
+{
+	uint16_t line = get_le16(data);
+	uint8_t module = get_u8(data + 2);
+	uint8_t reason = get_u8(data + 3);
+
+	print_field("Line: %u", line);
+	print_module(module);
+	print_field("Reason: 0x%2.2x", reason);
+}
+
+static void bootup_evt(const void *data, uint8_t size)
+{
+	uint8_t zero = get_u8(data);
+	uint8_t num_packets = get_u8(data + 1);
+	uint8_t source = get_u8(data + 2);
+	uint8_t reset_type = get_u8(data + 3);
+	uint8_t reset_reason = get_u8(data + 4);
+	uint8_t ddc_status = get_u8(data + 5);
+	const char *str;
+
+	print_field("Zero: 0x%2.2x", zero);
+	print_field("Number of packets: %d", num_packets);
+
+	switch (source) {
+	case 0x00:
+		str = "Bootloader";
+		break;
+	case 0x01:
+		str = "Operational firmware";
+		break;
+	case 0x02:
+		str = "Self test firmware";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Source: %s (0x%2.2x)", str, source);
+
+	switch (reset_type) {
+	case 0x00:
+		str = "Hardware reset";
+		break;
+	case 0x01:
+		str = "Soft watchdog reset";
+		break;
+	case 0x02:
+		str = "Soft software reset";
+		break;
+	case 0x03:
+		str = "Hard watchdog reset";
+		break;
+	case 0x04:
+		str = "Hard software reset";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Reset type: %s (0x%2.2x)", str, reset_type);
+
+	switch (reset_reason) {
+	case 0x00:
+		str = "Power on";
+		break;
+	case 0x01:
+		str = "Reset command";
+		break;
+	case 0x02:
+		str = "Intel reset command";
+		break;
+	case 0x03:
+		str = "Watchdog";
+		break;
+	case 0x04:
+		str = "Fatal exception";
+		break;
+	case 0x05:
+		str = "System exception";
+		break;
+	case 0xff:
+		str = "Unknown";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Reset reason: %s (0x%2.2x)", str, reset_reason);
+
+	switch (ddc_status) {
+	case 0x00:
+		str = "Firmware default";
+		break;
+	case 0x01:
+		str = "Firmware default plus OTP";
+		break;
+	case 0x02:
+		str = "Persistent RAM";
+		break;
+	case 0x03:
+		str = "Not used";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("DDC status: %s (0x%2.2x)", str, ddc_status);
+}
+
+static void default_bd_data_evt(const void *data, uint8_t size)
+{
+	uint8_t mem_status = get_u8(data);
+	const char *str;
+
+	switch (mem_status) {
+	case 0x02:
+		str = "Invalid manufacturing data";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Memory status: %s (0x%2.2x)", str, mem_status);
+}
+
+static void secure_send_commands_result_evt(const void *data, uint8_t size)
+{
+	uint8_t result = get_u8(data);
+	uint16_t opcode = get_le16(data + 1);
+	uint16_t ogf = cmd_opcode_ogf(opcode);
+	uint16_t ocf = cmd_opcode_ocf(opcode);
+	uint8_t status = get_u8(data + 3);
+	const char *str;
+
+	switch (result) {
+	case 0x00:
+		str = "Success";
+		break;
+	case 0x01:
+		str = "General failure";
+		break;
+	case 0x02:
+		str = "Hardware failure";
+		break;
+	case 0x03:
+		str = "Signature verification failed";
+		break;
+	case 0x04:
+		str = "Parsing error of command buffer";
+		break;
+	case 0x05:
+		str = "Command execution failure";
+		break;
+	case 0x06:
+		str = "Command parameters error";
+		break;
+	case 0x07:
+		str = "Command missing";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Result: %s (0x%2.2x)", str, result);
+	print_field("Opcode: 0x%4.4x (0x%2.2x|0x%4.4x)", opcode, ogf, ocf);
+	print_status(status);
+}
+
+static void debug_exception_evt(const void *data, uint8_t size)
+{
+	uint16_t line = get_le16(data);
+	uint8_t module = get_u8(data + 2);
+	uint8_t reason = get_u8(data + 3);
+
+	print_field("Line: %u", line);
+	print_module(module);
+	print_field("Reason: 0x%2.2x", reason);
+}
+
+static void le_link_established_evt(const void *data, uint8_t size)
+{
+	uint16_t handle = get_le16(data);
+	uint32_t access_addr = get_le32(data + 10);
+
+	print_field("Handle: %u", handle);
+
+	packet_hexdump(data + 2, 8);
+
+	print_field("Access address: 0x%8.8x", access_addr);
+
+	packet_hexdump(data + 14, size - 14);
+}
+
+static void scan_status_evt(const void *data, uint8_t size)
+{
+	uint8_t enable = get_u8(data);
+
+	print_field("Inquiry scan: %s",
+				(enable & 0x01) ? "Enabled" : "Disabled");
+	print_field("Page scan: %s",
+				(enable & 0x02) ? "Enabled" : "Disabled");
+
+	if (enable & 0xfc)
+		print_text(COLOR_UNKNOWN_SCAN_STATUS,
+				"  Unknown status (0x%2.2x)", enable & 0xfc);
+
+}
+
+static void act_deact_traces_complete_evt(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+
+	print_status(status);
+}
+
+static void lmp_pdu_trace_evt(const void *data, uint8_t size)
+{
+	uint8_t type, len, id;
+	uint16_t handle, count;
+	uint32_t clock;
+	const char *str;
+
+	type = get_u8(data);
+	handle = get_le16(data + 1);
+
+	switch (type) {
+	case 0x00:
+		str = "RX LMP";
+		break;
+	case 0x01:
+		str = "TX LMP";
+		break;
+	case 0x02:
+		str = "ACK LMP";
+		break;
+	case 0x03:
+		str = "RX LL";
+		break;
+	case 0x04:
+		str = "TX LL";
+		break;
+	case 0x05:
+		str = "ACK LL";
+		break;
+	default:
+		str = "Unknown";
+		break;
+	}
+
+	print_field("Type: %s (0x%2.2x)", str, type);
+	print_field("Handle: %u", handle);
+
+	switch (type) {
+	case 0x00:
+		len = size - 8;
+		clock = get_le32(data + 4 + len);
+
+		packet_hexdump(data + 3, 1);
+		lmp_packet(data + 4, len, false);
+		print_field("Clock: 0x%8.8x", clock);
+		break;
+	case 0x01:
+		len = size - 9;
+		clock = get_le32(data + 4 + len);
+		id = get_u8(data + 4 + len + 4);
+
+		packet_hexdump(data + 3, 1);
+		lmp_packet(data + 4, len, false);
+		print_field("Clock: 0x%8.8x", clock);
+		print_field("ID: 0x%2.2x", id);
+		break;
+	case 0x02:
+		clock = get_le32(data + 3);
+		id = get_u8(data + 3 + 4);
+
+		print_field("Clock: 0x%8.8x", clock);
+		print_field("ID: 0x%2.2x", id);
+		break;
+	case 0x03:
+		len = size - 8;
+		count = get_le16(data + 3);
+
+		print_field("Count: 0x%4.4x", count);
+		packet_hexdump(data + 3 + 2 + 1, 2);
+		llcp_packet(data + 8, len, false);
+		break;
+	case 0x04:
+		len = size - 8;
+		count = get_le16(data + 3);
+		id = get_u8(data + 3 + 2);
+
+		print_field("Count: 0x%4.4x", count);
+		print_field("ID: 0x%2.2x", id);
+		packet_hexdump(data + 3 + 2 + 1, 2);
+		llcp_packet(data + 8, len, false);
+		break;
+	case 0x05:
+		count = get_le16(data + 3);
+		id = get_u8(data + 3 + 2);
+
+		print_field("Count: 0x%4.4x", count);
+		print_field("ID: 0x%2.2x", id);
+		break;
+	default:
+		packet_hexdump(data + 3, size - 3);
+		break;
+	}
+}
+
+static void write_bd_data_complete_evt(const void *data, uint8_t size)
+{
+	uint8_t status = get_u8(data);
+
+	print_status(status);
+}
+
+static void sco_rejected_via_lmp_evt(const void *data, uint8_t size)
+{
+	uint8_t reason = get_u8(data + 6);
+
+	packet_print_addr("Address", data, false);
+	packet_print_error("Reason", reason);
+}
+
+static void ptt_switch_notification_evt(const void *data, uint8_t size)
+{
+	uint16_t handle = get_le16(data);
+	uint8_t table = get_u8(data + 2);
+	const char *str;
+
+	print_field("Handle: %u", handle);
+
+	switch (table) {
+	case 0x00:
+		str = "Basic rate";
+		break;
+	case 0x01:
+		str = "Enhanced data rate";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Packet type table: %s (0x%2.2x)", str, table);
+}
+
+static void system_exception_evt(const void *data, uint8_t size)
+{
+	uint8_t type = get_u8(data);
+	const char *str;
+
+	switch (type) {
+	case 0x00:
+		str = "No Exception";
+		break;
+	case 0x01:
+		str = "Undefined Instruction";
+		break;
+	case 0x02:
+		str = "Prefetch abort";
+		break;
+	case 0x03:
+		str = "Data abort";
+		break;
+	default:
+		str = "Reserved";
+		break;
+	}
+
+	print_field("Type: %s (0x%2.2x)", str, type);
+
+	packet_hexdump(data + 1, size - 1);
+}
+
+static const struct vendor_evt vendor_evt_table[] = {
+	{ 0x01, "Fatal Exception",
+			fatal_exception_evt, 4, true },
+	{ 0x02, "Bootup",
+			bootup_evt, 6, true },
+	{ 0x05, "Default BD Data",
+			default_bd_data_evt, 1, true },
+	{ 0x06, "Secure Send Commands Result",
+			secure_send_commands_result_evt, 4, true },
+	{ 0x08, "Debug Exception",
+			debug_exception_evt, 4, true },
+	{ 0x0f, "LE Link Established",
+			le_link_established_evt, 26, true },
+	{ 0x11, "Scan Status",
+			scan_status_evt, 1, true },
+	{ 0x16, "Activate Deactivate Traces Complete",
+			act_deact_traces_complete_evt, 1, true },
+	{ 0x17, "LMP PDU Trace",
+			lmp_pdu_trace_evt, 3, false },
+	{ 0x19, "Write BD Data Complete",
+			write_bd_data_complete_evt, 1, true },
+	{ 0x25, "SCO Rejected via LMP",
+			sco_rejected_via_lmp_evt, 7, true },
+	{ 0x26, "PTT Switch Notification",
+			ptt_switch_notification_evt, 3, true },
+	{ 0x29, "System Exception",
+			system_exception_evt, 133, true },
+	{ 0x2c, "FW Trace String" },
+	{ 0x2e, "FW Trace Binary" },
+	{ }
+};
+
+const struct vendor_evt *intel_vendor_evt(uint8_t evt)
+{
+	int i;
+
+	for (i = 0; vendor_evt_table[i].str; i++) {
+		if (vendor_evt_table[i].evt == evt)
+			return &vendor_evt_table[i];
+	}
+
+	return NULL;
+}

=== added file 'monitor/intel.h'
--- monitor/intel.h	1970-01-01 00:00:00 +0000
+++ monitor/intel.h	2015-11-23 18:34:05 +0000
@@ -0,0 +1,31 @@
+/*
+ *
+ *  BlueZ - Bluetooth protocol stack for Linux
+ *
+ *  Copyright (C) 2011-2014  Intel Corporation
+ *  Copyright (C) 2002-2010  Marcel Holtmann <[e-mail]>
+ *
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include <stdint.h>
+
+struct vendor_ocf;
+struct vendor_evt;
+
+const struct vendor_ocf *intel_vendor_ocf(uint16_t ocf);
+const struct vendor_evt *intel_vendor_evt(uint8_t evt);

=== modified file 'monitor/ll.c'
--- monitor/ll.c	2015-09-15 13:42:52 +0000
+++ monitor/ll.c	2015-11-23 18:34:05 +0000
@@ -245,7 +245,7 @@
 	}
 }
 
-static void data_packet(const void *data, uint8_t size)
+static void data_packet(const void *data, uint8_t size, bool padded)
 {
 	const uint8_t *ptr = data;
 	uint8_t llid, length;
@@ -290,7 +290,7 @@
 
 	switch (llid) {
 	case 0x03:
-		llcp_packet(data + 2, size - 2);
+		llcp_packet(data + 2, size - 2, padded);
 		break;
 
 	default:
@@ -299,7 +299,7 @@
 	}
 }
 
-void ll_packet(uint16_t frequency, const void *data, uint8_t size)
+void ll_packet(uint16_t frequency, const void *data, uint8_t size, bool padded)
 {
 	const struct bt_ll_hdr *hdr = data;
 	uint8_t channel = (frequency - 2402) / 2;
@@ -368,7 +368,7 @@
 	if (access_addr == 0x8e89bed6)
 		advertising_packet(pdu_data, pdu_len);
 	else
-		data_packet(pdu_data, pdu_len);
+		data_packet(pdu_data, pdu_len, padded);
 }
 
 static void null_pdu(const void *data, uint8_t size)
@@ -460,6 +460,21 @@
 	packet_print_error("Error code", pdu->error);
 }
 
+static void slave_feature_req(const void *data, uint8_t size)
+{
+	const struct bt_ll_slave_feature_req *pdu = data;
+
+	packet_print_features_ll(pdu->features);
+}
+
+static void reject_ind_ext(const void *data, uint8_t size)
+{
+	const struct bt_ll_reject_ind_ext *pdu = data;
+
+	print_field("Reject opcode: %u (0x%2.2x)", pdu->opcode, pdu->opcode);
+	packet_print_error("Error code", pdu->error);
+}
+
 struct llcp_data {
 	uint8_t opcode;
 	const char *str;
@@ -469,22 +484,28 @@
 };
 
 static const struct llcp_data llcp_table[] = {
-	{ 0x00, "LL_CONNECTION_UPDATE_REQ", conn_update_req, 11, true },
-	{ 0x01, "LL_CHANNEL_MAP_REQ",       channel_map_req,  7, true },
-	{ 0x02, "LL_TERMINATE_IND",         terminate_ind,    1, true },
-	{ 0x03, "LL_ENC_REQ",               enc_req,         22, true },
-	{ 0x04, "LL_ENC_RSP",               enc_rsp,         12, true },
-	{ 0x05, "LL_START_ENC_REQ",         null_pdu,         0, true },
-	{ 0x06, "LL_START_ENC_RSP",         null_pdu,         0, true },
-	{ 0x07, "LL_UNKNOWN_RSP",           unknown_rsp,      1, true },
-	{ 0x08, "LL_FEATURE_REQ",           feature_req,      8, true },
-	{ 0x09, "LL_FEATURE_RSP",           feature_rsp,      8, true },
-	{ 0x0a, "LL_PAUSE_ENC_REQ",         null_pdu,         0, true },
-	{ 0x0b, "LL_PAUSE_ENC_RSP",         null_pdu,         0, true },
-	{ 0x0c, "LL_VERSION_IND",           version_ind,      5, true },
-	{ 0x0d, "LL_REJECT_IND",            reject_ind,       1, true },
-	{ 0x12, "LL_PING_REQ",              null_pdu,         0, true },
-	{ 0x13, "LL_PING_RSP",              null_pdu,         0, true },
+	{ 0x00, "LL_CONNECTION_UPDATE_REQ", conn_update_req,   11, true },
+	{ 0x01, "LL_CHANNEL_MAP_REQ",       channel_map_req,    7, true },
+	{ 0x02, "LL_TERMINATE_IND",         terminate_ind,      1, true },
+	{ 0x03, "LL_ENC_REQ",               enc_req,           22, true },
+	{ 0x04, "LL_ENC_RSP",               enc_rsp,           12, true },
+	{ 0x05, "LL_START_ENC_REQ",         null_pdu,           0, true },
+	{ 0x06, "LL_START_ENC_RSP",         null_pdu,           0, true },
+	{ 0x07, "LL_UNKNOWN_RSP",           unknown_rsp,        1, true },
+	{ 0x08, "LL_FEATURE_REQ",           feature_req,        8, true },
+	{ 0x09, "LL_FEATURE_RSP",           feature_rsp,        8, true },
+	{ 0x0a, "LL_PAUSE_ENC_REQ",         null_pdu,           0, true },
+	{ 0x0b, "LL_PAUSE_ENC_RSP",         null_pdu,           0, true },
+	{ 0x0c, "LL_VERSION_IND",           version_ind,        5, true },
+	{ 0x0d, "LL_REJECT_IND",            reject_ind,         1, true },
+	{ 0x0e, "LL_SLAVE_FEATURE_REQ",     slave_feature_req,  8, true },
+	{ 0x0f, "LL_CONNECTION_PARAM_REQ",  NULL,              23, true },
+	{ 0x10, "LL_CONNECTION_PARAM_RSP",  NULL,              23, true },
+	{ 0x11, "LL_REJECT_IND_EXT",        reject_ind_ext,     2, true },
+	{ 0x12, "LL_PING_REQ",              null_pdu,           0, true },
+	{ 0x13, "LL_PING_RSP",              null_pdu,           0, true },
+	{ 0x14, "LL_LENGTH_REQ",            NULL,               8, true },
+	{ 0x15, "LL_LENGTH_RSP",            NULL,               8, true },
 	{ }
 };
 
@@ -500,7 +521,7 @@
 	return "Unknown";
 }
 
-void llcp_packet(const void *data, uint8_t size)
+void llcp_packet(const void *data, uint8_t size, bool padded)
 {
 	uint8_t opcode = ((const uint8_t *) data)[0];
 	const struct llcp_data *llcp_data = NULL;
@@ -533,7 +554,7 @@
 		return;
 	}
 
-	if (llcp_data->fixed) {
+	if (llcp_data->fixed && !padded) {
 		if (size - 1 != llcp_data->size) {
 			print_text(COLOR_ERROR, "invalid packet size");
 			packet_hexdump(data + 1, size - 1);

=== modified file 'monitor/ll.h'
--- monitor/ll.h	2015-09-15 13:42:52 +0000
+++ monitor/ll.h	2015-11-23 18:34:05 +0000
@@ -24,5 +24,5 @@
 
 #include <stdint.h>
 
-void ll_packet(uint16_t frequency, const void *data, uint8_t size);
-void llcp_packet(const void *data, uint8_t size);
+void ll_packet(uint16_t frequency, const void *data, uint8_t size, bool padded);
+void llcp_packet(const void *data, uint8_t size, bool padded);

=== modified file 'monitor/lmp.c'
--- monitor/lmp.c	2015-09-15 13:42:52 +0000
+++ monitor/lmp.c	2015-11-23 18:34:05 +0000
@@ -27,6 +27,7 @@
 #endif
 
 #include <stdio.h>
+#include <string.h>
 
 #include "src/shared/util.h"
 #include "display.h"
@@ -54,6 +55,26 @@
 		print_field("Operation: %s (%u)", str, opcode);
 }
 
+static void name_req(const void *data, uint8_t size)
+{
+	const struct bt_lmp_name_req *pdu = data;
+
+	print_field("Offset: %u", pdu->offset);
+}
+
+static void name_rsp(const void *data, uint8_t size)
+{
+	const struct bt_lmp_name_rsp *pdu = data;
+	char str[15];
+
+	memcpy(str, pdu->fragment, 14);
+	str[14] = '\0';
+
+	print_field("Offset: %u", pdu->offset);
+	print_field("Length: %u", pdu->length);
+	print_field("Fragment: %s", str);
+}
+
 static void accepted(const void *data, uint8_t size)
 {
 	const struct bt_lmp_accepted *pdu = data;
@@ -73,6 +94,13 @@
 {
 }
 
+static void clkoffset_rsp(const void *data, uint8_t size)
+{
+	const struct bt_lmp_clkoffset_rsp *pdu = data;
+
+	print_field("Clock offset: 0x%4.4x", le16_to_cpu(pdu->offset));
+}
+
 static void detach(const void *data, uint8_t size)
 {
 	const struct bt_lmp_detach *pdu = data;
@@ -135,6 +163,13 @@
 {
 }
 
+static void switch_req(const void *data, uint8_t size)
+{
+	const struct bt_lmp_switch_req *pdu = data;
+
+	print_field("Instant: 0x%8.8x", le32_to_cpu(pdu->instant));
+}
+
 static void unsniff_req(const void *data, uint8_t size)
 {
 }
@@ -151,6 +186,67 @@
 {
 }
 
+static void preferred_rate(const void *data, uint8_t size)
+{
+	const struct bt_lmp_preferred_rate *pdu = data;
+	const char *str;
+
+	str = (pdu->rate & 0x01) ? "do not use FEC" : "use FEC";
+
+	print_field("Basic data rate: %s (0x%02x)", str, pdu->rate & 0x01);
+
+	switch ((pdu->rate & 0x06) >> 1) {
+	case 0:
+		str = "No packet-size preference available";
+		break;
+	case 1:
+		str = "use 1-slot packets";
+		break;
+	case 2:
+		str = "use 3-slot packets";
+		break;
+	case 3:
+		str = "use 5-slot packets";
+		break;
+	}
+
+	print_field("Basic data rate: %s (0x%02x)", str, pdu->rate & 0x06);
+
+	switch ((pdu->rate & 0x11) >> 3) {
+	case 0:
+		str = "use DM1 packets";
+		break;
+	case 1:
+		str = "use 2 Mb/s packets";
+		break;
+	case 2:
+		str = "use 3 MB/s packets";
+		break;
+	case 3:
+		str = "reserved";
+		break;
+	}
+
+	print_field("Enhanced data rate: %s (0x%2.2x)", str, pdu->rate & 0x11);
+
+	switch ((pdu->rate & 0x60) >> 5) {
+	case 0:
+		str = "No packet-size preference available";
+		break;
+	case 1:
+		str = "use 1-slot packets";
+		break;
+	case 2:
+		str = "use 3-slot packets";
+		break;
+	case 3:
+		str = "use 5-slot packets";
+		break;
+	}
+
+	print_field("Enhanced data rate: %s (0x%2.2x)", str, pdu->rate & 0x60);
+}
+
 static void version_req(const void *data, uint8_t size)
 {
 	const struct bt_lmp_version_req *pdu = data;
@@ -221,6 +317,14 @@
 {
 }
 
+static void slot_offset(const void *data, uint8_t size)
+{
+	const struct bt_lmp_slot_offset *pdu = data;
+
+	print_field("Offset: %u usec", le16_to_cpu(pdu->offset));
+	packet_print_addr("Address", pdu->bdaddr, false);
+}
+
 static void page_scan_mode_req(const void *data, uint8_t size)
 {
 	const struct bt_lmp_page_scan_mode_req *pdu = data;
@@ -446,7 +550,7 @@
 	for (i = 0; i < 10; i++)
 		sprintf(str + (i * 2), "%2.2x", pdu->classification[i]);
 
-	print_field("Features: 0x%s", str);
+	print_field("Classification: 0x%s", str);
 }
 
 static void pause_encryption_req(const void *data, uint8_t size)
@@ -625,12 +729,12 @@
 };
 
 static const struct lmp_data lmp_table[] = {
-	{  1, "LMP_name_req" },
-	{  2, "LMP_name_res" },
+	{  1, "LMP_name_req", name_req, 1, true },
+	{  2, "LMP_name_res", name_rsp, 16, true },
 	{  3, "LMP_accepted", accepted, 1, true },
 	{  4, "LMP_not_accepted", not_accepted, 2, true },
 	{  5, "LMP_clkoffset_req", clkoffset_req, 0, true },
-	{  6, "LMP_clkoffset_res" },
+	{  6, "LMP_clkoffset_res", clkoffset_rsp, 2, true },
 	{  7, "LMP_detach", detach, 1, true },
 	{  8, "LMP_in_rand" },
 	{  9, "LMP_comb_key" },
@@ -643,7 +747,7 @@
 	{ 16, "LMP_encryption_key_size_req", encryption_key_size_req, 1, true },
 	{ 17, "LMP_start_encryption_req", start_encryption_req, 16, true },
 	{ 18, "LMP_stop_encryption_req", stop_encryption_req, 0, true },
-	{ 19, "LMP_switch_req" },
+	{ 19, "LMP_switch_req", switch_req, 4, true },
 	{ 20, "LMP_hold" },
 	{ 21, "LMP_hold_req" },
 	{ 22, "LMP_sniff" },
@@ -660,7 +764,7 @@
 	{ 33, "LMP_max_power", max_power, 0, true },
 	{ 34, "LMP_min_power", min_power, 0, true },
 	{ 35, "LMP_auto_rate", auto_rate, 0, true },
-	{ 36, "LMP_preferred_rate" },
+	{ 36, "LMP_preferred_rate", preferred_rate, 1, true },
 	{ 37, "LMP_version_req", version_req, 5, true },
 	{ 38, "LMP_version_res", version_res, 5, true },
 	{ 39, "LMP_features_req", features_req, 8, true },
@@ -676,7 +780,7 @@
 	{ 49, "LMP_setup_complete", setup_complete, 0, true },
 	{ 50, "LMP_use_semi_permanent_key", use_semi_permanent_key, 0, true },
 	{ 51, "LMP_host_connection_req", host_connection_req, 0, true },
-	{ 52, "LMP_slot_offset" },
+	{ 52, "LMP_slot_offset", slot_offset, 8, true },
 	{ 53, "LMP_page_mode_req" },
 	{ 54, "LMP_page_scan_mode_req", page_scan_mode_req, 2, true },
 	{ 55, "LMP_supervision_timeout" },
@@ -732,19 +836,27 @@
 	return NULL;
 }
 
-void lmp_packet(const void *data, uint8_t size)
+void lmp_packet(const void *data, uint8_t size, bool padded)
 {
 	const struct lmp_data *lmp_data = NULL;
 	const char *opcode_color, *opcode_str;
 	uint16_t opcode;
 	uint8_t tid, off;
+	const char *tid_str;
 	int i;
 
 	tid = ((const uint8_t *) data)[0] & 0x01;
 	opcode = (((const uint8_t *) data)[0] & 0xfe) >> 1;
 
+	tid_str = tid == 0x00 ? "Master" : "Slave";
+
 	switch (opcode) {
 	case 127:
+		if (size < 2) {
+			print_text(COLOR_ERROR, "extended opcode too short");
+			packet_hexdump(data, size);
+			return;
+		}
 		opcode = LMP_ESC4(((const uint8_t *) data)[1]);
 		off = 2;
 		break;
@@ -777,17 +889,19 @@
 
 	if (opcode & 0xff00)
 		print_indent(6, opcode_color, "", opcode_str, COLOR_OFF,
-			" (%u/%u) TID %u", opcode >> 8, opcode & 0xff, tid);
+				" (%u/%u) %s transaction (%u)",
+				opcode >> 8, opcode & 0xff, tid_str, tid);
 	else
 		print_indent(6, opcode_color, "", opcode_str, COLOR_OFF,
-					" (%u) TID %d", opcode, tid);
+				" (%u) %s transaction (%d)",
+				opcode, tid_str, tid);
 
 	if (!lmp_data || !lmp_data->func) {
 		packet_hexdump(data + off, size - off);
 		return;
 	}
 
-	if (lmp_data->fixed) {
+	if (lmp_data->fixed && !padded) {
 		if (size - off != lmp_data->size) {
 			print_text(COLOR_ERROR, "invalid packet size");
 			packet_hexdump(data + off, size - off);

=== modified file 'monitor/lmp.h'
--- monitor/lmp.h	2015-09-15 13:42:52 +0000
+++ monitor/lmp.h	2015-11-23 18:34:05 +0000
@@ -24,6 +24,6 @@
 
 #include <stdint.h>
 
-void lmp_packet(const void *data, uint8_t size);
+void lmp_packet(const void *data, uint8_t size, bool padded);
 
 void lmp_todo(void);

=== modified file 'monitor/packet.c'
--- monitor/packet.c	2015-09-15 13:42:52 +0000
+++ monitor/packet.c	2015-11-23 18:34:05 +0000
@@ -36,6 +36,7 @@
 #include <inttypes.h>
 #include <time.h>
 #include <sys/time.h>
+#include <sys/socket.h>
 
 #include "lib/bluetooth.h"
 #include "lib/hci.h"
@@ -52,6 +53,8 @@
 #include "l2cap.h"
 #include "control.h"
 #include "vendor.h"
+#include "intel.h"
+#include "broadcom.h"
 #include "packet.h"
 
 #define COLOR_INDEX_LABEL		COLOR_WHITE
@@ -59,6 +62,10 @@
 
 #define COLOR_NEW_INDEX			COLOR_GREEN
 #define COLOR_DEL_INDEX			COLOR_RED
+#define COLOR_OPEN_INDEX		COLOR_GREEN
+#define COLOR_CLOSE_INDEX		COLOR_RED
+#define COLOR_INDEX_INFO		COLOR_GREEN
+#define COLOR_VENDOR_DIAG		COLOR_YELLOW
 
 #define COLOR_HCI_COMMAND		COLOR_BLUE
 #define COLOR_HCI_COMMAND_UNKNOWN	COLOR_WHITE_BG
@@ -85,6 +92,8 @@
 static uint16_t index_number = 0;
 static uint16_t index_current = 0;
 
+#define UNKNOWN_MANUFACTURER 0xffff
+
 #define MAX_CONN 16
 
 struct conn_data {
@@ -160,7 +169,8 @@
 
 #define print_space(x) printf("%*c", (x), ' ');
 
-static void print_packet(struct timeval *tv, uint16_t index, char ident,
+static void print_packet(struct timeval *tv, struct ucred *cred,
+					uint16_t index, char ident,
 					const char *color, const char *label,
 					const char *text, const char *extra)
 {
@@ -168,7 +178,8 @@
 	char line[256], ts_str[64];
 	int n, ts_len = 0, ts_pos = 0, len = 0, pos = 0;
 
-	if (filter_mask & PACKET_FILTER_SHOW_INDEX) {
+	if ((filter_mask & PACKET_FILTER_SHOW_INDEX) &&
+					index != HCI_DEV_NONE) {
 		if (use_color()) {
 			n = sprintf(ts_str + ts_pos, "%s", COLOR_INDEX_LABEL);
 			if (n > 0)
@@ -2456,11 +2467,11 @@
 
 	if (str)
 		print_field("  Firmware: %3.3u.%3.3u.%3.3u (%s)",
-				(ver & 0x7000) >> 13,
+				(ver & 0xe000) >> 13,
 				(ver & 0x1f00) >> 8, ver & 0x00ff, str);
 	else
 		print_field("  Firmware: %3.3u.%3.3u.%3.3u",
-				(ver & 0x7000) >> 13,
+				(ver & 0xe000) >> 13,
 				(ver & 0x1f00) >> 8, ver & 0x00ff);
 
 	if (rev != 0xffff)
@@ -3646,7 +3657,8 @@
 	}
 }
 
-void packet_control(struct timeval *tv, uint16_t index, uint16_t opcode,
+void packet_control(struct timeval *tv, struct ucred *cred,
+					uint16_t index, uint16_t opcode,
 					const void *data, uint16_t size)
 {
 	if (index_filter && index_number != index)
@@ -3664,17 +3676,21 @@
 #define MAX_INDEX 16
 
 struct index_data {
-	uint8_t type;
-	uint8_t bdaddr[6];
+	uint8_t  type;
+	uint8_t  bdaddr[6];
+	uint16_t manufacturer;
 };
 
 static struct index_data index_list[MAX_INDEX];
 
-void packet_monitor(struct timeval *tv, uint16_t index, uint16_t opcode,
+void packet_monitor(struct timeval *tv, struct ucred *cred,
+					uint16_t index, uint16_t opcode,
 					const void *data, uint16_t size)
 {
 	const struct btsnoop_opcode_new_index *ni;
+	const struct btsnoop_opcode_index_info *ii;
 	char str[18], extra_str[24];
+	uint16_t manufacturer;
 
 	if (index_filter && index_number != index)
 		return;
@@ -3691,6 +3707,7 @@
 		if (index < MAX_INDEX) {
 			index_list[index].type = ni->type;
 			memcpy(index_list[index].bdaddr, ni->bdaddr, 6);
+			index_list[index].manufacturer = UNKNOWN_MANUFACTURER;
 		}
 
 		addr2str(ni->bdaddr, str);
@@ -3705,26 +3722,62 @@
 		packet_del_index(tv, index, str);
 		break;
 	case BTSNOOP_OPCODE_COMMAND_PKT:
-		packet_hci_command(tv, index, data, size);
+		packet_hci_command(tv, cred, index, data, size);
 		break;
 	case BTSNOOP_OPCODE_EVENT_PKT:
-		packet_hci_event(tv, index, data, size);
+		packet_hci_event(tv, cred, index, data, size);
 		break;
 	case BTSNOOP_OPCODE_ACL_TX_PKT:
-		packet_hci_acldata(tv, index, false, data, size);
+		packet_hci_acldata(tv, cred, index, false, data, size);
 		break;
 	case BTSNOOP_OPCODE_ACL_RX_PKT:
-		packet_hci_acldata(tv, index, true, data, size);
+		packet_hci_acldata(tv, cred, index, true, data, size);
 		break;
 	case BTSNOOP_OPCODE_SCO_TX_PKT:
-		packet_hci_scodata(tv, index, false, data, size);
+		packet_hci_scodata(tv, cred, index, false, data, size);
 		break;
 	case BTSNOOP_OPCODE_SCO_RX_PKT:
-		packet_hci_scodata(tv, index, true, data, size);
+		packet_hci_scodata(tv, cred, index, true, data, size);
+		break;
+	case BTSNOOP_OPCODE_OPEN_INDEX:
+		if (index < MAX_INDEX)
+			addr2str(index_list[index].bdaddr, str);
+		else
+			sprintf(str, "00:00:00:00:00:00");
+
+		packet_open_index(tv, index, str);
+		break;
+	case BTSNOOP_OPCODE_CLOSE_INDEX:
+		if (index < MAX_INDEX)
+			addr2str(index_list[index].bdaddr, str);
+		else
+			sprintf(str, "00:00:00:00:00:00");
+
+		packet_close_index(tv, index, str);
+		break;
+	case BTSNOOP_OPCODE_INDEX_INFO:
+		ii = data;
+		manufacturer = le16_to_cpu(ii->manufacturer);
+
+		if (index < MAX_INDEX) {
+			memcpy(index_list[index].bdaddr, ii->bdaddr, 6);
+			index_list[index].manufacturer = manufacturer;
+		}
+
+		addr2str(ii->bdaddr, str);
+		packet_index_info(tv, index, str, manufacturer);
+		break;
+	case BTSNOOP_OPCODE_VENDOR_DIAG:
+		if (index < MAX_INDEX)
+			manufacturer = index_list[index].manufacturer;
+		else
+			manufacturer = UNKNOWN_MANUFACTURER;
+
+		packet_vendor_diag(tv, index, manufacturer, data, size);
 		break;
 	default:
 		sprintf(extra_str, "(code %d len %d)", opcode, size);
-		print_packet(tv, index, '*', COLOR_ERROR,
+		print_packet(tv, cred, index, '*', COLOR_ERROR,
 					"Unknown packet", NULL, extra_str);
 		packet_hexdump(data, size);
 		break;
@@ -3741,10 +3794,10 @@
 
 	sprintf(str, "%u MHz", frequency);
 
-	print_packet(tv, 0, '*', COLOR_PHY_PACKET,
+	print_packet(tv, NULL, 0, '*', COLOR_PHY_PACKET,
 					"Physical packet:", NULL, str);
 
-	ll_packet(frequency, data, size);
+	ll_packet(frequency, data, size, false);
 }
 
 static void null_cmd(const void *data, uint8_t size)
@@ -5453,22 +5506,29 @@
 static void read_local_version_rsp(const void *data, uint8_t size)
 {
 	const struct bt_hci_rsp_read_local_version *rsp = data;
+	uint16_t manufacturer;
 
 	print_status(rsp->status);
 	print_hci_version(rsp->hci_ver, rsp->hci_rev);
 
-	switch (index_list[index_current].type) {
-	case HCI_BREDR:
-		print_lmp_version(rsp->lmp_ver, rsp->lmp_subver);
-		break;
-	case HCI_AMP:
-		print_pal_version(rsp->lmp_ver, rsp->lmp_subver);
-		break;
+	manufacturer = le16_to_cpu(rsp->manufacturer);
+
+	if (index_current < MAX_INDEX) {
+		switch (index_list[index_current].type) {
+		case HCI_BREDR:
+			print_lmp_version(rsp->lmp_ver, rsp->lmp_subver);
+			break;
+		case HCI_AMP:
+			print_pal_version(rsp->lmp_ver, rsp->lmp_subver);
+			break;
+		}
+
+		index_list[index_current].manufacturer = manufacturer;
 	}
 
 	print_manufacturer(rsp->manufacturer);
 
-	switch (le16_to_cpu(rsp->manufacturer)) {
+	switch (manufacturer) {
 	case 15:
 		print_manufacturer_broadcom(rsp->lmp_subver, rsp->hci_rev);
 		break;
@@ -5548,6 +5608,9 @@
 
 	print_status(rsp->status);
 	print_bdaddr(rsp->bdaddr);
+
+	if (index_current < MAX_INDEX)
+		memcpy(index_list[index_current].bdaddr, rsp->bdaddr, 6);
 }
 
 static void read_data_block_size_rsp(const void *data, uint8_t size)
@@ -7198,6 +7261,63 @@
 	return NULL;
 }
 
+static const char *current_vendor_str(void)
+{
+	uint16_t manufacturer;
+
+	if (index_current < MAX_INDEX)
+		manufacturer = index_list[index_current].manufacturer;
+	else
+		manufacturer = UNKNOWN_MANUFACTURER;
+
+	switch (manufacturer) {
+	case 2:
+		return "Intel";
+	case 15:
+		return "Broadcom";
+	}
+
+	return NULL;
+}
+
+static const struct vendor_ocf *current_vendor_ocf(uint16_t ocf)
+{
+	uint16_t manufacturer;
+
+	if (index_current < MAX_INDEX)
+		manufacturer = index_list[index_current].manufacturer;
+	else
+		manufacturer = UNKNOWN_MANUFACTURER;
+
+	switch (manufacturer) {
+	case 2:
+		return intel_vendor_ocf(ocf);
+	case 15:
+		return broadcom_vendor_ocf(ocf);
+	}
+
+	return NULL;
+}
+
+static const struct vendor_evt *current_vendor_evt(uint8_t evt)
+{
+	uint16_t manufacturer;
+
+	if (index_current < MAX_INDEX)
+		manufacturer = index_list[index_current].manufacturer;
+	else
+		manufacturer = UNKNOWN_MANUFACTURER;
+
+	switch (manufacturer) {
+	case 2:
+		return intel_vendor_evt(evt);
+	case 15:
+		return broadcom_vendor_evt(evt);
+	}
+
+	return NULL;
+}
+
 static void inquiry_complete_evt(const void *data, uint8_t size)
 {
 	const struct bt_hci_evt_inquiry_complete *evt = data;
@@ -7346,8 +7466,10 @@
 	uint16_t opcode = le16_to_cpu(evt->opcode);
 	uint16_t ogf = cmd_opcode_ogf(opcode);
 	uint16_t ocf = cmd_opcode_ocf(opcode);
+	struct opcode_data vendor_data;
 	const struct opcode_data *opcode_data = NULL;
 	const char *opcode_color, *opcode_str;
+	char vendor_str[150];
 	int i;
 
 	for (i = 0; opcode_table[i].str; i++) {
@@ -7365,8 +7487,32 @@
 		opcode_str = opcode_data->str;
 	} else {
 		if (ogf == 0x3f) {
-			opcode_color = COLOR_HCI_COMMAND;
-			opcode_str = "Vendor";
+			const struct vendor_ocf *vnd = current_vendor_ocf(ocf);
+
+			if (vnd) {
+				const char *str = current_vendor_str();
+
+				if (str) {
+					snprintf(vendor_str, sizeof(vendor_str),
+							"%s %s", str, vnd->str);
+					vendor_data.str = vendor_str;
+				} else
+					vendor_data.str = vnd->str;
+				vendor_data.rsp_func = vnd->rsp_func;
+				vendor_data.rsp_size = vnd->rsp_size;
+				vendor_data.rsp_fixed = vnd->rsp_fixed;
+
+				opcode_data = &vendor_data;
+
+				if (opcode_data->rsp_func)
+					opcode_color = COLOR_HCI_COMMAND;
+				else
+					opcode_color = COLOR_HCI_COMMAND_UNKNOWN;
+				opcode_str = opcode_data->str;
+			} else {
+				opcode_color = COLOR_HCI_COMMAND;
+				opcode_str = "Vendor";
+			}
 		} else {
 			opcode_color = COLOR_HCI_COMMAND_UNKNOWN;
 			opcode_str = "Unknown";
@@ -7418,6 +7564,7 @@
 	uint16_t ocf = cmd_opcode_ocf(opcode);
 	const struct opcode_data *opcode_data = NULL;
 	const char *opcode_color, *opcode_str;
+	char vendor_str[150];
 	int i;
 
 	for (i = 0; opcode_table[i].str; i++) {
@@ -7432,8 +7579,23 @@
 		opcode_str = opcode_data->str;
 	} else {
 		if (ogf == 0x3f) {
-			opcode_color = COLOR_HCI_COMMAND;
-			opcode_str = "Vendor";
+			const struct vendor_ocf *vnd = current_vendor_ocf(ocf);
+
+			if (vnd) {
+				const char *str = current_vendor_str();
+
+				if (str) {
+					snprintf(vendor_str, sizeof(vendor_str),
+							"%s %s", str, vnd->str);
+					opcode_str = vendor_str;
+				} else
+					opcode_str = vnd->str;
+
+				opcode_color = COLOR_HCI_COMMAND;
+			} else {
+				opcode_color = COLOR_HCI_COMMAND;
+				opcode_str = "Vendor";
+			}
 		} else {
 			opcode_color = COLOR_HCI_COMMAND_UNKNOWN;
 			opcode_str = "Unknown";
@@ -8185,7 +8347,48 @@
 	bool fixed;
 };
 
-static const struct subevent_data subevent_table[] = {
+static void print_subevent(const struct subevent_data *subevent_data,
+					const void *data, uint8_t size)
+{
+	const char *subevent_color, *subevent_str;
+
+	if (subevent_data) {
+		if (subevent_data->func)
+			subevent_color = COLOR_HCI_EVENT;
+		else
+			subevent_color = COLOR_HCI_EVENT_UNKNOWN;
+		subevent_str = subevent_data->str;
+	} else {
+		subevent_color = COLOR_HCI_EVENT_UNKNOWN;
+		subevent_str = "Unknown";
+	}
+
+	print_indent(6, subevent_color, "", subevent_str, COLOR_OFF,
+					" (0x%2.2x)", subevent_data->subevent);
+
+	if (!subevent_data || !subevent_data->func) {
+		packet_hexdump(data, size);
+		return;
+	}
+
+	if (subevent_data->fixed) {
+		if (size != subevent_data->size) {
+			print_text(COLOR_ERROR, "invalid packet size");
+			packet_hexdump(data, size);
+			return;
+		}
+	} else {
+		if (size < subevent_data->size) {
+			print_text(COLOR_ERROR, "too short packet");
+			packet_hexdump(data, size);
+			return;
+		}
+	}
+
+	subevent_data->func(data, size);
+}
+
+static const struct subevent_data le_meta_event_table[] = {
 	{ 0x01, "LE Connection Complete",
 				le_conn_complete_evt, 18, true },
 	{ 0x02, "LE Advertising Report",
@@ -8215,55 +8418,49 @@
 {
 	uint8_t subevent = *((const uint8_t *) data);
 	const struct subevent_data *subevent_data = NULL;
-	const char *subevent_color, *subevent_str;
 	int i;
 
-	for (i = 0; subevent_table[i].str; i++) {
-		if (subevent_table[i].subevent == subevent) {
-			subevent_data = &subevent_table[i];
+	for (i = 0; le_meta_event_table[i].str; i++) {
+		if (le_meta_event_table[i].subevent == subevent) {
+			subevent_data = &le_meta_event_table[i];
 			break;
 		}
 	}
 
-	if (subevent_data) {
-		if (subevent_data->func)
-			subevent_color = COLOR_HCI_EVENT;
-		else
-			subevent_color = COLOR_HCI_EVENT_UNKNOWN;
-		subevent_str = subevent_data->str;
-	} else {
-		subevent_color = COLOR_HCI_EVENT_UNKNOWN;
-		subevent_str = "Unknown";
-	}
-
-	print_indent(6, subevent_color, "", subevent_str, COLOR_OFF,
-						" (0x%2.2x)", subevent);
-
-	if (!subevent_data || !subevent_data->func) {
-		packet_hexdump(data + 1, size - 1);
-		return;
-	}
-
-	if (subevent_data->fixed) {
-		if (size - 1 != subevent_data->size) {
-			print_text(COLOR_ERROR, "invalid packet size");
-			packet_hexdump(data + 1, size - 1);
-			return;
-		}
-	} else {
-		if (size - 1 < subevent_data->size) {
-			print_text(COLOR_ERROR, "too short packet");
-			packet_hexdump(data + 1, size - 1);
-			return;
-		}
-	}
-
-	subevent_data->func(data + 1, size - 1);
+	print_subevent(subevent_data, data + 1, size - 1);
 }
 
 static void vendor_evt(const void *data, uint8_t size)
 {
-	vendor_event(0xffff, data, size);
+	uint8_t subevent = *((const uint8_t *) data);
+	struct subevent_data vendor_data;
+	char vendor_str[150];
+	const struct vendor_evt *vnd = current_vendor_evt(subevent);
+
+	if (vnd) {
+		const char *str = current_vendor_str();
+
+		if (str) {
+			snprintf(vendor_str, sizeof(vendor_str),
+						"%s %s", str, vnd->str);
+			vendor_data.str = vendor_str;
+		} else
+			vendor_data.str = vnd->str;
+		vendor_data.func = vnd->evt_func;
+		vendor_data.size = vnd->evt_size;
+		vendor_data.fixed = vnd->evt_fixed;
+
+		print_subevent(&vendor_data, data + 1, size - 1);
+	} else {
+		uint16_t manufacturer;
+
+		if (index_current < MAX_INDEX)
+			manufacturer = index_list[index_current].manufacturer;
+		else
+			manufacturer = UNKNOWN_MANUFACTURER;
+
+		vendor_event(manufacturer, data, size);
+	}
 }
 
 struct event_data {
@@ -8437,31 +8634,76 @@
 	sprintf(details, "(%s,%s,%s)", hci_typetostr(type),
 					hci_bustostr(bus), name);
 
-	print_packet(tv, index, '=', COLOR_NEW_INDEX, "New Index",
+	print_packet(tv, NULL, index, '=', COLOR_NEW_INDEX, "New Index",
 							label, details);
 }
 
 void packet_del_index(struct timeval *tv, uint16_t index, const char *label)
 {
-	print_packet(tv, index, '=', COLOR_DEL_INDEX, "Delete Index",
-							label, NULL);
-}
-
-void packet_hci_command(struct timeval *tv, uint16_t index,
+	print_packet(tv, NULL, index, '=', COLOR_DEL_INDEX, "Delete Index",
+							label, NULL);
+}
+
+void packet_open_index(struct timeval *tv, uint16_t index, const char *label)
+{
+	print_packet(tv, NULL, index, '=', COLOR_OPEN_INDEX, "Open Index",
+							label, NULL);
+}
+
+void packet_close_index(struct timeval *tv, uint16_t index, const char *label)
+{
+	print_packet(tv, NULL, index, '=', COLOR_CLOSE_INDEX, "Close Index",
+							label, NULL);
+}
+
+void packet_index_info(struct timeval *tv, uint16_t index, const char *label,
+							uint16_t manufacturer)
+{
+	char details[128];
+
+	sprintf(details, "(%s)", bt_compidtostr(manufacturer));
+
+	print_packet(tv, NULL, index, '=', COLOR_INDEX_INFO, "Index Info",
+							label, details);
+}
+
+void packet_vendor_diag(struct timeval *tv, uint16_t index,
+					uint16_t manufacturer,
+					const void *data, uint16_t size)
+{
+	char extra_str[16];
+
+	sprintf(extra_str, "(len %d)", size);
+
+	print_packet(tv, NULL, index, '=', COLOR_VENDOR_DIAG,
+					"Vendor Diagnostic", NULL, extra_str);
+
+	switch (manufacturer) {
+	case 15:
+		broadcom_lm_diag(data, size);
+		break;
+	default:
+		packet_hexdump(data, size);
+		break;
+	}
+}
+
+void packet_hci_command(struct timeval *tv, struct ucred *cred, uint16_t index,
 					const void *data, uint16_t size)
 {
 	const hci_command_hdr *hdr = data;
 	uint16_t opcode = le16_to_cpu(hdr->opcode);
 	uint16_t ogf = cmd_opcode_ogf(opcode);
 	uint16_t ocf = cmd_opcode_ocf(opcode);
+	struct opcode_data vendor_data;
 	const struct opcode_data *opcode_data = NULL;
 	const char *opcode_color, *opcode_str;
-	char extra_str[25];
+	char extra_str[25], vendor_str[150];
 	int i;
 
 	if (size < HCI_COMMAND_HDR_SIZE) {
 		sprintf(extra_str, "(len %d)", size);
-		print_packet(tv, index, '*', COLOR_ERROR,
+		print_packet(tv, cred, index, '*', COLOR_ERROR,
 			"Malformed HCI Command packet", NULL, extra_str);
 		packet_hexdump(data, size);
 		return;
@@ -8485,8 +8727,32 @@
 		opcode_str = opcode_data->str;
 	} else {
 		if (ogf == 0x3f) {
-			opcode_color = COLOR_HCI_COMMAND;
-			opcode_str = "Vendor";
+			const struct vendor_ocf *vnd = current_vendor_ocf(ocf);
+
+			if (vnd) {
+				const char *str = current_vendor_str();
+
+				if (str) {
+					snprintf(vendor_str, sizeof(vendor_str),
+							"%s %s", str, vnd->str);
+					vendor_data.str = vendor_str;
+				} else
+					vendor_data.str = vnd->str;
+				vendor_data.cmd_func = vnd->cmd_func;
+				vendor_data.cmd_size = vnd->cmd_size;
+				vendor_data.cmd_fixed = vnd->cmd_fixed;
+
+				opcode_data = &vendor_data;
+
+				if (opcode_data->cmd_func)
+					opcode_color = COLOR_HCI_COMMAND;
+				else
+					opcode_color = COLOR_HCI_COMMAND_UNKNOWN;
+				opcode_str = opcode_data->str;
+			} else {
+				opcode_color = COLOR_HCI_COMMAND;
+				opcode_str = "Vendor";
+			}
 		} else {
 			opcode_color = COLOR_HCI_COMMAND_UNKNOWN;
 			opcode_str = "Unknown";
@@ -8495,7 +8761,7 @@
 
 	sprintf(extra_str, "(0x%2.2x|0x%4.4x) plen %d", ogf, ocf, hdr->plen);
 
-	print_packet(tv, index, '<', opcode_color, "HCI Command",
+	print_packet(tv, cred, index, '<', opcode_color, "HCI Command",
 							opcode_str, extra_str);
 
 	if (!opcode_data || !opcode_data->cmd_func) {
@@ -8527,7 +8793,7 @@
 	opcode_data->cmd_func(data, hdr->plen);
 }
 
-void packet_hci_event(struct timeval *tv, uint16_t index,
+void packet_hci_event(struct timeval *tv, struct ucred *cred, uint16_t index,
 					const void *data, uint16_t size)
 {
 	const hci_event_hdr *hdr = data;
@@ -8538,7 +8804,7 @@
 
 	if (size < HCI_EVENT_HDR_SIZE) {
 		sprintf(extra_str, "(len %d)", size);
-		print_packet(tv, index, '*', COLOR_ERROR,
+		print_packet(tv, cred, index, '*', COLOR_ERROR,
 			"Malformed HCI Event packet", NULL, extra_str);
 		packet_hexdump(data, size);
 		return;
@@ -8567,7 +8833,7 @@
 
 	sprintf(extra_str, "(0x%2.2x) plen %d", hdr->evt, hdr->plen);
 
-	print_packet(tv, index, '>', event_color, "HCI Event",
+	print_packet(tv, cred, index, '>', event_color, "HCI Event",
 						event_str, extra_str);
 
 	if (!event_data || !event_data->func) {
@@ -8599,8 +8865,8 @@
 	event_data->func(data, hdr->plen);
 }
 
-void packet_hci_acldata(struct timeval *tv, uint16_t index, bool in,
-					const void *data, uint16_t size)
+void packet_hci_acldata(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size)
 {
 	const struct bt_hci_acl_hdr *hdr = data;
 	uint16_t handle = le16_to_cpu(hdr->handle);
@@ -8610,10 +8876,10 @@
 
 	if (size < sizeof(*hdr)) {
 		if (in)
-			print_packet(tv, index, '*', COLOR_ERROR,
+			print_packet(tv, cred, index, '*', COLOR_ERROR,
 				"Malformed ACL Data RX packet", NULL, NULL);
 		else
-			print_packet(tv, index, '*', COLOR_ERROR,
+			print_packet(tv, cred, index, '*', COLOR_ERROR,
 				"Malformed ACL Data TX packet", NULL, NULL);
 		packet_hexdump(data, size);
 		return;
@@ -8625,7 +8891,7 @@
 	sprintf(handle_str, "Handle %d", acl_handle(handle));
 	sprintf(extra_str, "flags 0x%2.2x dlen %d", flags, dlen);
 
-	print_packet(tv, index, in ? '>' : '<', COLOR_HCI_ACLDATA,
+	print_packet(tv, cred, index, in ? '>' : '<', COLOR_HCI_ACLDATA,
 				in ? "ACL Data RX" : "ACL Data TX",
 						handle_str, extra_str);
 
@@ -8642,8 +8908,8 @@
 	l2cap_packet(index, in, acl_handle(handle), flags, data, size);
 }
 
-void packet_hci_scodata(struct timeval *tv, uint16_t index, bool in,
-					const void *data, uint16_t size)
+void packet_hci_scodata(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size)
 {
 	const hci_sco_hdr *hdr = data;
 	uint16_t handle = le16_to_cpu(hdr->handle);
@@ -8652,10 +8918,10 @@
 
 	if (size < HCI_SCO_HDR_SIZE) {
 		if (in)
-			print_packet(tv, index, '*', COLOR_ERROR,
+			print_packet(tv, cred, index, '*', COLOR_ERROR,
 				"Malformed SCO Data RX packet", NULL, NULL);
 		else
-			print_packet(tv, index, '*', COLOR_ERROR,
+			print_packet(tv, cred, index, '*', COLOR_ERROR,
 				"Malformed SCO Data TX packet", NULL, NULL);
 		packet_hexdump(data, size);
 		return;
@@ -8667,7 +8933,7 @@
 	sprintf(handle_str, "Handle %d", acl_handle(handle));
 	sprintf(extra_str, "flags 0x%2.2x dlen %d", flags, hdr->dlen);
 
-	print_packet(tv, index, in ? '>' : '<', COLOR_HCI_SCODATA,
+	print_packet(tv, cred, index, in ? '>' : '<', COLOR_HCI_SCODATA,
 				in ? "SCO Data RX" : "SCO Data TX",
 						handle_str, extra_str);
 
@@ -8707,10 +8973,10 @@
 		printf("\t%s\n", event_table[i].str);
 	}
 
-	for (i = 0; subevent_table[i].str; i++) {
-		if (subevent_table[i].func)
+	for (i = 0; le_meta_event_table[i].str; i++) {
+		if (le_meta_event_table[i].func)
 			continue;
 
-		printf("\t%s\n", subevent_table[i].str);
+		printf("\t%s\n", le_meta_event_table[i].str);
 	}
 }

=== modified file 'monitor/packet.h'
--- monitor/packet.h	2015-09-15 13:42:52 +0000
+++ monitor/packet.h	2015-11-23 18:34:05 +0000
@@ -25,6 +25,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 #include <sys/time.h>
+#include <sys/socket.h>
 
 #define PACKET_FILTER_SHOW_INDEX	(1 << 0)
 #define PACKET_FILTER_SHOW_DATE		(1 << 1)
@@ -53,9 +54,11 @@
 void packet_print_io_capability(uint8_t capability);
 void packet_print_io_authentication(uint8_t authentication);
 
-void packet_control(struct timeval *tv, uint16_t index, uint16_t opcode,
+void packet_control(struct timeval *tv, struct ucred *cred,
+					uint16_t index, uint16_t opcode,
 					const void *data, uint16_t size);
-void packet_monitor(struct timeval *tv, uint16_t index, uint16_t opcode,
+void packet_monitor(struct timeval *tv, struct ucred *cred,
+					uint16_t index, uint16_t opcode,
 					const void *data, uint16_t size);
 void packet_simulator(struct timeval *tv, uint16_t frequency,
 					const void *data, uint16_t size);
@@ -63,14 +66,21 @@
 void packet_new_index(struct timeval *tv, uint16_t index, const char *label,
 				uint8_t type, uint8_t bus, const char *name);
 void packet_del_index(struct timeval *tv, uint16_t index, const char *label);
+void packet_open_index(struct timeval *tv, uint16_t index, const char *label);
+void packet_close_index(struct timeval *tv, uint16_t index, const char *label);
+void packet_index_info(struct timeval *tv, uint16_t index, const char *label,
+							uint16_t manufacturer);
+void packet_vendor_diag(struct timeval *tv, uint16_t index,
+					uint16_t manufacturer,
+					const void *data, uint16_t size);
 
-void packet_hci_command(struct timeval *tv, uint16_t index,
-					const void *data, uint16_t size);
-void packet_hci_event(struct timeval *tv, uint16_t index,
-					const void *data, uint16_t size);
-void packet_hci_acldata(struct timeval *tv, uint16_t index, bool in,
-					const void *data, uint16_t size);
-void packet_hci_scodata(struct timeval *tv, uint16_t index, bool in,
-					const void *data, uint16_t size);
+void packet_hci_command(struct timeval *tv, struct ucred *cred, uint16_t index,
+					const void *data, uint16_t size);
+void packet_hci_event(struct timeval *tv, struct ucred *cred, uint16_t index,
+					const void *data, uint16_t size);
+void packet_hci_acldata(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size);
+void packet_hci_scodata(struct timeval *tv, struct ucred *cred, uint16_t index,
+				bool in, const void *data, uint16_t size);
 
 void packet_todo(void);

=== modified file 'monitor/vendor.h'
--- monitor/vendor.h	2015-09-15 13:42:52 +0000
+++ monitor/vendor.h	2015-11-23 18:34:05 +0000
@@ -24,4 +24,23 @@
 
 #include <stdint.h>
 
+struct vendor_ocf {
+	uint16_t ocf;
+	const char *str;
+	void (*cmd_func) (const void *data, uint8_t size);
+	uint8_t cmd_size;
+	bool cmd_fixed;
+	void (*rsp_func) (const void *data, uint8_t size);
+	uint8_t rsp_size;
+	bool rsp_fixed;
+};
+
+struct vendor_evt {
+	uint8_t evt;
+	const char *str;
+	void (*evt_func) (const void *data, uint8_t size);
+	uint8_t evt_size;
+	bool evt_fixed;
+};
+
 void vendor_event(uint16_t manufacturer, const void *data, uint8_t size);

=== modified file 'obexd/plugins/pbap.c'
--- obexd/plugins/pbap.c	2015-09-15 13:42:52 +0000
+++ obexd/plugins/pbap.c	2015-11-23 18:34:05 +0000
@@ -193,6 +193,8 @@
 	pbap->obj->apparam = g_obex_apparam_set_uint16(NULL, PHONEBOOKSIZE_TAG,
 								phonebooksize);
 
+	pbap->obj->firstpacket = TRUE;
+
 	if (missed > 0)	{
 		DBG("missed %d", missed);
 
@@ -826,14 +828,13 @@
 								uint8_t *hi)
 {
 	struct pbap_object *obj = object;
-	struct pbap_session *pbap = obj->session;
 
 	if (!obj->buffer && !obj->apparam)
 		return -EAGAIN;
 
 	*hi = G_OBEX_HDR_APPARAM;
 
-	if (pbap->params->maxlistcount == 0 || obj->firstpacket) {
+	if (obj->firstpacket) {
 		obj->firstpacket = FALSE;
 
 		return g_obex_apparam_encode(obj->apparam, buf, mtu);

=== modified file 'profiles/audio/a2dp.c'
--- profiles/audio/a2dp.c	2015-09-15 13:42:52 +0000
+++ profiles/audio/a2dp.c	2015-11-23 18:34:05 +0000
@@ -1457,7 +1457,7 @@
 
 	if (!avdtp_stream_set_transport(setup->stream,
 					g_io_channel_unix_get_fd(io),
-					omtu, imtu))
+					imtu, omtu))
 		goto drop;
 
 	g_io_channel_set_close_on_unref(io, FALSE);

=== modified file 'profiles/audio/avrcp.c'
--- profiles/audio/avrcp.c	2015-10-06 11:46:27 +0000
+++ profiles/audio/avrcp.c	2015-11-23 18:34:05 +0000
@@ -3030,7 +3030,7 @@
 
 	length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
 
-	avctp_send_vendordep_req(session->conn, AVC_CTYPE_STATUS,
+	avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
 					AVC_SUBUNIT_PANEL, buf, length,
 					NULL, session);
 }
@@ -3076,7 +3076,7 @@
 
 	length = AVRCP_HEADER_LENGTH + ntohs(pdu->params_len);
 
-	avctp_send_vendordep_req(session->conn, AVC_CTYPE_STATUS,
+	avctp_send_vendordep_req(session->conn, AVC_CTYPE_CONTROL,
 					AVC_SUBUNIT_PANEL, buf, length,
 					NULL, session);
 }
@@ -3191,6 +3191,15 @@
 	.total_items = ct_get_total_numberofitems,
 };
 
+static void set_ct_player(struct avrcp *session, struct avrcp_player *player)
+{
+	struct btd_service *service;
+
+	session->controller->player = player;
+	service = btd_device_get_service(session->dev, AVRCP_TARGET_UUID);
+	control_set_player(service, media_player_get_path(player->user_data));
+}
+
 static struct avrcp_player *create_ct_player(struct avrcp *session,
 								uint16_t id)
 {
@@ -3212,7 +3221,7 @@
 	player->destroy = (GDestroyNotify) media_player_destroy;
 
 	if (session->controller->player == NULL)
-		session->controller->player = player;
+		set_ct_player(session, player);
 
 	session->controller->players = g_slist_prepend(
 						session->controller->players,
@@ -3320,10 +3329,15 @@
 
 	for (l = player->sessions; l; l = l->next) {
 		struct avrcp *session = l->data;
-
-		session->controller->players = g_slist_remove(
-						session->controller->players,
-						player);
+		struct avrcp_data *controller = session->controller;
+
+		controller->players = g_slist_remove(controller->players,
+								player);
+
+		/* Check if current player is being removed */
+		if (controller->player == player)
+			set_ct_player(session, g_slist_nth_data(
+						controller->players, 0));
 	}
 
 	player_destroy(player);
@@ -3374,9 +3388,6 @@
 		i += len;
 	}
 
-	if (g_slist_find(removed, session->controller->player))
-		session->controller->player = NULL;
-
 	g_slist_free_full(removed, player_remove);
 
 	return FALSE;
@@ -3501,7 +3512,7 @@
 	}
 
 	player->uid_counter = get_be16(&pdu->params[3]);
-	session->controller->player = player;
+	set_ct_player(session, player);
 
 	if (player->features != NULL)
 		return;

=== modified file 'profiles/audio/control.c'
--- profiles/audio/control.c	2015-09-15 13:42:52 +0000
+++ profiles/audio/control.c	2015-11-23 18:34:05 +0000
@@ -59,6 +59,7 @@
 
 #include "avctp.h"
 #include "control.h"
+#include "player.h"
 
 static GSList *devices = NULL;
 
@@ -68,6 +69,7 @@
 	struct btd_service *target;
 	struct btd_service *remote;
 	unsigned int avctp_id;
+	const char *player;
 };
 
 static void state_changed(struct btd_device *dev, avctp_state_t old_state,
@@ -81,9 +83,12 @@
 	switch (new_state) {
 	case AVCTP_STATE_DISCONNECTED:
 		control->session = NULL;
+		control->player = NULL;
 
 		g_dbus_emit_property_changed(conn, path,
 					AUDIO_CONTROL_INTERFACE, "Connected");
+		g_dbus_emit_property_changed(conn, path,
+					AUDIO_CONTROL_INTERFACE, "Player");
 
 		break;
 	case AVCTP_STATE_CONNECTING:
@@ -215,21 +220,46 @@
 	return TRUE;
 }
 
+static gboolean control_player_exists(const GDBusPropertyTable *property,
+								void *data)
+{
+	struct control *control = data;
+
+	return control->player != NULL;
+}
+
+static gboolean control_get_player(const GDBusPropertyTable *property,
+					DBusMessageIter *iter, void *data)
+{
+	struct control *control = data;
+
+	if (!control->player)
+		return FALSE;
+
+	dbus_message_iter_append_basic(iter, DBUS_TYPE_OBJECT_PATH,
+							&control->player);
+
+	return TRUE;
+}
+
 static const GDBusMethodTable control_methods[] = {
-	{ GDBUS_METHOD("Play", NULL, NULL, control_play) },
-	{ GDBUS_METHOD("Pause", NULL, NULL, control_pause) },
-	{ GDBUS_METHOD("Stop", NULL, NULL, control_stop) },
-	{ GDBUS_METHOD("Next", NULL, NULL, control_next) },
-	{ GDBUS_METHOD("Previous", NULL, NULL, control_previous) },
-	{ GDBUS_METHOD("VolumeUp", NULL, NULL, control_volume_up) },
-	{ GDBUS_METHOD("VolumeDown", NULL, NULL, control_volume_down) },
-	{ GDBUS_METHOD("FastForward", NULL, NULL, control_fast_forward) },
-	{ GDBUS_METHOD("Rewind", NULL, NULL, control_rewind) },
+	{ GDBUS_DEPRECATED_METHOD("Play", NULL, NULL, control_play) },
+	{ GDBUS_DEPRECATED_METHOD("Pause", NULL, NULL, control_pause) },
+	{ GDBUS_DEPRECATED_METHOD("Stop", NULL, NULL, control_stop) },
+	{ GDBUS_DEPRECATED_METHOD("Next", NULL, NULL, control_next) },
+	{ GDBUS_DEPRECATED_METHOD("Previous", NULL, NULL, control_previous) },
+	{ GDBUS_DEPRECATED_METHOD("VolumeUp", NULL, NULL, control_volume_up) },
+	{ GDBUS_DEPRECATED_METHOD("VolumeDown", NULL, NULL,
+							control_volume_down) },
+	{ GDBUS_DEPRECATED_METHOD("FastForward", NULL, NULL,
+							control_fast_forward) },
+	{ GDBUS_DEPRECATED_METHOD("Rewind", NULL, NULL, control_rewind) },
 	{ }
 };
 
 static const GDBusPropertyTable control_properties[] = {
 	{ "Connected", "b", control_property_get_connected },
+	{ "Player", "o", control_get_player, NULL, control_player_exists },
 	{ }
 };
 
@@ -338,3 +368,22 @@
 
 	return 0;
 }
+
+int control_set_player(struct btd_service *service, const char *path)
+{
+	struct control *control = btd_service_get_user_data(service);
+
+	if (!control->session)
+		return -ENOTCONN;
+
+	if (g_strcmp0(control->player, path) == 0)
+		return -EALREADY;
+
+	control->player = path;
+
+	g_dbus_emit_property_changed(btd_get_dbus_connection(),
+					device_get_path(control->dev),
+					AUDIO_CONTROL_INTERFACE, "Player");
+
+	return 0;
+}

=== modified file 'profiles/audio/control.h'
--- profiles/audio/control.h	2015-09-15 13:42:52 +0000
+++ profiles/audio/control.h	2015-11-23 18:34:05 +0000
@@ -32,3 +32,5 @@
 
 int control_connect(struct btd_service *service);
 int control_disconnect(struct btd_service *service);
+
+int control_set_player(struct btd_service *service, const char *path);

=== modified file 'profiles/audio/player.c'
--- profiles/audio/player.c	2015-09-15 13:42:52 +0000
+++ profiles/audio/player.c	2015-11-23 18:34:05 +0000
@@ -1193,6 +1193,11 @@
 	return mp;
 }
 
+const char *media_player_get_path(struct media_player *mp)
+{
+	return mp->path;
+}
+
 void media_player_set_duration(struct media_player *mp, uint32_t duration)
 {
 	char *value, *curval;

=== modified file 'profiles/audio/player.h'
--- profiles/audio/player.h	2015-09-15 13:42:52 +0000
+++ profiles/audio/player.h	2015-11-23 18:34:05 +0000
@@ -70,6 +70,7 @@
 
 struct media_player *media_player_controller_create(const char *path,
 								uint16_t id);
+const char *media_player_get_path(struct media_player *mp);
 void media_player_destroy(struct media_player *mp);
 void media_player_set_duration(struct media_player *mp, uint32_t duration);
 void media_player_set_position(struct media_player *mp, uint32_t position);

=== modified file 'profiles/deviceinfo/deviceinfo.c'
--- profiles/deviceinfo/deviceinfo.c	2015-09-15 13:42:52 +0000
+++ profiles/deviceinfo/deviceinfo.c	2015-11-23 18:34:05 +0000
@@ -3,6 +3,7 @@
  *  BlueZ - Bluetooth protocol stack for Linux
  *
  *  Copyright (C) 2012 Texas Instruments, Inc.
+ *  Copyright (C) 2015 Google Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -38,161 +39,113 @@
 #include "src/device.h"
 #include "src/profile.h"
 #include "src/service.h"
+#include "attrib/gattrib.h"
 #include "src/shared/util.h"
-#include "attrib/gattrib.h"
-#include "src/attio.h"
+#include "src/shared/queue.h"
+#include "src/shared/gatt-db.h"
+#include "src/shared/gatt-client.h"
 #include "attrib/att.h"
-#include "attrib/gatt.h"
 #include "src/log.h"
 
 #define PNP_ID_SIZE	7
 
-struct deviceinfo {
-	struct btd_device	*dev;		/* Device reference */
-	GAttrib			*attrib;	/* GATT connection */
-	guint			attioid;	/* Att watcher id */
-	struct att_range	*svc_range;	/* DeviceInfo range */
-	GSList			*chars;		/* Characteristics */
-};
-
-struct characteristic {
-	struct gatt_char	attr;	/* Characteristic */
-	struct deviceinfo	*d;	/* deviceinfo where the char belongs */
-};
-
-static void deviceinfo_driver_remove(struct btd_service *service)
-{
-	struct deviceinfo *d = btd_service_get_user_data(service);
-
-	if (d->attioid > 0)
-		btd_device_remove_attio_callback(d->dev, d->attioid);
-
-	if (d->attrib != NULL)
-		g_attrib_unref(d->attrib);
-
-	g_slist_free_full(d->chars, g_free);
-
-	btd_device_unref(d->dev);
-	g_free(d->svc_range);
-	g_free(d);
-}
-
-static void read_pnpid_cb(guint8 status, const guint8 *pdu, guint16 len,
-							gpointer user_data)
-{
-	struct characteristic *ch = user_data;
-	uint8_t value[PNP_ID_SIZE];
-	ssize_t vlen;
-
-	if (status != 0) {
-		error("Error reading PNP_ID value: %s", att_ecode2str(status));
-		return;
-	}
-
-	vlen = dec_read_resp(pdu, len, value, sizeof(value));
-	if (vlen < 0) {
-		error("Error reading PNP_ID: Protocol error");
-		return;
-	}
-
-	if (vlen < 7) {
+static void read_pnpid_cb(bool success, uint8_t att_ecode, const uint8_t *value,
+					uint16_t length, void *user_data)
+{
+	struct btd_device *device = user_data;
+
+	if (!success) {
+		error("Error reading PNP_ID value: %s",
+						att_ecode2str(att_ecode));
+		return;
+	}
+
+	if (length < PNP_ID_SIZE) {
 		error("Error reading PNP_ID: Invalid pdu length received");
 		return;
 	}
 
-	btd_device_set_pnpid(ch->d->dev, value[0], get_le16(&value[1]),
+	btd_device_set_pnpid(device, value[0], get_le16(&value[1]),
 				get_le16(&value[3]), get_le16(&value[5]));
 }
 
-static void process_deviceinfo_char(struct characteristic *ch)
+static void handle_pnpid(struct btd_device *device, uint16_t value_handle)
 {
-	if (g_strcmp0(ch->attr.uuid, PNPID_UUID) == 0)
-		gatt_read_char(ch->d->attrib, ch->attr.value_handle,
-							read_pnpid_cb, ch);
+	struct bt_gatt_client *client = btd_device_get_gatt_client(device);
+
+	if (!bt_gatt_client_read_value(client, value_handle,
+						read_pnpid_cb, device, NULL))
+		DBG("Failed to send request to read pnpid");
 }
 
-static void configure_deviceinfo_cb(uint8_t status, GSList *characteristics,
+static void handle_characteristic(struct gatt_db_attribute *attr,
 								void *user_data)
 {
-	struct deviceinfo *d = user_data;
-	GSList *l;
-
-	if (status != 0) {
-		error("Discover deviceinfo characteristics: %s",
-							att_ecode2str(status));
+	struct btd_device *device = user_data;
+	uint16_t value_handle;
+	bt_uuid_t uuid, pnpid_uuid;
+
+	bt_string_to_uuid(&pnpid_uuid, PNPID_UUID);
+
+	if (!gatt_db_attribute_get_char_data(attr, NULL, &value_handle, NULL,
+								&uuid)) {
+		error("Failed to obtain characteristic data");
 		return;
 	}
 
-	for (l = characteristics; l; l = l->next) {
-		struct gatt_char *c = l->data;
-		struct characteristic *ch;
-
-		ch = g_new0(struct characteristic, 1);
-		ch->attr.handle = c->handle;
-		ch->attr.properties = c->properties;
-		ch->attr.value_handle = c->value_handle;
-		memcpy(ch->attr.uuid, c->uuid, MAX_LEN_UUID_STR + 1);
-		ch->d = d;
-
-		d->chars = g_slist_append(d->chars, ch);
-
-		process_deviceinfo_char(ch);
+	if (bt_uuid_cmp(&pnpid_uuid, &uuid) == 0)
+		handle_pnpid(device, value_handle);
+	else {
+		char uuid_str[MAX_LEN_UUID_STR];
+
+		bt_uuid_to_string(&uuid, uuid_str, sizeof(uuid_str));
+		DBG("Unsupported characteristic: %s", uuid_str);
 	}
 }
-static void attio_connected_cb(GAttrib *attrib, gpointer user_data)
-{
-	struct deviceinfo *d = user_data;
-
-	d->attrib = g_attrib_ref(attrib);
-
-	gatt_discover_char(d->attrib, d->svc_range->start, d->svc_range->end,
-					NULL, configure_deviceinfo_cb, d);
-}
-
-static void attio_disconnected_cb(gpointer user_data)
-{
-	struct deviceinfo *d = user_data;
-
-	g_attrib_unref(d->attrib);
-	d->attrib = NULL;
-}
-
-static int deviceinfo_register(struct btd_service *service,
-						struct gatt_primary *prim)
-{
-	struct btd_device *device = btd_service_get_device(service);
-	struct deviceinfo *d;
-
-	d = g_new0(struct deviceinfo, 1);
-	d->dev = btd_device_ref(device);
-	d->svc_range = g_new0(struct att_range, 1);
-	d->svc_range->start = prim->range.start;
-	d->svc_range->end = prim->range.end;
-
-	btd_service_set_user_data(service, d);
-
-	d->attioid = btd_device_add_attio_callback(device, attio_connected_cb,
-						attio_disconnected_cb, d);
-	return 0;
+
+static void foreach_deviceinfo_service(struct gatt_db_attribute *attr,
+								void *user_data)
+{
+	struct btd_device *device = user_data;
+
+	gatt_db_service_foreach_char(attr, handle_characteristic, device);
 }
 
 static int deviceinfo_driver_probe(struct btd_service *service)
 {
+	return 0;
+}
+
+static void deviceinfo_driver_remove(struct btd_service *service)
+{
+}
+
+
+static int deviceinfo_driver_accept(struct btd_service *service)
+{
 	struct btd_device *device = btd_service_get_device(service);
-	struct gatt_primary *prim;
-
-	prim = btd_device_get_primary(device, DEVICE_INFORMATION_UUID);
-	if (prim == NULL)
-		return -EINVAL;
-
-	return deviceinfo_register(service, prim);
+	struct gatt_db *db = btd_device_get_gatt_db(device);
+	char addr[18];
+	bt_uuid_t deviceinfo_uuid;
+
+	ba2str(device_get_address(device), addr);
+	DBG("deviceinfo profile accept (%s)", addr);
+
+	/* Handle the device info service */
+	bt_string_to_uuid(&deviceinfo_uuid, DEVICE_INFORMATION_UUID);
+	gatt_db_foreach_service(db, &deviceinfo_uuid,
+					foreach_deviceinfo_service, device);
+
+	return 0;
 }
 
 static struct btd_profile deviceinfo_profile = {
 	.name		= "deviceinfo",
 	.remote_uuid	= DEVICE_INFORMATION_UUID,
+	.external	= true,
 	.device_probe	= deviceinfo_driver_probe,
-	.device_remove	= deviceinfo_driver_remove
+	.device_remove	= deviceinfo_driver_remove,
+	.accept		= deviceinfo_driver_accept,
 };
 
 static int deviceinfo_init(void)

=== modified file 'profiles/gap/gas.c'
--- profiles/gap/gas.c	2015-09-15 13:42:52 +0000
+++ profiles/gap/gas.c	2015-11-23 18:34:05 +0000
@@ -53,7 +53,6 @@
 struct gas {
 	struct btd_device *device;
 	struct gatt_db *db;
-	unsigned int db_id;
 	struct bt_gatt_client *client;
 	struct gatt_db_attribute *attr;
 };
@@ -62,7 +61,6 @@
 
 static void gas_free(struct gas *gas)
 {
-	gatt_db_unregister(gas->db, gas->db_id);
 	gatt_db_unref(gas->db);
 	bt_gatt_client_unref(gas->client);
 	btd_device_unref(gas->device);
@@ -269,43 +267,6 @@
 	handle_gap_service(gas);
 }
 
-static void service_added(struct gatt_db_attribute *attr, void *user_data)
-{
-	struct gas *gas = user_data;
-	bt_uuid_t uuid, gap_uuid;
-
-	if (!bt_gatt_client_is_ready(gas->client))
-		return;
-
-	gatt_db_attribute_get_service_uuid(attr, &uuid);
-	bt_uuid16_create(&gap_uuid, GAP_UUID16);
-
-	if (bt_uuid_cmp(&uuid, &gap_uuid))
-		return;
-
-	if (gas->attr) {
-		error("More than one GAP service added to device");
-		return;
-	}
-
-	DBG("GAP service added");
-
-	gas->attr = attr;
-	handle_gap_service(gas);
-}
-
-static void service_removed(struct gatt_db_attribute *attr, void *user_data)
-{
-	struct gas *gas = user_data;
-
-	if (gas->attr != attr)
-		return;
-
-	DBG("GAP service removed");
-
-	gas->attr = NULL;
-}
-
 static int gap_driver_accept(struct btd_service *service)
 {
 	struct btd_device *device = btd_service_get_device(service);
@@ -329,14 +290,11 @@
 
 	/* Clean-up any old client/db and acquire the new ones */
 	gas->attr = NULL;
-	gatt_db_unregister(gas->db, gas->db_id);
 	gatt_db_unref(gas->db);
 	bt_gatt_client_unref(gas->client);
 
 	gas->db = gatt_db_ref(db);
 	gas->client = bt_gatt_client_ref(client);
-	gas->db_id = gatt_db_register(db, service_added, service_removed, gas,
-									NULL);
 
 	/* Handle the GAP services */
 	bt_uuid16_create(&gap_uuid, GAP_UUID16);

=== modified file 'profiles/scanparam/scan.c'
--- profiles/scanparam/scan.c	2015-09-15 13:42:52 +0000
+++ profiles/scanparam/scan.c	2015-11-23 18:34:05 +0000
@@ -40,10 +40,11 @@
 #include "src/profile.h"
 #include "src/service.h"
 #include "src/shared/util.h"
+#include "src/shared/att.h"
+#include "src/shared/queue.h"
+#include "src/shared/gatt-db.h"
+#include "src/shared/gatt-client.h"
 #include "attrib/att.h"
-#include "attrib/gattrib.h"
-#include "attrib/gatt.h"
-#include "src/attio.h"
 
 #define SCAN_INTERVAL_WIN_UUID		0x2A4F
 #define SCAN_REFRESH_UUID		0x2A31
@@ -54,210 +55,217 @@
 
 struct scan {
 	struct btd_device *device;
-	GAttrib *attrib;
-	struct att_range range;
-	guint attioid;
-	uint16_t interval;
-	uint16_t window;
+	struct gatt_db *db;
+	struct bt_gatt_client *client;
+	struct gatt_db_attribute *attr;
 	uint16_t iwhandle;
-	uint16_t refresh_handle;
 	guint refresh_cb_id;
 };
 
-static void write_scan_params(GAttrib *attrib, uint16_t handle)
+static GSList *devices;
+
+static void scan_free(struct scan *scan)
+{
+	bt_gatt_client_unregister_notify(scan->client, scan->refresh_cb_id);
+	gatt_db_unref(scan->db);
+	bt_gatt_client_unref(scan->client);
+	btd_device_unref(scan->device);
+	g_free(scan);
+}
+
+static int cmp_device(gconstpointer a, gconstpointer b)
+{
+	const struct scan *scan = a;
+	const struct btd_device *device = b;
+
+	return scan->device == device ? 0 : -1;
+}
+
+static void write_scan_params(struct scan *scan)
 {
 	uint8_t value[4];
 
 	put_le16(SCAN_INTERVAL, &value[0]);
 	put_le16(SCAN_WINDOW, &value[2]);
 
-	gatt_write_cmd(attrib, handle, value, sizeof(value), NULL, NULL);
-}
-
-static void refresh_value_cb(const uint8_t *pdu, uint16_t len,
-						gpointer user_data)
-{
-	struct scan *scan = user_data;
-
-	DBG("Server requires refresh: %d", pdu[3]);
-
-	if (pdu[3] == SERVER_REQUIRES_REFRESH)
-		write_scan_params(scan->attrib, scan->iwhandle);
-}
-
-static void ccc_written_cb(guint8 status, const guint8 *pdu,
-					guint16 plen, gpointer user_data)
-{
-	struct scan *scan = user_data;
-
-	if (status != 0) {
-		error("Write Scan Refresh CCC failed: %s",
-						att_ecode2str(status));
+	bt_gatt_client_write_without_response(scan->client, scan->iwhandle,
+						false, value, sizeof(value));
+}
+
+static void refresh_value_cb(uint16_t value_handle, const uint8_t *value,
+					uint16_t length, void *user_data)
+{
+	struct scan *scan = user_data;
+
+	DBG("Server requires refresh: %d", value[3]);
+
+	if (value[3] == SERVER_REQUIRES_REFRESH)
+		write_scan_params(scan);
+}
+
+static void refresh_ccc_written_cb(uint16_t att_ecode, void *user_data)
+{
+	if (att_ecode != 0) {
+		error("Scan Refresh: notifications not enabled %s",
+						att_ecode2str(att_ecode));
 		return;
 	}
 
 	DBG("Scan Refresh: notification enabled");
-
-	scan->refresh_cb_id = g_attrib_register(scan->attrib,
-				ATT_OP_HANDLE_NOTIFY, scan->refresh_handle,
-				refresh_value_cb, scan, NULL);
-}
-
-static void discover_descriptor_cb(uint8_t status, GSList *descs,
-								void *user_data)
-{
-	struct scan *scan = user_data;
-	struct gatt_desc *desc;
-	uint8_t value[2];
-
-	if (status != 0) {
-		error("Discover descriptors failed: %s", att_ecode2str(status));
-		return;
-	}
-
-	/* There will be only one descriptor on list and it will be CCC */
-	desc = descs->data;
-
-	put_le16(GATT_CLIENT_CHARAC_CFG_NOTIF_BIT, value);
-	gatt_write_char(scan->attrib, desc->handle, value, sizeof(value),
-						ccc_written_cb, user_data);
-}
-
-static void refresh_discovered_cb(uint8_t status, GSList *chars,
-								void *user_data)
-{
-	struct scan *scan = user_data;
-	struct gatt_char *chr;
-	uint16_t start, end;
-	bt_uuid_t uuid;
-
-	if (status) {
-		error("Scan Refresh %s", att_ecode2str(status));
-		return;
-	}
-
-	if (!chars) {
-		DBG("Scan Refresh not supported");
-		return;
-	}
-
-	chr = chars->data;
-
-	DBG("Scan Refresh handle: 0x%04x", chr->value_handle);
-
-	start = chr->value_handle + 1;
-	end = scan->range.end;
-
-	if (start > end)
-		return;
-
-	scan->refresh_handle = chr->value_handle;
-
-	bt_uuid16_create(&uuid, GATT_CLIENT_CHARAC_CFG_UUID);
-
-	gatt_discover_desc(scan->attrib, start, end, &uuid,
-					discover_descriptor_cb, user_data);
-}
-
-static void iwin_discovered_cb(uint8_t status, GSList *chars, void *user_data)
-{
-	struct scan *scan = user_data;
-	struct gatt_char *chr;
-
-	if (status) {
-		error("Discover Scan Interval Window: %s",
-						att_ecode2str(status));
-		return;
-	}
-
-	chr = chars->data;
-	scan->iwhandle = chr->value_handle;
+}
+
+static void handle_refresh(struct scan *scan, uint16_t value_handle)
+{
+	DBG("Scan Refresh handle: 0x%04x", value_handle);
+
+	scan->refresh_cb_id = bt_gatt_client_register_notify(scan->client,
+					value_handle, refresh_ccc_written_cb,
+						refresh_value_cb, scan,	NULL);
+}
+
+static void handle_iwin(struct scan *scan, uint16_t value_handle)
+{
+	scan->iwhandle = value_handle;
 
 	DBG("Scan Interval Window handle: 0x%04x", scan->iwhandle);
 
-	write_scan_params(scan->attrib, scan->iwhandle);
-}
-
-static void attio_connected_cb(GAttrib *attrib, gpointer user_data)
-{
-	struct scan *scan = user_data;
-	bt_uuid_t iwin_uuid, refresh_uuid;
-
-	scan->attrib = g_attrib_ref(attrib);
-
-	if (scan->iwhandle) {
-		write_scan_params(scan->attrib, scan->iwhandle);
-		return;
-	}
-
-	bt_uuid16_create(&iwin_uuid, SCAN_INTERVAL_WIN_UUID);
-	bt_uuid16_create(&refresh_uuid, SCAN_REFRESH_UUID);
-
-	gatt_discover_char(scan->attrib, scan->range.start, scan->range.end,
-					&iwin_uuid, iwin_discovered_cb, scan);
-
-	gatt_discover_char(scan->attrib, scan->range.start, scan->range.end,
-				&refresh_uuid, refresh_discovered_cb, scan);
-}
-
-static void attio_disconnected_cb(gpointer user_data)
-{
-	struct scan *scan = user_data;
-
-	g_attrib_unref(scan->attrib);
-	scan->attrib = NULL;
-}
-
-static int scan_register(struct btd_service *service, struct gatt_primary *prim)
-{
-	struct btd_device *device = btd_service_get_device(service);
-	struct scan *scan;
+	write_scan_params(scan);
+}
+
+static void handle_characteristic(struct gatt_db_attribute *attr,
+								void *user_data)
+{
+	struct scan *scan = user_data;
+	uint16_t value_handle;
+	bt_uuid_t uuid, scan_interval_wind_uuid, scan_refresh_uuid;
+
+	if (!gatt_db_attribute_get_char_data(attr, NULL, &value_handle, NULL,
+								&uuid)) {
+		error("Failed to obtain characteristic data");
+		return;
+	}
+
+	bt_uuid16_create(&scan_interval_wind_uuid, SCAN_INTERVAL_WIN_UUID);
+	bt_uuid16_create(&scan_refresh_uuid, SCAN_REFRESH_UUID);
+
+	if (bt_uuid_cmp(&scan_interval_wind_uuid, &uuid) == 0)
+		handle_iwin(scan, value_handle);
+	else if (bt_uuid_cmp(&scan_refresh_uuid, &uuid) == 0)
+		handle_refresh(scan, value_handle);
+	else {
+		char uuid_str[MAX_LEN_UUID_STR];
+
+		bt_uuid_to_string(&uuid, uuid_str, sizeof(uuid_str));
+		DBG("Unsupported characteristic: %s", uuid_str);
+	}
+}
+
+static void foreach_scan_param_service(struct gatt_db_attribute *attr,
+								void *user_data)
+{
+	struct scan *scan = user_data;
+
+	if (scan->attr) {
+		error("More than one scan params service exists for this "
+								"device");
+		return;
+	}
+
+	scan->attr = attr;
+	gatt_db_service_foreach_char(scan->attr, handle_characteristic, scan);
+}
+
+static int scan_param_accept(struct btd_service *service)
+{
+	struct btd_device *device = btd_service_get_device(service);
+	struct gatt_db *db = btd_device_get_gatt_db(device);
+	struct bt_gatt_client *client = btd_device_get_gatt_client(device);
+	bt_uuid_t scan_parameters_uuid;
+	struct scan *scan;
+	GSList *l;
+	char addr[18];
+
+	ba2str(device_get_address(device), addr);
+	DBG("Scan Parameters Client Driver profile accept (%s)", addr);
+
+	l = g_slist_find_custom(devices, device, cmp_device);
+	if (!l) {
+		error("Scan Parameters service not handled by profile");
+		return -1;
+	}
+
+	scan = l->data;
+
+	/* Clean-up any old client/db and acquire the new ones */
+	scan->attr = NULL;
+	gatt_db_unref(scan->db);
+	bt_gatt_client_unref(scan->client);
+
+
+	scan->db = gatt_db_ref(db);
+	scan->client = bt_gatt_client_ref(client);
+
+	bt_string_to_uuid(&scan_parameters_uuid, SCAN_PARAMETERS_UUID);
+	gatt_db_foreach_service(db, &scan_parameters_uuid,
+					foreach_scan_param_service, scan);
+
+	return 0;
+}
+
+static void scan_param_remove(struct btd_service *service)
+{
+	struct btd_device *device = btd_service_get_device(service);
+	struct scan *scan;
+	GSList *l;
+	char addr[18];
+
+	ba2str(device_get_address(device), addr);
+	DBG("GAP profile remove (%s)", addr);
+
+	l = g_slist_find_custom(devices, device, cmp_device);
+	if (!l) {
+		error("GAP service not handled by profile");
+		return;
+	}
+
+	scan = l->data;
+
+	devices = g_slist_remove(devices, scan);
+	scan_free(scan);
+}
+
+static int scan_param_probe(struct btd_service *service)
+{
+	struct btd_device *device = btd_service_get_device(service);
+	struct scan *scan;
+	GSList *l;
+	char addr[18];
+
+	ba2str(device_get_address(device), addr);
+	DBG("Scan Parameters Client Driver profile probe (%s)", addr);
+
+	/* Ignore, if we were probed for this device already */
+	l = g_slist_find_custom(devices, device, cmp_device);
+	if (l) {
+		error("Profile probed twice for the same device!");
+		return -1;
+	}
 
 	scan = g_new0(struct scan, 1);
+	if (!scan)
+		return -1;
+
 	scan->device = btd_device_ref(device);
-	scan->range = prim->range;
-	scan->attioid = btd_device_add_attio_callback(device,
-							attio_connected_cb,
-							attio_disconnected_cb,
-							scan);
-
-	btd_service_set_user_data(service, scan);
-
+	devices = g_slist_append(devices, scan);
 	return 0;
 }
 
-static void scan_param_remove(struct btd_service *service)
-{
-	struct scan *scan = btd_service_get_user_data(service);
-
-	if (scan->attrib != NULL && scan->refresh_cb_id > 0)
-		g_attrib_unregister(scan->attrib, scan->refresh_cb_id);
-
-	btd_device_remove_attio_callback(scan->device, scan->attioid);
-	btd_device_unref(scan->device);
-	g_attrib_unref(scan->attrib);
-	g_free(scan);
-}
-
-static int scan_param_probe(struct btd_service *service)
-{
-	struct btd_device *device = btd_service_get_device(service);
-	struct gatt_primary *prim;
-
-	DBG("Probing Scan Parameters");
-
-	prim = btd_device_get_primary(device, SCAN_PARAMETERS_UUID);
-	if (!prim)
-		return -EINVAL;
-
-	return scan_register(service, prim);
-}
-
 static struct btd_profile scan_profile = {
 	.name = "Scan Parameters Client Driver",
 	.remote_uuid = SCAN_PARAMETERS_UUID,
 	.device_probe = scan_param_probe,
 	.device_remove = scan_param_remove,
+	.accept = scan_param_accept,
 };
 
 static int scan_param_init(void)

=== modified file 'src/advertising.c'
--- src/advertising.c	2015-09-15 13:42:52 +0000
+++ src/advertising.c	2015-11-23 18:34:05 +0000
@@ -77,10 +77,10 @@
 	const struct advertisement *ad = a;
 	const struct dbus_obj_match *match = b;
 
-	if (match->owner && !g_strcmp0(ad->owner, match->owner))
+	if (match->owner && g_strcmp0(ad->owner, match->owner))
 		return false;
 
-	if (match->path && !g_strcmp0(ad->path, match->path))
+	if (match->path && g_strcmp0(ad->path, match->path))
 		return false;
 
 	return true;

=== modified file 'src/bluetooth.service.in'
--- src/bluetooth.service.in	2015-09-15 13:42:52 +0000
+++ src/bluetooth.service.in	2015-11-23 18:34:05 +0000
@@ -1,6 +1,7 @@
 [Unit]
 Description=Bluetooth service
 Documentation=man:bluetoothd(8)
+ConditionPathIsDirectory=/sys/class/bluetooth
 
 [Service]
 Type=dbus

=== modified file 'src/device.c'
--- src/device.c	2015-10-06 11:46:27 +0000
+++ src/device.c	2015-11-23 18:34:05 +0000
@@ -626,6 +626,9 @@
 	g_slist_free_full(device->attios_offline, g_free);
 	g_slist_free_full(device->svc_callbacks, svc_dev_remove);
 
+	/* Reset callbacks since the device is going to be freed */
+	gatt_db_register(device->db, NULL, NULL, NULL, NULL);
+
 	attio_cleanup(device);
 
 	gatt_db_unref(device->db);
@@ -1355,6 +1358,12 @@
 	if (device->browse)
 		browse_request_cancel(device->browse);
 
+	if (device->att_io) {
+		g_io_channel_shutdown(device->att_io, FALSE, NULL);
+		g_io_channel_unref(device->att_io);
+		device->att_io = NULL;
+	}
+
 	if (device->connect) {
 		DBusMessage *reply = btd_error_failed(device->connect,
 								"Cancelled");
@@ -2006,7 +2015,7 @@
 
 	sprintf(handle, "%04hx", handle_num);
 	bt_uuid_to_string(&uuid, uuid_str, sizeof(uuid_str));
-	sprintf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hx:%s", value_handle,
+	sprintf(value, GATT_CHARAC_UUID_STR ":%04hx:%02hhx:%s", value_handle,
 							properties, uuid_str);
 	g_key_file_set_string(key_file, "Attributes", handle, value);
 
@@ -3230,7 +3239,7 @@
 	return true;
 }
 
-static void probe_gatt_profile(struct gatt_db_attribute *attr, void *user_data)
+static void add_gatt_service(struct gatt_db_attribute *attr, void *user_data)
 {
 	struct btd_device *device = user_data;
 	struct btd_service *service;
@@ -3242,6 +3251,11 @@
 	gatt_db_attribute_get_service_uuid(attr, &uuid);
 	bt_uuid_to_string(&uuid, uuid_str, sizeof(uuid_str));
 
+	/* Check if service was already probed */
+	l = find_service_with_uuid(device->services, uuid_str);
+	if (l)
+		goto done;
+
 	/* Add UUID and probe service */
 	btd_device_add_uuid(device, uuid_str);
 
@@ -3250,21 +3264,24 @@
 	if (!l)
 		return;
 
+done:
 	/* Mark service as active to skip discovering it again */
 	gatt_db_service_set_active(attr, true);
 
 	service = l->data;
 	profile = btd_service_get_profile(service);
 
-	/* Don't claim attributes of external profiles */
-	if (profile->external)
-		return;
+	/* Claim attributes of internal profiles */
+	if (!profile->external) {
+		/* Mark the service as claimed by the existing profile. */
+		gatt_db_service_set_claimed(attr, true);
+	}
 
-	/* Mark the service as claimed by the existing profile. */
-	gatt_db_service_set_claimed(attr, true);
+	/* Notify driver about the new connection */
+	service_accept(service);
 }
 
-static void device_probe_gatt_profiles(struct btd_device *device)
+static void device_add_gatt_services(struct btd_device *device)
 {
 	char addr[18];
 
@@ -3275,7 +3292,7 @@
 		return;
 	}
 
-	gatt_db_foreach_service(device->db, NULL, probe_gatt_profile, device);
+	gatt_db_foreach_service(device->db, NULL, add_gatt_service, device);
 }
 
 static void device_accept_gatt_profiles(struct btd_device *device)
@@ -3286,7 +3303,7 @@
 		service_accept(l->data);
 }
 
-static void device_remove_gatt_profile(struct btd_device *device,
+static void device_remove_gatt_service(struct btd_device *device,
 						struct gatt_db_attribute *attr)
 {
 	struct btd_service *service;
@@ -3323,16 +3340,12 @@
 {
 	struct btd_device *device = user_data;
 	GSList *new_service = NULL;
-	bt_uuid_t uuid;
-	char uuid_str[MAX_LEN_UUID_STR];
 	uint16_t start, end;
-	GSList *l;
 
 	if (!bt_gatt_client_is_ready(device->client))
 		return;
 
-	gatt_db_attribute_get_service_data(attr, &start, &end, NULL, &uuid);
-	bt_uuid_to_string(&uuid, uuid_str, sizeof(uuid_str));
+	gatt_db_attribute_get_service_data(attr, &start, &end, NULL, NULL);
 
 	DBG("start: 0x%04x, end: 0x%04x", start, end);
 
@@ -3344,21 +3357,9 @@
 	if (!new_service)
 		return;
 
-	l = find_service_with_uuid(device->services, uuid_str);
-
 	device_register_primaries(device, new_service, -1);
 
-	/*
-	 * If the profile was probed for the first time then call accept on
-	 * the service.
-	 */
-	if (!l) {
-		l = find_service_with_uuid(device->services, uuid_str);
-		if (l)
-			service_accept(l->data);
-	}
-
-	btd_device_add_uuid(device, uuid_str);
+	add_gatt_service(attr, device);
 
 	btd_gatt_client_service_added(device->client_dbus, attr);
 
@@ -3437,7 +3438,7 @@
 		 * remove it anyway.
 		 */
 		if (device->client || device->temporary == TRUE)
-			device_remove_gatt_profile(device, attr);
+			device_remove_gatt_service(device, attr);
 
 		g_free(l->data);
 		device->uuids = g_slist_delete_link(device->uuids, l);
@@ -4518,7 +4519,7 @@
 
 	device_register_primaries(device, services, -1);
 
-	device_probe_gatt_profiles(device);
+	device_add_gatt_services(device);
 
 	device_svc_resolved(device, device->bdaddr_type, 0);
 }
@@ -4539,8 +4540,6 @@
 
 	register_gatt_services(device);
 
-	device_accept_gatt_profiles(device);
-
 	btd_gatt_client_ready(device->client_dbus);
 
 	/*
@@ -4585,6 +4584,12 @@
 	/* Notify attio so it can react to notifications */
 	g_slist_foreach(device->attios, attio_connected, device->attrib);
 
+	/*
+	 * Notify notify existing service about the new connection so they can
+	 * react to notifications while discovering services
+	 */
+	device_accept_gatt_profiles(device);
+
 	if (!bt_gatt_client_set_ready_handler(device->client,
 							gatt_client_ready_cb,
 							device, NULL)) {
@@ -4779,7 +4784,7 @@
 	}
 
 	if (device->connect) {
-		if (!device->le_state.svc_resolved)
+		if (!device->le_state.svc_resolved && !err)
 			device_browse_gatt(device, NULL);
 
 		if (err < 0)

=== modified file 'src/gatt-client.c'
--- src/gatt-client.c	2015-10-06 11:46:27 +0000
+++ src/gatt-client.c	2015-11-23 18:34:05 +0000
@@ -1527,7 +1527,7 @@
 						service_properties,
 						service, service_free)) {
 		error("Unable to register GATT service with handle 0x%04x for "
-							"device %s:",
+							"device %s",
 							service->start_handle,
 							client->devaddr);
 		service_free(service);

=== modified file 'src/profile.c'
--- src/profile.c	2015-09-15 13:42:52 +0000
+++ src/profile.c	2015-11-23 18:34:05 +0000
@@ -742,10 +742,14 @@
 	for (l = ext_profiles; l != NULL; l = g_slist_next(l)) {
 		struct ext_profile *ext = l->data;
 
-		if (!g_str_equal(ext->owner, owner))
+		/*
+		 * Owner and path can be NULL if profile was registered by a
+		 * plugin using external flag.
+		 */
+		if (g_strcmp0(ext->owner, owner))
 			continue;
 
-		if (g_str_equal(ext->path, path))
+		if (!g_strcmp0(ext->path, path))
 			return ext;
 	}
 

=== modified file 'src/service.c'
--- src/service.c	2015-09-15 13:42:52 +0000
+++ src/service.c	2015-11-23 18:34:05 +0000
@@ -184,6 +184,18 @@
 	char addr[18];
 	int err;
 
+	switch (service->state) {
+	case BTD_SERVICE_STATE_UNAVAILABLE:
+		return -EINVAL;
+	case BTD_SERVICE_STATE_DISCONNECTED:
+		break;
+	case BTD_SERVICE_STATE_CONNECTING:
+	case BTD_SERVICE_STATE_CONNECTED:
+		return -EALREADY;
+	case BTD_SERVICE_STATE_DISCONNECTING:
+		return -EBUSY;
+	}
+
 	if (!service->profile->accept)
 		goto done;
 

=== modified file 'src/shared/ad.c'
--- src/shared/ad.c	2015-09-15 13:42:52 +0000
+++ src/shared/ad.c	2015-11-23 18:34:05 +0000
@@ -5,15 +5,19 @@
  *  Copyright (C) 2015  Google Inc.
  *
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
  *
- *  This program is distributed in the hope that it will be useful,
+ *  This library is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
 

=== modified file 'src/shared/ad.h'
--- src/shared/ad.h	2015-09-15 13:42:52 +0000
+++ src/shared/ad.h	2015-11-23 18:34:05 +0000
@@ -5,15 +5,19 @@
  *  Copyright (C) 2015  Google Inc.
  *
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2.1 of the License, or (at your option) any later version.
  *
- *  This program is distributed in the hope that it will be useful,
+ *  This library is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  *
  */
 

=== modified file 'src/shared/btsnoop.c'
--- src/shared/btsnoop.c	2015-09-15 13:42:52 +0000
+++ src/shared/btsnoop.c	2015-11-23 18:34:05 +0000
@@ -72,6 +72,7 @@
 	uint16_t index;
 	bool aborted;
 	bool pklg_format;
+	bool pklg_v2;
 };
 
 struct btsnoop *btsnoop_open(const char *path, unsigned long flags)
@@ -108,12 +109,14 @@
 			goto failed;
 
 		/* Check for Apple Packet Logger format */
-		if (hdr.id[0] != 0x00 || hdr.id[1] != 0x00)
+		if (hdr.id[0] != 0x00 ||
+				(hdr.id[1] != 0x00 && hdr.id[1] != 0x01))
 			goto failed;
 
 		btsnoop->type = BTSNOOP_TYPE_MONITOR;
 		btsnoop->index = 0xffff;
 		btsnoop->pklg_format = true;
+		btsnoop->pklg_v2 = (hdr.id[1] == 0x01);
 
 		/* Apple Packet Logger format has no header */
 		lseek(btsnoop->fd, 0, SEEK_SET);
@@ -242,6 +245,9 @@
 	case BTSNOOP_OPCODE_SCO_TX_PKT:
 	case BTSNOOP_OPCODE_SCO_RX_PKT:
 		break;
+	case BTSNOOP_OPCODE_OPEN_INDEX:
+	case BTSNOOP_OPCODE_CLOSE_INDEX:
+		break;
 	}
 
 	return 0xff;
@@ -334,11 +340,19 @@
 		return false;
 	}