ipv6: Remove external dependency on rt6i_dst and rt6i_src
[cascardo/linux.git] / net / bluetooth / mgmt.c
index 9ec5390..7fd87e7 100644 (file)
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
+#include <net/bluetooth/hci_sock.h>
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/mgmt.h>
 
 #include "hci_request.h"
 #include "smp.h"
+#include "mgmt_util.h"
 
 #define MGMT_VERSION   1
-#define MGMT_REVISION  8
+#define MGMT_REVISION  9
 
 static const u16 mgmt_commands[] = {
        MGMT_OP_READ_INDEX_LIST,
@@ -95,6 +97,11 @@ static const u16 mgmt_commands[] = {
        MGMT_OP_SET_EXTERNAL_CONFIG,
        MGMT_OP_SET_PUBLIC_ADDRESS,
        MGMT_OP_START_SERVICE_DISCOVERY,
+       MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
+       MGMT_OP_READ_EXT_INDEX_LIST,
+       MGMT_OP_READ_ADV_FEATURES,
+       MGMT_OP_ADD_ADVERTISING,
+       MGMT_OP_REMOVE_ADVERTISING,
 };
 
 static const u16 mgmt_events[] = {
@@ -127,6 +134,32 @@ static const u16 mgmt_events[] = {
        MGMT_EV_UNCONF_INDEX_ADDED,
        MGMT_EV_UNCONF_INDEX_REMOVED,
        MGMT_EV_NEW_CONFIG_OPTIONS,
+       MGMT_EV_EXT_INDEX_ADDED,
+       MGMT_EV_EXT_INDEX_REMOVED,
+       MGMT_EV_LOCAL_OOB_DATA_UPDATED,
+       MGMT_EV_ADVERTISING_ADDED,
+       MGMT_EV_ADVERTISING_REMOVED,
+};
+
+static const u16 mgmt_untrusted_commands[] = {
+       MGMT_OP_READ_INDEX_LIST,
+       MGMT_OP_READ_INFO,
+       MGMT_OP_READ_UNCONF_INDEX_LIST,
+       MGMT_OP_READ_CONFIG_INFO,
+       MGMT_OP_READ_EXT_INDEX_LIST,
+};
+
+static const u16 mgmt_untrusted_events[] = {
+       MGMT_EV_INDEX_ADDED,
+       MGMT_EV_INDEX_REMOVED,
+       MGMT_EV_NEW_SETTINGS,
+       MGMT_EV_CLASS_OF_DEV_CHANGED,
+       MGMT_EV_LOCAL_NAME_CHANGED,
+       MGMT_EV_UNCONF_INDEX_ADDED,
+       MGMT_EV_UNCONF_INDEX_REMOVED,
+       MGMT_EV_NEW_CONFIG_OPTIONS,
+       MGMT_EV_EXT_INDEX_ADDED,
+       MGMT_EV_EXT_INDEX_REMOVED,
 };
 
 #define CACHE_TIMEOUT  msecs_to_jiffies(2 * 1000)
@@ -134,17 +167,6 @@ static const u16 mgmt_events[] = {
 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
                 "\x00\x00\x00\x00\x00\x00\x00\x00"
 
-struct pending_cmd {
-       struct list_head list;
-       u16 opcode;
-       int index;
-       void *param;
-       size_t param_len;
-       struct sock *sk;
-       void *user_data;
-       int (*cmd_complete)(struct pending_cmd *cmd, u8 status);
-};
-
 /* HCI to MGMT error code conversion table */
 static u8 mgmt_status_table[] = {
        MGMT_STATUS_SUCCESS,
@@ -218,98 +240,32 @@ static u8 mgmt_status(u8 hci_status)
        return MGMT_STATUS_FAILED;
 }
 
-static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 data_len,
-                     struct sock *skip_sk)
+static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
+                           u16 len, int flag)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-
-       skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-       hdr->opcode = cpu_to_le16(event);
-       if (hdev)
-               hdr->index = cpu_to_le16(hdev->id);
-       else
-               hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
-       hdr->len = cpu_to_le16(data_len);
-
-       if (data)
-               memcpy(skb_put(skb, data_len), data, data_len);
-
-       /* Time stamp */
-       __net_timestamp(skb);
-
-       hci_send_to_control(skb, skip_sk);
-       kfree_skb(skb);
-
-       return 0;
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              flag, NULL);
 }
 
-static int cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
+static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
+                             u16 len, int flag, struct sock *skip_sk)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-       struct mgmt_ev_cmd_status *ev;
-       int err;
-
-       BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
-
-       skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-
-       hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
-       hdr->index = cpu_to_le16(index);
-       hdr->len = cpu_to_le16(sizeof(*ev));
-
-       ev = (void *) skb_put(skb, sizeof(*ev));
-       ev->status = status;
-       ev->opcode = cpu_to_le16(cmd);
-
-       err = sock_queue_rcv_skb(sk, skb);
-       if (err < 0)
-               kfree_skb(skb);
-
-       return err;
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              flag, skip_sk);
 }
 
-static int cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
-                       void *rp, size_t rp_len)
+static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
+                             u16 len, struct sock *skip_sk)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-       struct mgmt_ev_cmd_complete *ev;
-       int err;
-
-       BT_DBG("sock %p", sk);
-
-       skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-
-       hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
-       hdr->index = cpu_to_le16(index);
-       hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
-
-       ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
-       ev->opcode = cpu_to_le16(cmd);
-       ev->status = status;
-
-       if (rp)
-               memcpy(ev->data, rp, rp_len);
-
-       err = sock_queue_rcv_skb(sk, skb);
-       if (err < 0)
-               kfree_skb(skb);
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              HCI_MGMT_GENERIC_EVENTS, skip_sk);
+}
 
-       return err;
+static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
+                     struct sock *skip_sk)
+{
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              HCI_SOCK_TRUSTED, skip_sk);
 }
 
 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -322,22 +278,28 @@ static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.version = MGMT_VERSION;
        rp.revision = cpu_to_le16(MGMT_REVISION);
 
-       return cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, &rp,
-                           sizeof(rp));
+       return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0,
+                                &rp, sizeof(rp));
 }
 
 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
                         u16 data_len)
 {
        struct mgmt_rp_read_commands *rp;
-       const u16 num_commands = ARRAY_SIZE(mgmt_commands);
-       const u16 num_events = ARRAY_SIZE(mgmt_events);
-       __le16 *opcode;
+       u16 num_commands, num_events;
        size_t rp_size;
        int i, err;
 
        BT_DBG("sock %p", sk);
 
+       if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
+               num_commands = ARRAY_SIZE(mgmt_commands);
+               num_events = ARRAY_SIZE(mgmt_events);
+       } else {
+               num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
+               num_events = ARRAY_SIZE(mgmt_untrusted_events);
+       }
+
        rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 
        rp = kmalloc(rp_size, GFP_KERNEL);
@@ -347,14 +309,26 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
        rp->num_commands = cpu_to_le16(num_commands);
        rp->num_events = cpu_to_le16(num_events);
 
-       for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
-               put_unaligned_le16(mgmt_commands[i], opcode);
+       if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
+               __le16 *opcode = rp->opcodes;
+
+               for (i = 0; i < num_commands; i++, opcode++)
+                       put_unaligned_le16(mgmt_commands[i], opcode);
+
+               for (i = 0; i < num_events; i++, opcode++)
+                       put_unaligned_le16(mgmt_events[i], opcode);
+       } else {
+               __le16 *opcode = rp->opcodes;
+
+               for (i = 0; i < num_commands; i++, opcode++)
+                       put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 
-       for (i = 0; i < num_events; i++, opcode++)
-               put_unaligned_le16(mgmt_events[i], opcode);
+               for (i = 0; i < num_events; i++, opcode++)
+                       put_unaligned_le16(mgmt_untrusted_events[i], opcode);
+       }
 
-       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, rp,
-                          rp_size);
+       err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
+                               rp, rp_size);
        kfree(rp);
 
        return err;
@@ -376,7 +350,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
        count = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
                if (d->dev_type == HCI_BREDR &&
-                   !test_bit(HCI_UNCONFIGURED, &d->dev_flags))
+                   !hci_dev_test_flag(d, HCI_UNCONFIGURED))
                        count++;
        }
 
@@ -389,9 +363,9 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 
        count = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
-               if (test_bit(HCI_SETUP, &d->dev_flags) ||
-                   test_bit(HCI_CONFIG, &d->dev_flags) ||
-                   test_bit(HCI_USER_CHANNEL, &d->dev_flags))
+               if (hci_dev_test_flag(d, HCI_SETUP) ||
+                   hci_dev_test_flag(d, HCI_CONFIG) ||
+                   hci_dev_test_flag(d, HCI_USER_CHANNEL))
                        continue;
 
                /* Devices marked as raw-only are neither configured
@@ -401,7 +375,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                        continue;
 
                if (d->dev_type == HCI_BREDR &&
-                   !test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
+                   !hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
                        rp->index[count++] = cpu_to_le16(d->id);
                        BT_DBG("Added hci%u", d->id);
                }
@@ -412,8 +386,8 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 
        read_unlock(&hci_dev_list_lock);
 
-       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
-                          rp_len);
+       err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST,
+                               0, rp, rp_len);
 
        kfree(rp);
 
@@ -436,7 +410,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
        count = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
                if (d->dev_type == HCI_BREDR &&
-                   test_bit(HCI_UNCONFIGURED, &d->dev_flags))
+                   hci_dev_test_flag(d, HCI_UNCONFIGURED))
                        count++;
        }
 
@@ -449,9 +423,9 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 
        count = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
-               if (test_bit(HCI_SETUP, &d->dev_flags) ||
-                   test_bit(HCI_CONFIG, &d->dev_flags) ||
-                   test_bit(HCI_USER_CHANNEL, &d->dev_flags))
+               if (hci_dev_test_flag(d, HCI_SETUP) ||
+                   hci_dev_test_flag(d, HCI_CONFIG) ||
+                   hci_dev_test_flag(d, HCI_USER_CHANNEL))
                        continue;
 
                /* Devices marked as raw-only are neither configured
@@ -461,7 +435,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
                        continue;
 
                if (d->dev_type == HCI_BREDR &&
-                   test_bit(HCI_UNCONFIGURED, &d->dev_flags)) {
+                   hci_dev_test_flag(d, HCI_UNCONFIGURED)) {
                        rp->index[count++] = cpu_to_le16(d->id);
                        BT_DBG("Added hci%u", d->id);
                }
@@ -472,8 +446,84 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 
        read_unlock(&hci_dev_list_lock);
 
-       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_UNCONF_INDEX_LIST,
-                          0, rp, rp_len);
+       err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
+                               MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len);
+
+       kfree(rp);
+
+       return err;
+}
+
+static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev,
+                              void *data, u16 data_len)
+{
+       struct mgmt_rp_read_ext_index_list *rp;
+       struct hci_dev *d;
+       size_t rp_len;
+       u16 count;
+       int err;
+
+       BT_DBG("sock %p", sk);
+
+       read_lock(&hci_dev_list_lock);
+
+       count = 0;
+       list_for_each_entry(d, &hci_dev_list, list) {
+               if (d->dev_type == HCI_BREDR || d->dev_type == HCI_AMP)
+                       count++;
+       }
+
+       rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
+       rp = kmalloc(rp_len, GFP_ATOMIC);
+       if (!rp) {
+               read_unlock(&hci_dev_list_lock);
+               return -ENOMEM;
+       }
+
+       count = 0;
+       list_for_each_entry(d, &hci_dev_list, list) {
+               if (hci_dev_test_flag(d, HCI_SETUP) ||
+                   hci_dev_test_flag(d, HCI_CONFIG) ||
+                   hci_dev_test_flag(d, HCI_USER_CHANNEL))
+                       continue;
+
+               /* Devices marked as raw-only are neither configured
+                * nor unconfigured controllers.
+                */
+               if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks))
+                       continue;
+
+               if (d->dev_type == HCI_BREDR) {
+                       if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
+                               rp->entry[count].type = 0x01;
+                       else
+                               rp->entry[count].type = 0x00;
+               } else if (d->dev_type == HCI_AMP) {
+                       rp->entry[count].type = 0x02;
+               } else {
+                       continue;
+               }
+
+               rp->entry[count].bus = d->bus;
+               rp->entry[count++].index = cpu_to_le16(d->id);
+               BT_DBG("Added hci%u", d->id);
+       }
+
+       rp->num_controllers = cpu_to_le16(count);
+       rp_len = sizeof(*rp) + (sizeof(rp->entry[0]) * count);
+
+       read_unlock(&hci_dev_list_lock);
+
+       /* If this command is called at least once, then all the
+        * default index and unconfigured index events are disabled
+        * and from now on only extended index events are used.
+        */
+       hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS);
+       hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS);
+       hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
+
+       err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE,
+                               MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, rp_len);
 
        kfree(rp);
 
@@ -483,7 +533,7 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 static bool is_configured(struct hci_dev *hdev)
 {
        if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
-           !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
+           !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
                return false;
 
        if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
@@ -498,7 +548,7 @@ static __le32 get_missing_options(struct hci_dev *hdev)
        u32 options = 0;
 
        if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) &&
-           !test_bit(HCI_EXT_CONFIGURED, &hdev->dev_flags))
+           !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED))
                options |= MGMT_OPTION_EXTERNAL_CONFIG;
 
        if (test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) &&
@@ -512,16 +562,16 @@ static int new_options(struct hci_dev *hdev, struct sock *skip)
 {
        __le32 options = get_missing_options(hdev);
 
-       return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
-                         sizeof(options), skip);
+       return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
+                                 sizeof(options), skip);
 }
 
 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
        __le32 options = get_missing_options(hdev);
 
-       return cmd_complete(sk, hdev->id, opcode, 0, &options,
-                           sizeof(options));
+       return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options,
+                                sizeof(options));
 }
 
 static int read_config_info(struct sock *sk, struct hci_dev *hdev,
@@ -548,8 +598,8 @@ static int read_config_info(struct sock *sk, struct hci_dev *hdev,
 
        hci_dev_unlock(hdev);
 
-       return cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, &rp,
-                           sizeof(rp));
+       return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0,
+                                &rp, sizeof(rp));
 }
 
 static u32 get_supported_settings(struct hci_dev *hdev)
@@ -582,6 +632,7 @@ static u32 get_supported_settings(struct hci_dev *hdev)
                settings |= MGMT_SETTING_ADVERTISING;
                settings |= MGMT_SETTING_SECURE_CONN;
                settings |= MGMT_SETTING_PRIVACY;
+               settings |= MGMT_SETTING_STATIC_ADDRESS;
        }
 
        if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
@@ -598,45 +649,64 @@ static u32 get_current_settings(struct hci_dev *hdev)
        if (hdev_is_powered(hdev))
                settings |= MGMT_SETTING_POWERED;
 
-       if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_CONNECTABLE))
                settings |= MGMT_SETTING_CONNECTABLE;
 
-       if (test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
                settings |= MGMT_SETTING_FAST_CONNECTABLE;
 
-       if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
                settings |= MGMT_SETTING_DISCOVERABLE;
 
-       if (test_bit(HCI_BONDABLE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_BONDABLE))
                settings |= MGMT_SETTING_BONDABLE;
 
-       if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
                settings |= MGMT_SETTING_BREDR;
 
-       if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
                settings |= MGMT_SETTING_LE;
 
-       if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY))
                settings |= MGMT_SETTING_LINK_SECURITY;
 
-       if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
                settings |= MGMT_SETTING_SSP;
 
-       if (test_bit(HCI_HS_ENABLED, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
                settings |= MGMT_SETTING_HS;
 
-       if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
                settings |= MGMT_SETTING_ADVERTISING;
 
-       if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_SC_ENABLED))
                settings |= MGMT_SETTING_SECURE_CONN;
 
-       if (test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS))
                settings |= MGMT_SETTING_DEBUG_KEYS;
 
-       if (test_bit(HCI_PRIVACY, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_PRIVACY))
                settings |= MGMT_SETTING_PRIVACY;
 
+       /* The current setting for static address has two purposes. The
+        * first is to indicate if the static address will be used and
+        * the second is to indicate if it is actually set.
+        *
+        * This means if the static address is not configured, this flag
+        * will never be set. If the address is configured, then if the
+        * address is actually used decides if the flag is set or not.
+        *
+        * For single mode LE only controllers and dual-mode controllers
+        * with BR/EDR disabled, the existence of the static address will
+        * be evaluated.
+        */
+       if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
+           !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
+           !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
+               if (bacmp(&hdev->static_addr, BDADDR_ANY))
+                       settings |= MGMT_SETTING_STATIC_ADDRESS;
+       }
+
        return settings;
 }
 
@@ -750,35 +820,19 @@ static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
        return ptr;
 }
 
-static struct pending_cmd *mgmt_pending_find(u16 opcode, struct hci_dev *hdev)
+static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 {
-       struct pending_cmd *cmd;
-
-       list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
-               if (cmd->opcode == opcode)
-                       return cmd;
-       }
-
-       return NULL;
+       return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 }
 
-static struct pending_cmd *mgmt_pending_find_data(u16 opcode,
+static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
                                                  struct hci_dev *hdev,
                                                  const void *data)
 {
-       struct pending_cmd *cmd;
-
-       list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
-               if (cmd->user_data != data)
-                       continue;
-               if (cmd->opcode == opcode)
-                       return cmd;
-       }
-
-       return NULL;
+       return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 }
 
-static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
+static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 {
        u8 ad_len = 0;
        size_t name_len;
@@ -804,21 +858,36 @@ static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
        return ad_len;
 }
 
-static void update_scan_rsp_data(struct hci_request *req)
+static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
+{
+       /* TODO: Set the appropriate entries based on advertising instance flags
+        * here once flags other than 0 are supported.
+        */
+       memcpy(ptr, hdev->adv_instance.scan_rsp_data,
+              hdev->adv_instance.scan_rsp_len);
+
+       return hdev->adv_instance.scan_rsp_len;
+}
+
+static void update_scan_rsp_data_for_instance(struct hci_request *req,
+                                             u8 instance)
 {
        struct hci_dev *hdev = req->hdev;
        struct hci_cp_le_set_scan_rsp_data cp;
        u8 len;
 
-       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
                return;
 
        memset(&cp, 0, sizeof(cp));
 
-       len = create_scan_rsp_data(hdev, cp.data);
+       if (instance)
+               len = create_instance_scan_rsp_data(hdev, cp.data);
+       else
+               len = create_default_scan_rsp_data(hdev, cp.data);
 
        if (hdev->scan_rsp_data_len == len &&
-           memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
+           !memcmp(cp.data, hdev->scan_rsp_data, len))
                return;
 
        memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
@@ -829,14 +898,33 @@ static void update_scan_rsp_data(struct hci_request *req)
        hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 }
 
+static void update_scan_rsp_data(struct hci_request *req)
+{
+       struct hci_dev *hdev = req->hdev;
+       u8 instance;
+
+       /* The "Set Advertising" setting supersedes the "Add Advertising"
+        * setting. Here we set the scan response data based on which
+        * setting was set. When neither apply, default to the global settings,
+        * represented by instance "0".
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               instance = 0x01;
+       else
+               instance = 0x00;
+
+       update_scan_rsp_data_for_instance(req, instance);
+}
+
 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        /* If there's a pending mgmt command the flags will not yet have
         * their final values, so check for this first.
         */
-       cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
        if (cmd) {
                struct mgmt_mode *cp = cmd->param;
                if (cp->val == 0x01)
@@ -844,39 +932,131 @@ static u8 get_adv_discov_flags(struct hci_dev *hdev)
                else if (cp->val == 0x02)
                        return LE_AD_LIMITED;
        } else {
-               if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
+               if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
                        return LE_AD_LIMITED;
-               else if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
+               else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
                        return LE_AD_GENERAL;
        }
 
        return 0;
 }
 
-static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
+static u8 get_current_adv_instance(struct hci_dev *hdev)
+{
+       /* The "Set Advertising" setting supersedes the "Add Advertising"
+        * setting. Here we set the advertising data based on which
+        * setting was set. When neither apply, default to the global settings,
+        * represented by instance "0".
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               return 0x01;
+
+       return 0x00;
+}
+
+static bool get_connectable(struct hci_dev *hdev)
+{
+       struct mgmt_pending_cmd *cmd;
+
+       /* If there's a pending mgmt command the flag will not yet have
+        * it's final value, so check for this first.
+        */
+       cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+       if (cmd) {
+               struct mgmt_mode *cp = cmd->param;
+
+               return cp->val;
+       }
+
+       return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
+}
+
+static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
+{
+       u32 flags;
+
+       if (instance > 0x01)
+               return 0;
+
+       if (instance == 0x01)
+               return hdev->adv_instance.flags;
+
+       /* Instance 0 always manages the "Tx Power" and "Flags" fields */
+       flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting corresponds
+        * to the "connectable" instance flag.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
+               flags |= MGMT_ADV_FLAG_CONNECTABLE;
+
+       return flags;
+}
+
+static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
+{
+       /* Ignore instance 0 and other unsupported instances */
+       if (instance != 0x01)
+               return 0;
+
+       /* TODO: Take into account the "appearance" and "local-name" flags here.
+        * These are currently being ignored as they are not supported.
+        */
+       return hdev->adv_instance.scan_rsp_len;
+}
+
+static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
 {
        u8 ad_len = 0, flags = 0;
+       u32 instance_flags = get_adv_instance_flags(hdev, instance);
 
-       flags |= get_adv_discov_flags(hdev);
+       /* The Add Advertising command allows userspace to set both the general
+        * and limited discoverable flags.
+        */
+       if (instance_flags & MGMT_ADV_FLAG_DISCOV)
+               flags |= LE_AD_GENERAL;
 
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
-               flags |= LE_AD_NO_BREDR;
+       if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
+               flags |= LE_AD_LIMITED;
 
-       if (flags) {
-               BT_DBG("adv flags 0x%02x", flags);
+       if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
+               /* If a discovery flag wasn't provided, simply use the global
+                * settings.
+                */
+               if (!flags)
+                       flags |= get_adv_discov_flags(hdev);
 
-               ptr[0] = 2;
-               ptr[1] = EIR_FLAGS;
-               ptr[2] = flags;
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+                       flags |= LE_AD_NO_BREDR;
 
-               ad_len += 3;
-               ptr += 3;
+               /* If flags would still be empty, then there is no need to
+                * include the "Flags" AD field".
+                */
+               if (flags) {
+                       ptr[0] = 0x02;
+                       ptr[1] = EIR_FLAGS;
+                       ptr[2] = flags;
+
+                       ad_len += 3;
+                       ptr += 3;
+               }
        }
 
-       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
-               ptr[0] = 2;
+       if (instance) {
+               memcpy(ptr, hdev->adv_instance.adv_data,
+                      hdev->adv_instance.adv_data_len);
+
+               ad_len += hdev->adv_instance.adv_data_len;
+               ptr += hdev->adv_instance.adv_data_len;
+       }
+
+       /* Provide Tx Power only if we can provide a valid value for it */
+       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
+           (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
+               ptr[0] = 0x02;
                ptr[1] = EIR_TX_POWER;
-               ptr[2] = (u8) hdev->adv_tx_power;
+               ptr[2] = (u8)hdev->adv_tx_power;
 
                ad_len += 3;
                ptr += 3;
@@ -885,19 +1065,20 @@ static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
        return ad_len;
 }
 
-static void update_adv_data(struct hci_request *req)
+static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
 {
        struct hci_dev *hdev = req->hdev;
        struct hci_cp_le_set_adv_data cp;
        u8 len;
 
-       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
                return;
 
        memset(&cp, 0, sizeof(cp));
 
-       len = create_adv_data(hdev, cp.data);
+       len = create_instance_adv_data(hdev, instance, cp.data);
 
+       /* There's nothing to do if the data hasn't changed */
        if (hdev->adv_data_len == len &&
            memcmp(cp.data, hdev->adv_data, len) == 0)
                return;
@@ -910,6 +1091,14 @@ static void update_adv_data(struct hci_request *req)
        hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 }
 
+static void update_adv_data(struct hci_request *req)
+{
+       struct hci_dev *hdev = req->hdev;
+       u8 instance = get_current_adv_instance(hdev);
+
+       update_adv_data_for_instance(req, instance);
+}
+
 int mgmt_update_adv_data(struct hci_dev *hdev)
 {
        struct hci_request req;
@@ -979,10 +1168,10 @@ static void update_eir(struct hci_request *req)
        if (!lmp_ext_inq_capable(hdev))
                return;
 
-       if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
                return;
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
                return;
 
        memset(&cp, 0, sizeof(cp));
@@ -1018,17 +1207,17 @@ static void update_class(struct hci_request *req)
        if (!hdev_is_powered(hdev))
                return;
 
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
                return;
 
-       if (test_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
                return;
 
        cod[0] = hdev->minor_class;
        cod[1] = hdev->major_class;
        cod[2] = get_service_classes(hdev);
 
-       if (test_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
                cod[1] |= 0x20;
 
        if (memcmp(cod, hdev->dev_class, 3) == 0)
@@ -1037,22 +1226,6 @@ static void update_class(struct hci_request *req)
        hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 }
 
-static bool get_connectable(struct hci_dev *hdev)
-{
-       struct pending_cmd *cmd;
-
-       /* If there's a pending mgmt command the flag will not yet have
-        * it's final value, so check for this first.
-        */
-       cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
-       if (cmd) {
-               struct mgmt_mode *cp = cmd->param;
-               return cp->val;
-       }
-
-       return test_bit(HCI_CONNECTABLE, &hdev->dev_flags);
-}
-
 static void disable_advertising(struct hci_request *req)
 {
        u8 enable = 0x00;
@@ -1066,11 +1239,13 @@ static void enable_advertising(struct hci_request *req)
        struct hci_cp_le_set_adv_param cp;
        u8 own_addr_type, enable = 0x01;
        bool connectable;
+       u8 instance;
+       u32 flags;
 
        if (hci_conn_num(hdev, LE_LINK) > 0)
                return;
 
-       if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_LE_ADV))
                disable_advertising(req);
 
        /* Clear the HCI_LE_ADV bit temporarily so that the
@@ -1078,9 +1253,16 @@ static void enable_advertising(struct hci_request *req)
         * and write a new random address. The flag will be set back on
         * as soon as the SET_ADV_ENABLE HCI command completes.
         */
-       clear_bit(HCI_LE_ADV, &hdev->dev_flags);
+       hci_dev_clear_flag(hdev, HCI_LE_ADV);
+
+       instance = get_current_adv_instance(hdev);
+       flags = get_adv_instance_flags(hdev, instance);
 
-       connectable = get_connectable(hdev);
+       /* If the "connectable" instance flag was not set, then choose between
+        * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
+        */
+       connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
+                     get_connectable(hdev);
 
        /* Set require_privacy to true only when non-connectable
         * advertising is used. In that case it is fine to use a
@@ -1092,7 +1274,14 @@ static void enable_advertising(struct hci_request *req)
        memset(&cp, 0, sizeof(cp));
        cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
        cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
-       cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
+
+       if (connectable)
+               cp.type = LE_ADV_IND;
+       else if (get_adv_instance_scan_rsp_len(hdev, instance))
+               cp.type = LE_ADV_SCAN_IND;
+       else
+               cp.type = LE_ADV_NONCONN_IND;
+
        cp.own_address_type = own_addr_type;
        cp.channel_map = hdev->le_adv_channel_map;
 
@@ -1107,7 +1296,7 @@ static void service_cache_off(struct work_struct *work)
                                            service_cache.work);
        struct hci_request req;
 
-       if (!test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
+       if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
                return;
 
        hci_req_init(&req, hdev);
@@ -1130,9 +1319,9 @@ static void rpa_expired(struct work_struct *work)
 
        BT_DBG("");
 
-       set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+       hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
 
-       if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
                return;
 
        /* The generation of a new RPA and programming it into the
@@ -1145,7 +1334,7 @@ static void rpa_expired(struct work_struct *work)
 
 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
 {
-       if (test_and_set_bit(HCI_MGMT, &hdev->dev_flags))
+       if (hci_dev_test_and_set_flag(hdev, HCI_MGMT))
                return;
 
        INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off);
@@ -1156,7 +1345,7 @@ static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev)
         * for mgmt we require user-space to explicitly enable
         * it
         */
-       clear_bit(HCI_BONDABLE, &hdev->dev_flags);
+       hci_dev_clear_flag(hdev, HCI_BONDABLE);
 }
 
 static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
@@ -1185,73 +1374,16 @@ static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
 
        hci_dev_unlock(hdev);
 
-       return cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
-                           sizeof(rp));
-}
-
-static void mgmt_pending_free(struct pending_cmd *cmd)
-{
-       sock_put(cmd->sk);
-       kfree(cmd->param);
-       kfree(cmd);
-}
-
-static struct pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
-                                           struct hci_dev *hdev, void *data,
-                                           u16 len)
-{
-       struct pending_cmd *cmd;
-
-       cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-       if (!cmd)
-               return NULL;
-
-       cmd->opcode = opcode;
-       cmd->index = hdev->id;
-
-       cmd->param = kmemdup(data, len, GFP_KERNEL);
-       if (!cmd->param) {
-               kfree(cmd);
-               return NULL;
-       }
-
-       cmd->param_len = len;
-
-       cmd->sk = sk;
-       sock_hold(sk);
-
-       list_add(&cmd->list, &hdev->mgmt_pending);
-
-       return cmd;
-}
-
-static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
-                                void (*cb)(struct pending_cmd *cmd,
-                                           void *data),
-                                void *data)
-{
-       struct pending_cmd *cmd, *tmp;
-
-       list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
-               if (opcode > 0 && cmd->opcode != opcode)
-                       continue;
-
-               cb(cmd, data);
-       }
-}
-
-static void mgmt_pending_remove(struct pending_cmd *cmd)
-{
-       list_del(&cmd->list);
-       mgmt_pending_free(cmd);
+       return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp,
+                                sizeof(rp));
 }
 
 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
        __le32 settings = cpu_to_le32(get_current_settings(hdev));
 
-       return cmd_complete(sk, hdev->id, opcode, 0, &settings,
-                           sizeof(settings));
+       return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings,
+                                sizeof(settings));
 }
 
 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode)
@@ -1272,9 +1404,10 @@ static bool hci_stop_discovery(struct hci_request *req)
 
        switch (hdev->discovery.state) {
        case DISCOVERY_FINDING:
-               if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+               if (test_bit(HCI_INQUIRY, &hdev->flags))
                        hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-               } else {
+
+               if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
                        cancel_delayed_work(&hdev->le_scan_disable);
                        hci_req_add_le_scan_disable(req);
                }
@@ -1295,7 +1428,7 @@ static bool hci_stop_discovery(struct hci_request *req)
 
        default:
                /* Passive scanning */
-               if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) {
+               if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
                        hci_req_add_le_scan_disable(req);
                        return true;
                }
@@ -1306,22 +1439,68 @@ static bool hci_stop_discovery(struct hci_request *req)
        return false;
 }
 
-static int clean_up_hci_state(struct hci_dev *hdev)
+static void advertising_added(struct sock *sk, struct hci_dev *hdev,
+                             u8 instance)
 {
-       struct hci_request req;
-       struct hci_conn *conn;
-       bool discov_stopped;
-       int err;
+       struct mgmt_ev_advertising_added ev;
 
-       hci_req_init(&req, hdev);
+       ev.instance = instance;
 
-       if (test_bit(HCI_ISCAN, &hdev->flags) ||
-           test_bit(HCI_PSCAN, &hdev->flags)) {
-               u8 scan = 0x00;
+       mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
+}
+
+static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
+                               u8 instance)
+{
+       struct mgmt_ev_advertising_removed ev;
+
+       ev.instance = instance;
+
+       mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
+}
+
+static void clear_adv_instance(struct hci_dev *hdev)
+{
+       struct hci_request req;
+
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               return;
+
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
+
+       memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
+       advertising_removed(NULL, hdev, 1);
+       hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
+
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               return;
+
+       hci_req_init(&req, hdev);
+       disable_advertising(&req);
+       hci_req_run(&req, NULL);
+}
+
+static int clean_up_hci_state(struct hci_dev *hdev)
+{
+       struct hci_request req;
+       struct hci_conn *conn;
+       bool discov_stopped;
+       int err;
+
+       hci_req_init(&req, hdev);
+
+       if (test_bit(HCI_ISCAN, &hdev->flags) ||
+           test_bit(HCI_PSCAN, &hdev->flags)) {
+               u8 scan = 0x00;
                hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
        }
 
-       if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
+       if (hdev->adv_instance.timeout)
+               clear_adv_instance(hdev);
+
+       if (hci_dev_test_flag(hdev, HCI_LE_ADV))
                disable_advertising(&req);
 
        discov_stopped = hci_stop_discovery(&req);
@@ -1369,24 +1548,24 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
                       u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        int err;
 
        BT_DBG("request for %s", hdev->name);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
-       if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
-       if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+       if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
                cancel_delayed_work(&hdev->power_off);
 
                if (cp->val) {
@@ -1433,11 +1612,10 @@ failed:
 
 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 {
-       __le32 ev;
+       __le32 ev = cpu_to_le32(get_current_settings(hdev));
 
-       ev = cpu_to_le32(get_current_settings(hdev));
-
-       return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
+       return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
+                                 sizeof(ev), skip);
 }
 
 int mgmt_new_settings(struct hci_dev *hdev)
@@ -1451,7 +1629,7 @@ struct cmd_lookup {
        u8 mgmt_status;
 };
 
-static void settings_rsp(struct pending_cmd *cmd, void *data)
+static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
        struct cmd_lookup *match = data;
 
@@ -1467,15 +1645,15 @@ static void settings_rsp(struct pending_cmd *cmd, void *data)
        mgmt_pending_free(cmd);
 }
 
-static void cmd_status_rsp(struct pending_cmd *cmd, void *data)
+static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
        u8 *status = data;
 
-       cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
+       mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status);
        mgmt_pending_remove(cmd);
 }
 
-static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
+static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
        if (cmd->cmd_complete) {
                u8 *status = data;
@@ -1489,23 +1667,23 @@ static void cmd_complete_rsp(struct pending_cmd *cmd, void *data)
        cmd_status_rsp(cmd, data);
 }
 
-static int generic_cmd_complete(struct pending_cmd *cmd, u8 status)
+static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
 {
-       return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
-                           cmd->param, cmd->param_len);
+       return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
+                                cmd->param, cmd->param_len);
 }
 
-static int addr_cmd_complete(struct pending_cmd *cmd, u8 status)
+static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
 {
-       return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, cmd->param,
-                           sizeof(struct mgmt_addr_info));
+       return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
+                                cmd->param, sizeof(struct mgmt_addr_info));
 }
 
 static u8 mgmt_bredr_support(struct hci_dev *hdev)
 {
        if (!lmp_bredr_capable(hdev))
                return MGMT_STATUS_NOT_SUPPORTED;
-       else if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+       else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
                return MGMT_STATUS_REJECTED;
        else
                return MGMT_STATUS_SUCCESS;
@@ -1515,7 +1693,7 @@ static u8 mgmt_le_support(struct hci_dev *hdev)
 {
        if (!lmp_le_capable(hdev))
                return MGMT_STATUS_NOT_SUPPORTED;
-       else if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+       else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
                return MGMT_STATUS_REJECTED;
        else
                return MGMT_STATUS_SUCCESS;
@@ -1524,7 +1702,7 @@ static u8 mgmt_le_support(struct hci_dev *hdev)
 static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
                                      u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct mgmt_mode *cp;
        struct hci_request req;
        bool changed;
@@ -1533,21 +1711,20 @@ static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
        if (!cmd)
                goto unlock;
 
        if (status) {
                u8 mgmt_err = mgmt_status(status);
-               cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
-               clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
+               hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
                goto remove_cmd;
        }
 
        cp = cmd->param;
        if (cp->val) {
-               changed = !test_and_set_bit(HCI_DISCOVERABLE,
-                                           &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_DISCOVERABLE);
 
                if (hdev->discov_timeout > 0) {
                        int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
@@ -1555,8 +1732,7 @@ static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
                                           to);
                }
        } else {
-               changed = test_and_clear_bit(HCI_DISCOVERABLE,
-                                            &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_DISCOVERABLE);
        }
 
        send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev);
@@ -1585,7 +1761,7 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                            u16 len)
 {
        struct mgmt_cp_set_discoverable *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        u16 timeout;
        u8 scan;
@@ -1593,14 +1769,14 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 
        BT_DBG("request for %s", hdev->name);
 
-       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
-           !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                 MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
+           !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                      MGMT_STATUS_REJECTED);
 
        if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        timeout = __le16_to_cpu(cp->timeout);
 
@@ -1609,27 +1785,27 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
         */
        if ((cp->val == 0x00 && timeout > 0) ||
            (cp->val == 0x02 && timeout == 0))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev) && timeout > 0) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                MGMT_STATUS_NOT_POWERED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                     MGMT_STATUS_NOT_POWERED);
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
+           pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
-       if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
-                                MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
+                                     MGMT_STATUS_REJECTED);
                goto failed;
        }
 
@@ -1640,8 +1816,8 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                 * not a valid operation since it requires a timeout
                 * and so no need to check HCI_LIMITED_DISCOVERABLE.
                 */
-               if (!!cp->val != test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) {
-                       change_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+               if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) {
+                       hci_dev_change_flag(hdev, HCI_DISCOVERABLE);
                        changed = true;
                }
 
@@ -1659,9 +1835,9 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
         * value with the new value. And if only the timeout gets updated,
         * then no need for any HCI transactions.
         */
-       if (!!cp->val == test_bit(HCI_DISCOVERABLE, &hdev->dev_flags) &&
-           (cp->val == 0x02) == test_bit(HCI_LIMITED_DISCOVERABLE,
-                                         &hdev->dev_flags)) {
+       if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
+           (cp->val == 0x02) == hci_dev_test_flag(hdev,
+                                                  HCI_LIMITED_DISCOVERABLE)) {
                cancel_delayed_work(&hdev->discov_off);
                hdev->discov_timeout = timeout;
 
@@ -1690,16 +1866,16 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 
        /* Limited discoverable mode */
        if (cp->val == 0x02)
-               set_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
+               hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE);
        else
-               clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
 
        hci_req_init(&req, hdev);
 
        /* The procedure for LE-only controllers is much simpler - just
         * update the advertising data.
         */
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
                goto update_ad;
 
        scan = SCAN_PAGE;
@@ -1729,7 +1905,7 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
 
                scan |= SCAN_INQUIRY;
        } else {
-               clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
        }
 
        hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
@@ -1752,7 +1928,7 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
        struct hci_cp_write_page_scan_activity acp;
        u8 type;
 
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
                return;
 
        if (hdev->hci_ver < BLUETOOTH_VER_1_2)
@@ -1784,7 +1960,7 @@ static void write_fast_connectable(struct hci_request *req, bool enable)
 static void set_connectable_complete(struct hci_dev *hdev, u8 status,
                                     u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct mgmt_mode *cp;
        bool conn_changed, discov_changed;
 
@@ -1792,26 +1968,26 @@ static void set_connectable_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
        if (!cmd)
                goto unlock;
 
        if (status) {
                u8 mgmt_err = mgmt_status(status);
-               cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
                goto remove_cmd;
        }
 
        cp = cmd->param;
        if (cp->val) {
-               conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
-                                                &hdev->dev_flags);
+               conn_changed = !hci_dev_test_and_set_flag(hdev,
+                                                         HCI_CONNECTABLE);
                discov_changed = false;
        } else {
-               conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
-                                                 &hdev->dev_flags);
-               discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
-                                                   &hdev->dev_flags);
+               conn_changed = hci_dev_test_and_clear_flag(hdev,
+                                                          HCI_CONNECTABLE);
+               discov_changed = hci_dev_test_and_clear_flag(hdev,
+                                                            HCI_DISCOVERABLE);
        }
 
        send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev);
@@ -1837,14 +2013,14 @@ static int set_connectable_update_settings(struct hci_dev *hdev,
        bool changed = false;
        int err;
 
-       if (!!val != test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
+       if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE))
                changed = true;
 
        if (val) {
-               set_bit(HCI_CONNECTABLE, &hdev->dev_flags);
+               hci_dev_set_flag(hdev, HCI_CONNECTABLE);
        } else {
-               clear_bit(HCI_CONNECTABLE, &hdev->dev_flags);
-               clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_CONNECTABLE);
+               hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
        }
 
        err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev);
@@ -1864,21 +2040,21 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                           u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        u8 scan;
        int err;
 
        BT_DBG("request for %s", hdev->name);
 
-       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
-           !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
-                                 MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
+           !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                      MGMT_STATUS_REJECTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
@@ -1887,10 +2063,10 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
+           pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
@@ -1906,10 +2082,10 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
         * by-product of disabling connectable, we need to update the
         * advertising flags.
         */
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
                if (!cp->val) {
-                       clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
-                       clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+                       hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
+                       hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
                }
                update_adv_data(&req);
        } else if (cp->val != test_bit(HCI_PSCAN, &hdev->flags)) {
@@ -1938,17 +2114,9 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
        }
 
 no_scan_update:
-       /* If we're going from non-connectable to connectable or
-        * vice-versa when fast connectable is enabled ensure that fast
-        * connectable gets disabled. write_fast_connectable won't do
-        * anything if the page scan parameters are already what they
-        * should be.
-        */
-       if (cp->val || test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags))
-               write_fast_connectable(&req, false);
-
        /* Update the advertising parameters if necessary */
-       if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                enable_advertising(&req);
 
        err = hci_req_run(&req, set_connectable_complete);
@@ -1975,15 +2143,15 @@ static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("request for %s", hdev->name);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        if (cp->val)
-               changed = !test_and_set_bit(HCI_BONDABLE, &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE);
        else
-               changed = test_and_clear_bit(HCI_BONDABLE, &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE);
 
        err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev);
        if (err < 0)
@@ -2001,7 +2169,7 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                             u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        u8 val, status;
        int err;
 
@@ -2009,21 +2177,20 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
 
        status = mgmt_bredr_support(hdev);
        if (status)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
-                                 status);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                      status);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
                bool changed = false;
 
-               if (!!cp->val != test_bit(HCI_LINK_SECURITY,
-                                         &hdev->dev_flags)) {
-                       change_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+               if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
+                       hci_dev_change_flag(hdev, HCI_LINK_SECURITY);
                        changed = true;
                }
 
@@ -2037,9 +2204,9 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
@@ -2070,7 +2237,7 @@ failed:
 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        u8 status;
        int err;
 
@@ -2078,15 +2245,15 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
        status = mgmt_bredr_support(hdev);
        if (status)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status);
 
        if (!lmp_ssp_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
@@ -2094,16 +2261,16 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                bool changed;
 
                if (cp->val) {
-                       changed = !test_and_set_bit(HCI_SSP_ENABLED,
-                                                   &hdev->dev_flags);
+                       changed = !hci_dev_test_and_set_flag(hdev,
+                                                            HCI_SSP_ENABLED);
                } else {
-                       changed = test_and_clear_bit(HCI_SSP_ENABLED,
-                                                    &hdev->dev_flags);
+                       changed = hci_dev_test_and_clear_flag(hdev,
+                                                             HCI_SSP_ENABLED);
                        if (!changed)
-                               changed = test_and_clear_bit(HCI_HS_ENABLED,
-                                                            &hdev->dev_flags);
+                               changed = hci_dev_test_and_clear_flag(hdev,
+                                                                     HCI_HS_ENABLED);
                        else
-                               clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+                               hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
                }
 
                err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
@@ -2116,14 +2283,13 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_HS, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_SSP, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
-       if (!!cp->val == test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+       if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
                err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
                goto failed;
        }
@@ -2134,7 +2300,7 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                goto failed;
        }
 
-       if (!cp->val && test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
+       if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
                hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
                             sizeof(cp->val), &cp->val);
 
@@ -2160,32 +2326,38 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
        status = mgmt_bredr_support(hdev);
        if (status)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
 
        if (!lmp_ssp_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
-       if (!test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-                                 MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                      MGMT_STATUS_REJECTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
+       if (pending_find(MGMT_OP_SET_SSP, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                     MGMT_STATUS_BUSY);
+               goto unlock;
+       }
+
        if (cp->val) {
-               changed = !test_and_set_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
        } else {
                if (hdev_is_powered(hdev)) {
-                       err = cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-                                        MGMT_STATUS_REJECTED);
+                       err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+                                             MGMT_STATUS_REJECTED);
                        goto unlock;
                }
 
-               changed = test_and_clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
        }
 
        err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
@@ -2226,7 +2398,7 @@ static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
         * has actually been enabled. During power on, the
         * update in powered_update_hci will take care of it.
         */
-       if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+       if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
                struct hci_request req;
 
                hci_req_init(&req, hdev);
@@ -2244,7 +2416,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
        struct mgmt_mode *cp = data;
        struct hci_cp_write_le_host_supported hci_cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
        u8 val, enabled;
@@ -2252,17 +2424,29 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
-       /* LE-only devices do not allow toggling LE on/off */
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                 MGMT_STATUS_REJECTED);
+       /* Bluetooth single mode LE only controllers or dual-mode
+        * controllers configured as LE only devices, do not allow
+        * switching LE off. These have either LE enabled explicitly
+        * or BR/EDR has been previously switched off.
+        *
+        * When trying to enable an already enabled LE, then gracefully
+        * send a positive response. Trying to disable it however will
+        * result into rejection.
+        */
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
+               if (cp->val == 0x01)
+                       return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
+
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                      MGMT_STATUS_REJECTED);
+       }
 
        hci_dev_lock(hdev);
 
@@ -2272,13 +2456,13 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        if (!hdev_is_powered(hdev) || val == enabled) {
                bool changed = false;
 
-               if (val != test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
-                       change_bit(HCI_LE_ENABLED, &hdev->dev_flags);
+               if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
+                       hci_dev_change_flag(hdev, HCI_LE_ENABLED);
                        changed = true;
                }
 
-               if (!val && test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
-                       clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+               if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+                       hci_dev_clear_flag(hdev, HCI_ADVERTISING);
                        changed = true;
                }
 
@@ -2292,10 +2476,10 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_LE, hdev) ||
+           pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
@@ -2313,7 +2497,7 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                hci_cp.le = val;
                hci_cp.simul = 0x00;
        } else {
-               if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
+               if (hci_dev_test_flag(hdev, HCI_LE_ADV))
                        disable_advertising(&req);
        }
 
@@ -2337,7 +2521,7 @@ unlock:
  */
 static bool pending_eir_or_class(struct hci_dev *hdev)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
                switch (cmd->opcode) {
@@ -2373,16 +2557,16 @@ static u8 get_uuid_size(const u8 *uuid)
 
 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(mgmt_op, hdev);
+       cmd = pending_find(mgmt_op, hdev);
        if (!cmd)
                goto unlock;
 
-       cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(status),
-                    hdev->dev_class, 3);
+       mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
+                         mgmt_status(status), hdev->dev_class, 3);
 
        mgmt_pending_remove(cmd);
 
@@ -2400,7 +2584,7 @@ static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
        struct mgmt_cp_add_uuid *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        struct bt_uuid *uuid;
        int err;
@@ -2410,8 +2594,8 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        hci_dev_lock(hdev);
 
        if (pending_eir_or_class(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
-                                MGMT_STATUS_BUSY);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
@@ -2437,8 +2621,8 @@ static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                if (err != -ENODATA)
                        goto failed;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
-                                  hdev->dev_class, 3);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0,
+                                       hdev->dev_class, 3);
                goto failed;
        }
 
@@ -2460,7 +2644,7 @@ static bool enable_service_cache(struct hci_dev *hdev)
        if (!hdev_is_powered(hdev))
                return false;
 
-       if (!test_and_set_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
+       if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) {
                queue_delayed_work(hdev->workqueue, &hdev->service_cache,
                                   CACHE_TIMEOUT);
                return true;
@@ -2480,7 +2664,7 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
                       u16 len)
 {
        struct mgmt_cp_remove_uuid *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct bt_uuid *match, *tmp;
        u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
        struct hci_request req;
@@ -2491,8 +2675,8 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (pending_eir_or_class(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
-                                MGMT_STATUS_BUSY);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
@@ -2500,8 +2684,9 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
                hci_uuids_clear(hdev);
 
                if (enable_service_cache(hdev)) {
-                       err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID,
-                                          0, hdev->dev_class, 3);
+                       err = mgmt_cmd_complete(sk, hdev->id,
+                                               MGMT_OP_REMOVE_UUID,
+                                               0, hdev->dev_class, 3);
                        goto unlock;
                }
 
@@ -2520,8 +2705,8 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
        }
 
        if (found == 0) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
-                                MGMT_STATUS_INVALID_PARAMS);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID,
+                                     MGMT_STATUS_INVALID_PARAMS);
                goto unlock;
        }
 
@@ -2536,8 +2721,8 @@ update_class:
                if (err != -ENODATA)
                        goto unlock;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
-                                  hdev->dev_class, 3);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0,
+                                       hdev->dev_class, 3);
                goto unlock;
        }
 
@@ -2565,27 +2750,27 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
                         u16 len)
 {
        struct mgmt_cp_set_dev_class *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_bredr_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        hci_dev_lock(hdev);
 
        if (pending_eir_or_class(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                MGMT_STATUS_BUSY);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
        if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
-                                MGMT_STATUS_INVALID_PARAMS);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS,
+                                     MGMT_STATUS_INVALID_PARAMS);
                goto unlock;
        }
 
@@ -2593,14 +2778,14 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
        hdev->minor_class = cp->minor;
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
-                                  hdev->dev_class, 3);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
+                                       hdev->dev_class, 3);
                goto unlock;
        }
 
        hci_req_init(&req, hdev);
 
-       if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags)) {
+       if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) {
                hci_dev_unlock(hdev);
                cancel_delayed_work_sync(&hdev->service_cache);
                hci_dev_lock(hdev);
@@ -2614,8 +2799,8 @@ static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data,
                if (err != -ENODATA)
                        goto unlock;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
-                                  hdev->dev_class, 3);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0,
+                                       hdev->dev_class, 3);
                goto unlock;
        }
 
@@ -2645,15 +2830,15 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_bredr_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        key_count = __le16_to_cpu(cp->key_count);
        if (key_count > max_key_count) {
                BT_ERR("load_link_keys: too big key_count value %u",
                       key_count);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        expected_len = sizeof(*cp) + key_count *
@@ -2661,13 +2846,13 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
        if (expected_len != len) {
                BT_ERR("load_link_keys: expected %u bytes, got %u bytes",
                       expected_len, len);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        BT_DBG("%s debug_keys %u key_count %u", hdev->name, cp->debug_keys,
               key_count);
@@ -2676,8 +2861,9 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                struct mgmt_link_key_info *key = &cp->keys[i];
 
                if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
-                       return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS,
-                                         MGMT_STATUS_INVALID_PARAMS);
+                       return mgmt_cmd_status(sk, hdev->id,
+                                              MGMT_OP_LOAD_LINK_KEYS,
+                                              MGMT_STATUS_INVALID_PARAMS);
        }
 
        hci_dev_lock(hdev);
@@ -2685,11 +2871,10 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_link_keys_clear(hdev);
 
        if (cp->debug_keys)
-               changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
-                                           &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
        else
-               changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
-                                            &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev,
+                                                     HCI_KEEP_DEBUG_KEYS);
 
        if (changed)
                new_settings(hdev, NULL);
@@ -2707,7 +2892,7 @@ static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data,
                                 key->type, key->pin_len, NULL);
        }
 
-       cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
+       mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0);
 
        hci_dev_unlock(hdev);
 
@@ -2732,7 +2917,7 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        struct mgmt_cp_unpair_device *cp = data;
        struct mgmt_rp_unpair_device rp;
        struct hci_cp_disconnect dc;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
        int err;
 
@@ -2741,20 +2926,21 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.addr.type = cp->addr.type;
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        if (cp->disconnect != 0x00 && cp->disconnect != 0x01)
-               return cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
-                                  MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                       MGMT_STATUS_NOT_POWERED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
@@ -2804,8 +2990,9 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        }
 
        if (err < 0) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
-                                  MGMT_STATUS_NOT_PAIRED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
+                                       MGMT_STATUS_NOT_PAIRED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
@@ -2813,8 +3000,8 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         * link is requested.
         */
        if (!conn) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
-                                  &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0,
+                                       &rp, sizeof(rp));
                device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk);
                goto unlock;
        }
@@ -2844,7 +3031,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
 {
        struct mgmt_cp_disconnect *cp = data;
        struct mgmt_rp_disconnect rp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
        int err;
 
@@ -2855,21 +3042,22 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.addr.type = cp->addr.type;
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        hci_dev_lock(hdev);
 
        if (!test_bit(HCI_UP, &hdev->flags)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                  MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                       MGMT_STATUS_NOT_POWERED, &rp,
+                                       sizeof(rp));
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                  MGMT_STATUS_BUSY, &rp, sizeof(rp));
+       if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                       MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto failed;
        }
 
@@ -2880,8 +3068,9 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
        if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
-                                  MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
+                                       MGMT_STATUS_NOT_CONNECTED, &rp,
+                                       sizeof(rp));
                goto failed;
        }
 
@@ -2935,8 +3124,8 @@ static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
-                                MGMT_STATUS_NOT_POWERED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS,
+                                     MGMT_STATUS_NOT_POWERED);
                goto unlock;
        }
 
@@ -2969,8 +3158,8 @@ static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data,
        /* Recalculate length in case of filtered SCO connections, etc */
        rp_len = sizeof(*rp) + (i * sizeof(struct mgmt_addr_info));
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
-                          rp_len);
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp,
+                               rp_len);
 
        kfree(rp);
 
@@ -2982,7 +3171,7 @@ unlock:
 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev,
                                   struct mgmt_cp_pin_code_neg_reply *cp)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        int err;
 
        cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp,
@@ -3004,7 +3193,7 @@ static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
        struct hci_conn *conn;
        struct mgmt_cp_pin_code_reply *cp = data;
        struct hci_cp_pin_code_reply reply;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        int err;
 
        BT_DBG("");
@@ -3012,15 +3201,15 @@ static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
-                                MGMT_STATUS_NOT_POWERED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                     MGMT_STATUS_NOT_POWERED);
                goto failed;
        }
 
        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr);
        if (!conn) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
-                                MGMT_STATUS_NOT_CONNECTED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                     MGMT_STATUS_NOT_CONNECTED);
                goto failed;
        }
 
@@ -3033,8 +3222,8 @@ static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data,
 
                err = send_pin_code_neg_reply(sk, hdev, &ncp);
                if (err >= 0)
-                       err = cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
-                                        MGMT_STATUS_INVALID_PARAMS);
+                       err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY,
+                                             MGMT_STATUS_INVALID_PARAMS);
 
                goto failed;
        }
@@ -3068,8 +3257,8 @@ static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("");
 
        if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY)
-               return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
-                                   MGMT_STATUS_INVALID_PARAMS, NULL, 0);
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY,
+                                        MGMT_STATUS_INVALID_PARAMS, NULL, 0);
 
        hci_dev_lock(hdev);
 
@@ -3080,14 +3269,14 @@ static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data,
 
        hci_dev_unlock(hdev);
 
-       return cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, NULL,
-                           0);
+       return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0,
+                                NULL, 0);
 }
 
-static struct pending_cmd *find_pairing(struct hci_conn *conn)
+static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn)
 {
        struct hci_dev *hdev = conn->hdev;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
                if (cmd->opcode != MGMT_OP_PAIR_DEVICE)
@@ -3102,7 +3291,7 @@ static struct pending_cmd *find_pairing(struct hci_conn *conn)
        return NULL;
 }
 
-static int pairing_complete(struct pending_cmd *cmd, u8 status)
+static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status)
 {
        struct mgmt_rp_pair_device rp;
        struct hci_conn *conn = cmd->user_data;
@@ -3111,8 +3300,8 @@ static int pairing_complete(struct pending_cmd *cmd, u8 status)
        bacpy(&rp.addr.bdaddr, &conn->dst);
        rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type);
 
-       err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, status,
-                          &rp, sizeof(rp));
+       err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE,
+                               status, &rp, sizeof(rp));
 
        /* So we don't get further callbacks for this connection */
        conn->connect_cfm_cb = NULL;
@@ -3134,7 +3323,7 @@ static int pairing_complete(struct pending_cmd *cmd, u8 status)
 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
 {
        u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        cmd = find_pairing(conn);
        if (cmd) {
@@ -3145,7 +3334,7 @@ void mgmt_smp_complete(struct hci_conn *conn, bool complete)
 
 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status %u", status);
 
@@ -3161,7 +3350,7 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
 
 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status %u", status);
 
@@ -3183,7 +3372,7 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 {
        struct mgmt_cp_pair_device *cp = data;
        struct mgmt_rp_pair_device rp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        u8 sec_level, auth_type;
        struct hci_conn *conn;
        int err;
@@ -3195,20 +3384,28 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.addr.type = cp->addr.type;
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY)
-               return cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                  MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                       MGMT_STATUS_NOT_POWERED, &rp,
+                                       sizeof(rp));
+               goto unlock;
+       }
+
+       if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) {
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                       MGMT_STATUS_ALREADY_PAIRED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
@@ -3249,19 +3446,22 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 
                if (PTR_ERR(conn) == -EBUSY)
                        status = MGMT_STATUS_BUSY;
+               else if (PTR_ERR(conn) == -EOPNOTSUPP)
+                       status = MGMT_STATUS_NOT_SUPPORTED;
+               else if (PTR_ERR(conn) == -ECONNREFUSED)
+                       status = MGMT_STATUS_REJECTED;
                else
                        status = MGMT_STATUS_CONNECT_FAILED;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                  status, &rp,
-                                  sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                       status, &rp, sizeof(rp));
                goto unlock;
        }
 
        if (conn->connect_cfm_cb) {
                hci_conn_drop(conn);
-               err = cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
-                                  MGMT_STATUS_BUSY, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE,
+                                       MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto unlock;
        }
 
@@ -3305,7 +3505,7 @@ static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                              u16 len)
 {
        struct mgmt_addr_info *addr = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
        int err;
 
@@ -3314,31 +3514,31 @@ static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
-                                MGMT_STATUS_NOT_POWERED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                     MGMT_STATUS_NOT_POWERED);
                goto unlock;
        }
 
-       cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
        if (!cmd) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
-                                MGMT_STATUS_INVALID_PARAMS);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                     MGMT_STATUS_INVALID_PARAMS);
                goto unlock;
        }
 
        conn = cmd->user_data;
 
        if (bacmp(&addr->bdaddr, &conn->dst) != 0) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
-                                MGMT_STATUS_INVALID_PARAMS);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
+                                     MGMT_STATUS_INVALID_PARAMS);
                goto unlock;
        }
 
        cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
        mgmt_pending_remove(cmd);
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
-                          addr, sizeof(*addr));
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
+                               addr, sizeof(*addr));
 unlock:
        hci_dev_unlock(hdev);
        return err;
@@ -3348,16 +3548,16 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
                             struct mgmt_addr_info *addr, u16 mgmt_op,
                             u16 hci_op, __le32 passkey)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
        int err;
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, mgmt_op,
-                                  MGMT_STATUS_NOT_POWERED, addr,
-                                  sizeof(*addr));
+               err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
+                                       MGMT_STATUS_NOT_POWERED, addr,
+                                       sizeof(*addr));
                goto done;
        }
 
@@ -3367,22 +3567,22 @@ static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev,
                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &addr->bdaddr);
 
        if (!conn) {
-               err = cmd_complete(sk, hdev->id, mgmt_op,
-                                  MGMT_STATUS_NOT_CONNECTED, addr,
-                                  sizeof(*addr));
+               err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
+                                       MGMT_STATUS_NOT_CONNECTED, addr,
+                                       sizeof(*addr));
                goto done;
        }
 
        if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) {
                err = smp_user_confirm_reply(conn, mgmt_op, passkey);
                if (!err)
-                       err = cmd_complete(sk, hdev->id, mgmt_op,
-                                          MGMT_STATUS_SUCCESS, addr,
-                                          sizeof(*addr));
+                       err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
+                                               MGMT_STATUS_SUCCESS, addr,
+                                               sizeof(*addr));
                else
-                       err = cmd_complete(sk, hdev->id, mgmt_op,
-                                          MGMT_STATUS_FAILED, addr,
-                                          sizeof(*addr));
+                       err = mgmt_cmd_complete(sk, hdev->id, mgmt_op,
+                                               MGMT_STATUS_FAILED, addr,
+                                               sizeof(*addr));
 
                goto done;
        }
@@ -3434,8 +3634,8 @@ static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("");
 
        if (len != sizeof(*cp))
-               return cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        return user_pairing_resp(sk, hdev, &cp->addr,
                                 MGMT_OP_USER_CONFIRM_REPLY,
@@ -3491,24 +3691,24 @@ static void update_name(struct hci_request *req)
 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
        struct mgmt_cp_set_local_name *cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status 0x%02x", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
+       cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
        if (!cmd)
                goto unlock;
 
        cp = cmd->param;
 
        if (status)
-               cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
-                          mgmt_status(status));
+               mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
+                               mgmt_status(status));
        else
-               cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
-                            cp, sizeof(*cp));
+               mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                                 cp, sizeof(*cp));
 
        mgmt_pending_remove(cmd);
 
@@ -3520,7 +3720,7 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
                          u16 len)
 {
        struct mgmt_cp_set_local_name *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
@@ -3534,8 +3734,8 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
        if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) &&
            !memcmp(hdev->short_name, cp->short_name,
                    sizeof(hdev->short_name))) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
-                                  data, len);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                                       data, len);
                goto failed;
        }
 
@@ -3544,13 +3744,13 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
        if (!hdev_is_powered(hdev)) {
                memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name));
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
-                                  data, len);
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0,
+                                       data, len);
                if (err < 0)
                        goto failed;
 
-               err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
-                                sk);
+               err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
+                                        data, len, sk);
 
                goto failed;
        }
@@ -3585,10 +3785,70 @@ failed:
        return err;
 }
 
+static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
+                                        u16 opcode, struct sk_buff *skb)
+{
+       struct mgmt_rp_read_local_oob_data mgmt_rp;
+       size_t rp_size = sizeof(mgmt_rp);
+       struct mgmt_pending_cmd *cmd;
+
+       BT_DBG("%s status %u", hdev->name, status);
+
+       cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
+       if (!cmd)
+               return;
+
+       if (status || !skb) {
+               mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                               status ? mgmt_status(status) : MGMT_STATUS_FAILED);
+               goto remove;
+       }
+
+       memset(&mgmt_rp, 0, sizeof(mgmt_rp));
+
+       if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
+               struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
+
+               if (skb->len < sizeof(*rp)) {
+                       mgmt_cmd_status(cmd->sk, hdev->id,
+                                       MGMT_OP_READ_LOCAL_OOB_DATA,
+                                       MGMT_STATUS_FAILED);
+                       goto remove;
+               }
+
+               memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
+               memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
+
+               rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
+       } else {
+               struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
+
+               if (skb->len < sizeof(*rp)) {
+                       mgmt_cmd_status(cmd->sk, hdev->id,
+                                       MGMT_OP_READ_LOCAL_OOB_DATA,
+                                       MGMT_STATUS_FAILED);
+                       goto remove;
+               }
+
+               memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
+               memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
+
+               memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
+               memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
+       }
+
+       mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                         MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
+
+remove:
+       mgmt_pending_remove(cmd);
+}
+
 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                               void *data, u16 data_len)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
        int err;
 
        BT_DBG("%s", hdev->name);
@@ -3596,20 +3856,20 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                MGMT_STATUS_NOT_POWERED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                     MGMT_STATUS_NOT_POWERED);
                goto unlock;
        }
 
        if (!lmp_ssp_capable(hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                MGMT_STATUS_NOT_SUPPORTED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                     MGMT_STATUS_NOT_SUPPORTED);
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
@@ -3619,12 +3879,14 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                goto unlock;
        }
 
+       hci_req_init(&req, hdev);
+
        if (bredr_sc_enabled(hdev))
-               err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
-                                  0, NULL);
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
        else
-               err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
 
+       err = hci_req_run_skb(&req, read_local_oob_data_complete);
        if (err < 0)
                mgmt_pending_remove(cmd);
 
@@ -3642,9 +3904,10 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("%s ", hdev->name);
 
        if (!bdaddr_type_is_valid(addr->type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_INVALID_PARAMS, addr,
-                                   sizeof(*addr));
+               return mgmt_cmd_complete(sk, hdev->id,
+                                        MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        addr, sizeof(*addr));
 
        hci_dev_lock(hdev);
 
@@ -3653,10 +3916,10 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                u8 status;
 
                if (cp->addr.type != BDADDR_BREDR) {
-                       err = cmd_complete(sk, hdev->id,
-                                          MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                          MGMT_STATUS_INVALID_PARAMS,
-                                          &cp->addr, sizeof(cp->addr));
+                       err = mgmt_cmd_complete(sk, hdev->id,
+                                               MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                               MGMT_STATUS_INVALID_PARAMS,
+                                               &cp->addr, sizeof(cp->addr));
                        goto unlock;
                }
 
@@ -3668,8 +3931,9 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                else
                        status = MGMT_STATUS_SUCCESS;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                  status, &cp->addr, sizeof(cp->addr));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_ADD_REMOTE_OOB_DATA, status,
+                                       &cp->addr, sizeof(cp->addr));
        } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) {
                struct mgmt_cp_add_remote_oob_ext_data *cp = data;
                u8 *rand192, *hash192, *rand256, *hash256;
@@ -3681,10 +3945,10 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                         */
                        if (memcmp(cp->rand192, ZERO_KEY, 16) ||
                            memcmp(cp->hash192, ZERO_KEY, 16)) {
-                               err = cmd_complete(sk, hdev->id,
-                                                  MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                                  MGMT_STATUS_INVALID_PARAMS,
-                                                  addr, sizeof(*addr));
+                               err = mgmt_cmd_complete(sk, hdev->id,
+                                                       MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                                       MGMT_STATUS_INVALID_PARAMS,
+                                                       addr, sizeof(*addr));
                                goto unlock;
                        }
 
@@ -3724,12 +3988,13 @@ static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                else
                        status = MGMT_STATUS_SUCCESS;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                  status, &cp->addr, sizeof(cp->addr));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                       status, &cp->addr, sizeof(cp->addr));
        } else {
                BT_ERR("add_remote_oob_data: invalid length of %u bytes", len);
-               err = cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
-                                MGMT_STATUS_INVALID_PARAMS);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA,
+                                     MGMT_STATUS_INVALID_PARAMS);
        }
 
 unlock:
@@ -3747,9 +4012,10 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("%s", hdev->name);
 
        if (cp->addr.type != BDADDR_BREDR)
-               return cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &cp->addr, sizeof(cp->addr));
+               return mgmt_cmd_complete(sk, hdev->id,
+                                        MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
@@ -3766,100 +4032,136 @@ static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev,
                status = MGMT_STATUS_SUCCESS;
 
 done:
-       err = cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
-                          status, &cp->addr, sizeof(cp->addr));
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA,
+                               status, &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
        return err;
 }
 
-static bool trigger_discovery(struct hci_request *req, u8 *status)
+static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
 {
        struct hci_dev *hdev = req->hdev;
-       struct hci_cp_le_set_scan_param param_cp;
-       struct hci_cp_le_set_scan_enable enable_cp;
-       struct hci_cp_inquiry inq_cp;
+       struct hci_cp_inquiry cp;
        /* General inquiry access code (GIAC) */
        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+
+       *status = mgmt_bredr_support(hdev);
+       if (*status)
+               return false;
+
+       if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
+               *status = MGMT_STATUS_BUSY;
+               return false;
+       }
+
+       hci_inquiry_cache_flush(hdev);
+
+       memset(&cp, 0, sizeof(cp));
+       memcpy(&cp.lap, lap, sizeof(cp.lap));
+       cp.length = DISCOV_BREDR_INQUIRY_LEN;
+
+       hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
+
+       return true;
+}
+
+static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
+{
+       struct hci_dev *hdev = req->hdev;
+       struct hci_cp_le_set_scan_param param_cp;
+       struct hci_cp_le_set_scan_enable enable_cp;
        u8 own_addr_type;
        int err;
 
-       switch (hdev->discovery.type) {
-       case DISCOV_TYPE_BREDR:
-               *status = mgmt_bredr_support(hdev);
-               if (*status)
-                       return false;
+       *status = mgmt_le_support(hdev);
+       if (*status)
+               return false;
 
-               if (test_bit(HCI_INQUIRY, &hdev->flags)) {
-                       *status = MGMT_STATUS_BUSY;
+       if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
+               /* Don't let discovery abort an outgoing connection attempt
+                * that's using directed advertising.
+                */
+               if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
+                       *status = MGMT_STATUS_REJECTED;
                        return false;
                }
 
-               hci_inquiry_cache_flush(hdev);
+               disable_advertising(req);
+       }
 
-               memset(&inq_cp, 0, sizeof(inq_cp));
-               memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
-               inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
-               hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
-               break;
+       /* If controller is scanning, it means the background scanning is
+        * running. Thus, we should temporarily stop it in order to set the
+        * discovery scanning parameters.
+        */
+       if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
+               hci_req_add_le_scan_disable(req);
 
-       case DISCOV_TYPE_LE:
-       case DISCOV_TYPE_INTERLEAVED:
-               *status = mgmt_le_support(hdev);
-               if (*status)
-                       return false;
+       /* All active scans will be done with either a resolvable private
+        * address (when privacy feature has been enabled) or non-resolvable
+        * private address.
+        */
+       err = hci_update_random_address(req, true, &own_addr_type);
+       if (err < 0) {
+               *status = MGMT_STATUS_FAILED;
+               return false;
+       }
 
-               if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-                   !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
-                       *status = MGMT_STATUS_NOT_SUPPORTED;
+       memset(&param_cp, 0, sizeof(param_cp));
+       param_cp.type = LE_SCAN_ACTIVE;
+       param_cp.interval = cpu_to_le16(interval);
+       param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
+       param_cp.own_address_type = own_addr_type;
+
+       hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
+                   &param_cp);
+
+       memset(&enable_cp, 0, sizeof(enable_cp));
+       enable_cp.enable = LE_SCAN_ENABLE;
+       enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+
+       hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
+                   &enable_cp);
+
+       return true;
+}
+
+static bool trigger_discovery(struct hci_request *req, u8 *status)
+{
+       struct hci_dev *hdev = req->hdev;
+
+       switch (hdev->discovery.type) {
+       case DISCOV_TYPE_BREDR:
+               if (!trigger_bredr_inquiry(req, status))
                        return false;
-               }
+               break;
 
-               if (test_bit(HCI_LE_ADV, &hdev->dev_flags)) {
-                       /* Don't let discovery abort an outgoing
-                        * connection attempt that's using directed
-                        * advertising.
+       case DISCOV_TYPE_INTERLEAVED:
+               if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
+                            &hdev->quirks)) {
+                       /* During simultaneous discovery, we double LE scan
+                        * interval. We must leave some time for the controller
+                        * to do BR/EDR inquiry.
                         */
-                       if (hci_conn_hash_lookup_state(hdev, LE_LINK,
-                                                      BT_CONNECT)) {
-                               *status = MGMT_STATUS_REJECTED;
+                       if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
+                                            status))
                                return false;
-                       }
 
-                       disable_advertising(req);
-               }
-
-               /* If controller is scanning, it means the background scanning
-                * is running. Thus, we should temporarily stop it in order to
-                * set the discovery scanning parameters.
-                */
-               if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
-                       hci_req_add_le_scan_disable(req);
+                       if (!trigger_bredr_inquiry(req, status))
+                               return false;
 
-               memset(&param_cp, 0, sizeof(param_cp));
+                       return true;
+               }
 
-               /* All active scans will be done with either a resolvable
-                * private address (when privacy feature has been enabled)
-                * or non-resolvable private address.
-                */
-               err = hci_update_random_address(req, true, &own_addr_type);
-               if (err < 0) {
-                       *status = MGMT_STATUS_FAILED;
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
+                       *status = MGMT_STATUS_NOT_SUPPORTED;
                        return false;
                }
+               /* fall through */
 
-               param_cp.type = LE_SCAN_ACTIVE;
-               param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
-               param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
-               param_cp.own_address_type = own_addr_type;
-               hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
-                           &param_cp);
-
-               memset(&enable_cp, 0, sizeof(enable_cp));
-               enable_cp.enable = LE_SCAN_ENABLE;
-               enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
-               hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
-                           &enable_cp);
+       case DISCOV_TYPE_LE:
+               if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
+                       return false;
                break;
 
        default:
@@ -3873,16 +4175,16 @@ static bool trigger_discovery(struct hci_request *req, u8 *status)
 static void start_discovery_complete(struct hci_dev *hdev, u8 status,
                                     u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        unsigned long timeout;
 
        BT_DBG("status %d", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
+       cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
        if (!cmd)
-               cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
+               cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
 
        if (cmd) {
                cmd->cmd_complete(cmd, mgmt_status(status));
@@ -3904,7 +4206,18 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status,
                timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
                break;
        case DISCOV_TYPE_INTERLEAVED:
-               timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
+                /* When running simultaneous discovery, the LE scanning time
+                * should occupy the whole discovery time sine BR/EDR inquiry
+                * and LE scanning are scheduled by the controller.
+                *
+                * For interleaving discovery in comparison, BR/EDR inquiry
+                * and LE scanning are done sequentially with separate
+                * timeouts.
+                */
+               if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
+                       timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
+               else
+                       timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
                break;
        case DISCOV_TYPE_BREDR:
                timeout = 0;
@@ -3923,8 +4236,7 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status,
                 */
                if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
                             &hdev->quirks) &&
-                   (hdev->discovery.uuid_count > 0 ||
-                    hdev->discovery.rssi != HCI_RSSI_INVALID)) {
+                   hdev->discovery.result_filtering) {
                        hdev->discovery.scan_start = jiffies;
                        hdev->discovery.scan_duration = timeout;
                }
@@ -3941,7 +4253,7 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
                           void *data, u16 len)
 {
        struct mgmt_cp_start_discovery *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        u8 status;
        int err;
@@ -3951,17 +4263,17 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                  MGMT_STATUS_NOT_POWERED,
-                                  &cp->type, sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                       MGMT_STATUS_NOT_POWERED,
+                                       &cp->type, sizeof(cp->type));
                goto failed;
        }
 
        if (hdev->discovery.state != DISCOVERY_STOPPED ||
-           test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                  MGMT_STATUS_BUSY, &cp->type,
-                                  sizeof(cp->type));
+           hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                       MGMT_STATUS_BUSY, &cp->type,
+                                       sizeof(cp->type));
                goto failed;
        }
 
@@ -3984,8 +4296,8 @@ static int start_discovery(struct sock *sk, struct hci_dev *hdev,
        hci_req_init(&req, hdev);
 
        if (!trigger_discovery(&req, &status)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
-                                  status, &cp->type, sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_START_DISCOVERY,
+                                       status, &cp->type, sizeof(cp->type));
                mgmt_pending_remove(cmd);
                goto failed;
        }
@@ -4003,17 +4315,18 @@ failed:
        return err;
 }
 
-static int service_discovery_cmd_complete(struct pending_cmd *cmd, u8 status)
+static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd,
+                                         u8 status)
 {
-       return cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
-                           cmd->param, 1);
+       return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status,
+                                cmd->param, 1);
 }
 
 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
                                   void *data, u16 len)
 {
        struct mgmt_cp_start_service_discovery *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16);
        u16 uuid_count, expected_len;
@@ -4025,19 +4338,19 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id,
-                                  MGMT_OP_START_SERVICE_DISCOVERY,
-                                  MGMT_STATUS_NOT_POWERED,
-                                  &cp->type, sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_START_SERVICE_DISCOVERY,
+                                       MGMT_STATUS_NOT_POWERED,
+                                       &cp->type, sizeof(cp->type));
                goto failed;
        }
 
        if (hdev->discovery.state != DISCOVERY_STOPPED ||
-           test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags)) {
-               err = cmd_complete(sk, hdev->id,
-                                  MGMT_OP_START_SERVICE_DISCOVERY,
-                                  MGMT_STATUS_BUSY, &cp->type,
-                                  sizeof(cp->type));
+           hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) {
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_START_SERVICE_DISCOVERY,
+                                       MGMT_STATUS_BUSY, &cp->type,
+                                       sizeof(cp->type));
                goto failed;
        }
 
@@ -4045,10 +4358,10 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
        if (uuid_count > max_uuid_count) {
                BT_ERR("service_discovery: too big uuid_count value %u",
                       uuid_count);
-               err = cmd_complete(sk, hdev->id,
-                                  MGMT_OP_START_SERVICE_DISCOVERY,
-                                  MGMT_STATUS_INVALID_PARAMS, &cp->type,
-                                  sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_START_SERVICE_DISCOVERY,
+                                       MGMT_STATUS_INVALID_PARAMS, &cp->type,
+                                       sizeof(cp->type));
                goto failed;
        }
 
@@ -4056,10 +4369,10 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
        if (expected_len != len) {
                BT_ERR("service_discovery: expected %u bytes, got %u bytes",
                       expected_len, len);
-               err = cmd_complete(sk, hdev->id,
-                                  MGMT_OP_START_SERVICE_DISCOVERY,
-                                  MGMT_STATUS_INVALID_PARAMS, &cp->type,
-                                  sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_START_SERVICE_DISCOVERY,
+                                       MGMT_STATUS_INVALID_PARAMS, &cp->type,
+                                       sizeof(cp->type));
                goto failed;
        }
 
@@ -4077,6 +4390,7 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
         */
        hci_discovery_filter_clear(hdev);
 
+       hdev->discovery.result_filtering = true;
        hdev->discovery.type = cp->type;
        hdev->discovery.rssi = cp->rssi;
        hdev->discovery.uuid_count = uuid_count;
@@ -4085,10 +4399,10 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
                hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16,
                                                GFP_KERNEL);
                if (!hdev->discovery.uuids) {
-                       err = cmd_complete(sk, hdev->id,
-                                          MGMT_OP_START_SERVICE_DISCOVERY,
-                                          MGMT_STATUS_FAILED,
-                                          &cp->type, sizeof(cp->type));
+                       err = mgmt_cmd_complete(sk, hdev->id,
+                                               MGMT_OP_START_SERVICE_DISCOVERY,
+                                               MGMT_STATUS_FAILED,
+                                               &cp->type, sizeof(cp->type));
                        mgmt_pending_remove(cmd);
                        goto failed;
                }
@@ -4097,9 +4411,9 @@ static int start_service_discovery(struct sock *sk, struct hci_dev *hdev,
        hci_req_init(&req, hdev);
 
        if (!trigger_discovery(&req, &status)) {
-               err = cmd_complete(sk, hdev->id,
-                                  MGMT_OP_START_SERVICE_DISCOVERY,
-                                  status, &cp->type, sizeof(cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_START_SERVICE_DISCOVERY,
+                                       status, &cp->type, sizeof(cp->type));
                mgmt_pending_remove(cmd);
                goto failed;
        }
@@ -4119,13 +4433,13 @@ failed:
 
 static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status %d", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
+       cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
        if (cmd) {
                cmd->cmd_complete(cmd, mgmt_status(status));
                mgmt_pending_remove(cmd);
@@ -4141,7 +4455,7 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
                          u16 len)
 {
        struct mgmt_cp_stop_discovery *mgmt_cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
@@ -4150,16 +4464,16 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (!hci_discovery_active(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
-                                  MGMT_STATUS_REJECTED, &mgmt_cp->type,
-                                  sizeof(mgmt_cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                       MGMT_STATUS_REJECTED, &mgmt_cp->type,
+                                       sizeof(mgmt_cp->type));
                goto unlock;
        }
 
        if (hdev->discovery.type != mgmt_cp->type) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
-                                  MGMT_STATUS_INVALID_PARAMS, &mgmt_cp->type,
-                                  sizeof(mgmt_cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY,
+                                       MGMT_STATUS_INVALID_PARAMS,
+                                       &mgmt_cp->type, sizeof(mgmt_cp->type));
                goto unlock;
        }
 
@@ -4185,8 +4499,8 @@ static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data,
 
        /* If no HCI commands were sent we're done */
        if (err == -ENODATA) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
-                                  &mgmt_cp->type, sizeof(mgmt_cp->type));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 0,
+                                       &mgmt_cp->type, sizeof(mgmt_cp->type));
                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
        }
 
@@ -4207,17 +4521,17 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
        hci_dev_lock(hdev);
 
        if (!hci_discovery_active(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
-                                  MGMT_STATUS_FAILED, &cp->addr,
-                                  sizeof(cp->addr));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                       MGMT_STATUS_FAILED, &cp->addr,
+                                       sizeof(cp->addr));
                goto failed;
        }
 
        e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr);
        if (!e) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
-                                  MGMT_STATUS_INVALID_PARAMS, &cp->addr,
-                                  sizeof(cp->addr));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME,
+                                       MGMT_STATUS_INVALID_PARAMS, &cp->addr,
+                                       sizeof(cp->addr));
                goto failed;
        }
 
@@ -4229,8 +4543,8 @@ static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data,
                hci_inquiry_cache_update_resolve(hdev, e);
        }
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, &cp->addr,
-                          sizeof(cp->addr));
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0,
+                               &cp->addr, sizeof(cp->addr));
 
 failed:
        hci_dev_unlock(hdev);
@@ -4247,9 +4561,9 @@ static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("%s", hdev->name);
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &cp->addr, sizeof(cp->addr));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
@@ -4265,8 +4579,8 @@ static int block_device(struct sock *sk, struct hci_dev *hdev, void *data,
        status = MGMT_STATUS_SUCCESS;
 
 done:
-       err = cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
-                          &cp->addr, sizeof(cp->addr));
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status,
+                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
 
@@ -4283,9 +4597,9 @@ static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
        BT_DBG("%s", hdev->name);
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &cp->addr, sizeof(cp->addr));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &cp->addr, sizeof(cp->addr));
 
        hci_dev_lock(hdev);
 
@@ -4301,8 +4615,8 @@ static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data,
        status = MGMT_STATUS_SUCCESS;
 
 done:
-       err = cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
-                          &cp->addr, sizeof(cp->addr));
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status,
+                               &cp->addr, sizeof(cp->addr));
 
        hci_dev_unlock(hdev);
 
@@ -4322,8 +4636,8 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
        source = __le16_to_cpu(cp->source);
 
        if (source > 0x0002)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
@@ -4332,7 +4646,8 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
        hdev->devid_product = __le16_to_cpu(cp->product);
        hdev->devid_version = __le16_to_cpu(cp->version);
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, NULL, 0);
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0,
+                               NULL, 0);
 
        hci_req_init(&req, hdev);
        update_eir(&req);
@@ -4343,10 +4658,17 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
        return err;
 }
 
+static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
+                                       u16 opcode)
+{
+       BT_DBG("status %d", status);
+}
+
 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
                                     u16 opcode)
 {
        struct cmd_lookup match = { NULL, hdev };
+       struct hci_request req;
 
        hci_dev_lock(hdev);
 
@@ -4358,10 +4680,10 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status,
                goto unlock;
        }
 
-       if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
-               set_bit(HCI_ADVERTISING, &hdev->dev_flags);
+       if (hci_dev_test_flag(hdev, HCI_LE_ADV))
+               hci_dev_set_flag(hdev, HCI_ADVERTISING);
        else
-               clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_ADVERTISING);
 
        mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp,
                             &match);
@@ -4371,6 +4693,21 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status,
        if (match.sk)
                sock_put(match.sk);
 
+       /* If "Set Advertising" was just disabled and instance advertising was
+        * set up earlier, then enable the advertising instance.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               goto unlock;
+
+       hci_req_init(&req, hdev);
+
+       update_adv_data(&req);
+       enable_advertising(&req);
+
+       if (hci_req_run(&req, enable_advertising_instance) < 0)
+               BT_ERR("Failed to re-configure advertising");
+
 unlock:
        hci_dev_unlock(hdev);
 }
@@ -4379,41 +4716,48 @@ static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
                           u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
-       u8 val, enabled, status;
+       u8 val, status;
        int err;
 
        BT_DBG("request for %s", hdev->name);
 
        status = mgmt_le_support(hdev);
        if (status)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
-                                 status);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                      status);
 
-       if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
-                                 MGMT_STATUS_INVALID_PARAMS);
+       if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        val = !!cp->val;
-       enabled = test_bit(HCI_ADVERTISING, &hdev->dev_flags);
 
        /* The following conditions are ones which mean that we should
         * not do any HCI communication but directly send a mgmt
         * response to user space (after toggling the flag if
         * necessary).
         */
-       if (!hdev_is_powered(hdev) || val == enabled ||
+       if (!hdev_is_powered(hdev) ||
+           (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
+            (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) ||
            hci_conn_num(hdev, LE_LINK) > 0 ||
-           (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
+           (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
             hdev->le_scan_type == LE_SCAN_ACTIVE)) {
-               bool changed = false;
+               bool changed;
 
-               if (val != test_bit(HCI_ADVERTISING, &hdev->dev_flags)) {
-                       change_bit(HCI_ADVERTISING, &hdev->dev_flags);
-                       changed = true;
+               if (cp->val) {
+                       changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING);
+                       if (cp->val == 0x02)
+                               hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
+                       else
+                               hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
+               } else {
+                       changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING);
+                       hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
                }
 
                err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev);
@@ -4426,10 +4770,10 @@ static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
@@ -4441,10 +4785,19 @@ static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
 
        hci_req_init(&req, hdev);
 
-       if (val)
-               enable_advertising(&req);
+       if (cp->val == 0x02)
+               hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
        else
+               hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
+
+       if (val) {
+               /* Switch to instance "0" for the Set Advertising setting. */
+               update_adv_data_for_instance(&req, 0);
+               update_scan_rsp_data_for_instance(&req, 0);
+               enable_advertising(&req);
+       } else {
                disable_advertising(&req);
+       }
 
        err = hci_req_run(&req, set_advertising_complete);
        if (err < 0)
@@ -4464,34 +4817,38 @@ static int set_static_address(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("%s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        if (hdev_is_powered(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
-                                 MGMT_STATUS_REJECTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS,
+                                      MGMT_STATUS_REJECTED);
 
        if (bacmp(&cp->bdaddr, BDADDR_ANY)) {
                if (!bacmp(&cp->bdaddr, BDADDR_NONE))
-                       return cmd_status(sk, hdev->id,
-                                         MGMT_OP_SET_STATIC_ADDRESS,
-                                         MGMT_STATUS_INVALID_PARAMS);
+                       return mgmt_cmd_status(sk, hdev->id,
+                                              MGMT_OP_SET_STATIC_ADDRESS,
+                                              MGMT_STATUS_INVALID_PARAMS);
 
                /* Two most significant bits shall be set */
                if ((cp->bdaddr.b[5] & 0xc0) != 0xc0)
-                       return cmd_status(sk, hdev->id,
-                                         MGMT_OP_SET_STATIC_ADDRESS,
-                                         MGMT_STATUS_INVALID_PARAMS);
+                       return mgmt_cmd_status(sk, hdev->id,
+                                              MGMT_OP_SET_STATIC_ADDRESS,
+                                              MGMT_STATUS_INVALID_PARAMS);
        }
 
        hci_dev_lock(hdev);
 
        bacpy(&hdev->static_addr, &cp->bdaddr);
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 0, NULL, 0);
+       err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev);
+       if (err < 0)
+               goto unlock;
+
+       err = new_settings(hdev, sk);
 
+unlock:
        hci_dev_unlock(hdev);
-
        return err;
 }
 
@@ -4505,36 +4862,37 @@ static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("%s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        interval = __le16_to_cpu(cp->interval);
 
        if (interval < 0x0004 || interval > 0x4000)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        window = __le16_to_cpu(cp->window);
 
        if (window < 0x0004 || window > 0x4000)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        if (window > interval)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        hdev->le_scan_interval = interval;
        hdev->le_scan_window = window;
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, NULL, 0);
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0,
+                               NULL, 0);
 
        /* If background scan is running, restart it so new parameters are
         * loaded.
         */
-       if (test_bit(HCI_LE_SCAN, &hdev->dev_flags) &&
+       if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
            hdev->discovery.state == DISCOVERY_STOPPED) {
                struct hci_request req;
 
@@ -4554,26 +4912,26 @@ static int set_scan_params(struct sock *sk, struct hci_dev *hdev,
 static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
                                      u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status 0x%02x", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
        if (!cmd)
                goto unlock;
 
        if (status) {
-               cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                          mgmt_status(status));
+               mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                               mgmt_status(status));
        } else {
                struct mgmt_mode *cp = cmd->param;
 
                if (cp->val)
-                       set_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
+                       hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE);
                else
-                       clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
+                       hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
 
                send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev);
                new_settings(hdev, cmd->sk);
@@ -4589,40 +4947,40 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
                                void *data, u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
        BT_DBG("%s", hdev->name);
 
-       if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) ||
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) ||
            hdev->hci_ver < BLUETOOTH_VER_1_2)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                 MGMT_STATUS_INVALID_PARAMS);
-
-       if (!hdev_is_powered(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                 MGMT_STATUS_NOT_POWERED);
-
-       if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                 MGMT_STATUS_REJECTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
-       if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                     MGMT_STATUS_BUSY);
+               goto unlock;
+       }
+
+       if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) {
+               err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
+                                       hdev);
                goto unlock;
        }
 
-       if (!!cp->val == test_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags)) {
+       if (!hdev_is_powered(hdev)) {
+               hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE);
                err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE,
                                        hdev);
+               new_settings(hdev, sk);
                goto unlock;
        }
 
@@ -4639,8 +4997,8 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
 
        err = hci_req_run(&req, fast_connectable_complete);
        if (err < 0) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
-                                MGMT_STATUS_FAILED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
+                                     MGMT_STATUS_FAILED);
                mgmt_pending_remove(cmd);
        }
 
@@ -4652,13 +5010,13 @@ unlock:
 
 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status 0x%02x", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
+       cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
        if (!cmd)
                goto unlock;
 
@@ -4668,9 +5026,9 @@ static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
                /* We need to restore the flag if related HCI commands
                 * failed.
                 */
-               clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
 
-               cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err);
        } else {
                send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev);
                new_settings(hdev, cmd->sk);
@@ -4685,41 +5043,41 @@ unlock:
 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
-       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                 MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                      MGMT_STATUS_REJECTED);
 
        if (cp->val != 0x00 && cp->val != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
-       if (cp->val == test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+       if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
                err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
                goto unlock;
        }
 
        if (!hdev_is_powered(hdev)) {
                if (!cp->val) {
-                       clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
-                       clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
-                       clear_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
-                       clear_bit(HCI_FAST_CONNECTABLE, &hdev->dev_flags);
-                       clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+                       hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
+                       hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
+                       hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
+                       hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
+                       hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
                }
 
-               change_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+               hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
 
                err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev);
                if (err < 0)
@@ -4731,8 +5089,8 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
        /* Reject disabling when powered on */
        if (!cp->val) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                MGMT_STATUS_REJECTED);
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                     MGMT_STATUS_REJECTED);
                goto unlock;
        } else {
                /* When configuring a dual-mode controller to operate
@@ -4749,18 +5107,18 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                 * switching BR/EDR back on when secure connections has been
                 * enabled is not a supported transaction.
                 */
-               if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
                    (bacmp(&hdev->static_addr, BDADDR_ANY) ||
-                    test_bit(HCI_SC_ENABLED, &hdev->dev_flags))) {
-                       err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                        MGMT_STATUS_REJECTED);
+                    hci_dev_test_flag(hdev, HCI_SC_ENABLED))) {
+                       err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                             MGMT_STATUS_REJECTED);
                        goto unlock;
                }
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
        }
 
@@ -4773,7 +5131,7 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
        /* We need to flip the bit already here so that update_adv_data
         * generates the correct flags.
         */
-       set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
+       hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
 
        hci_req_init(&req, hdev);
 
@@ -4796,20 +5154,20 @@ unlock:
 
 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct mgmt_mode *cp;
 
        BT_DBG("%s status %u", hdev->name, status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
+       cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
        if (!cmd)
                goto unlock;
 
        if (status) {
-               cmd_status(cmd->sk, cmd->index, cmd->opcode,
-                          mgmt_status(status));
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
+                               mgmt_status(status));
                goto remove;
        }
 
@@ -4817,16 +5175,16 @@ static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        switch (cp->val) {
        case 0x00:
-               clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
-               clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
+               hci_dev_clear_flag(hdev, HCI_SC_ONLY);
                break;
        case 0x01:
-               set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
-               clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+               hci_dev_set_flag(hdev, HCI_SC_ENABLED);
+               hci_dev_clear_flag(hdev, HCI_SC_ONLY);
                break;
        case 0x02:
-               set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
-               set_bit(HCI_SC_ONLY, &hdev->dev_flags);
+               hci_dev_set_flag(hdev, HCI_SC_ENABLED);
+               hci_dev_set_flag(hdev, HCI_SC_ONLY);
                break;
        }
 
@@ -4843,7 +5201,7 @@ static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
                           void *data, u16 len)
 {
        struct mgmt_mode *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        u8 val;
        int err;
@@ -4851,37 +5209,37 @@ static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_sc_capable(hdev) &&
-           !test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+           !hci_dev_test_flag(hdev, HCI_LE_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
-       if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
+       if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
            lmp_sc_capable(hdev) &&
-           !test_bit(HCI_SSP_ENABLED, &hdev->dev_flags))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
-                                 MGMT_STATUS_REJECTED);
+           !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                      MGMT_STATUS_REJECTED);
 
        if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
                                  MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) ||
-           !test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+           !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
                bool changed;
 
                if (cp->val) {
-                       changed = !test_and_set_bit(HCI_SC_ENABLED,
-                                                   &hdev->dev_flags);
+                       changed = !hci_dev_test_and_set_flag(hdev,
+                                                            HCI_SC_ENABLED);
                        if (cp->val == 0x02)
-                               set_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                               hci_dev_set_flag(hdev, HCI_SC_ONLY);
                        else
-                               clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                               hci_dev_clear_flag(hdev, HCI_SC_ONLY);
                } else {
-                       changed = test_and_clear_bit(HCI_SC_ENABLED,
-                                                    &hdev->dev_flags);
-                       clear_bit(HCI_SC_ONLY, &hdev->dev_flags);
+                       changed = hci_dev_test_and_clear_flag(hdev,
+                                                             HCI_SC_ENABLED);
+                       hci_dev_clear_flag(hdev, HCI_SC_ONLY);
                }
 
                err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
@@ -4894,16 +5252,16 @@ static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
-               err = cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
-                                MGMT_STATUS_BUSY);
+       if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
+                                     MGMT_STATUS_BUSY);
                goto failed;
        }
 
        val = !!cp->val;
 
-       if (val == test_bit(HCI_SC_ENABLED, &hdev->dev_flags) &&
-           (cp->val == 0x02) == test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
+       if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
+           (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
                err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev);
                goto failed;
        }
@@ -4937,27 +5295,26 @@ static int set_debug_keys(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("request for %s", hdev->name);
 
        if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
        if (cp->val)
-               changed = !test_and_set_bit(HCI_KEEP_DEBUG_KEYS,
-                                           &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS);
        else
-               changed = test_and_clear_bit(HCI_KEEP_DEBUG_KEYS,
-                                            &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev,
+                                                     HCI_KEEP_DEBUG_KEYS);
 
        if (cp->val == 0x02)
-               use_changed = !test_and_set_bit(HCI_USE_DEBUG_KEYS,
-                                               &hdev->dev_flags);
+               use_changed = !hci_dev_test_and_set_flag(hdev,
+                                                        HCI_USE_DEBUG_KEYS);
        else
-               use_changed = test_and_clear_bit(HCI_USE_DEBUG_KEYS,
-                                                &hdev->dev_flags);
+               use_changed = hci_dev_test_and_clear_flag(hdev,
+                                                         HCI_USE_DEBUG_KEYS);
 
        if (hdev_is_powered(hdev) && use_changed &&
-           test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+           hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
                u8 mode = (cp->val == 0x02) ? 0x01 : 0x00;
                hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
                             sizeof(mode), &mode);
@@ -4985,32 +5342,32 @@ static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data,
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        if (cp->privacy != 0x00 && cp->privacy != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        if (hdev_is_powered(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
-                                 MGMT_STATUS_REJECTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY,
+                                      MGMT_STATUS_REJECTED);
 
        hci_dev_lock(hdev);
 
        /* If user space supports this command it is also expected to
         * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag.
         */
-       set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
+       hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
 
        if (cp->privacy) {
-               changed = !test_and_set_bit(HCI_PRIVACY, &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY);
                memcpy(hdev->irk, cp->irk, sizeof(hdev->irk));
-               set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+               hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
        } else {
-               changed = test_and_clear_bit(HCI_PRIVACY, &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY);
                memset(hdev->irk, 0, sizeof(hdev->irk));
-               clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
+               hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
        }
 
        err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev);
@@ -5053,22 +5410,22 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        irk_count = __le16_to_cpu(cp->irk_count);
        if (irk_count > max_irk_count) {
                BT_ERR("load_irks: too big irk_count value %u", irk_count);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        expected_len = sizeof(*cp) + irk_count * sizeof(struct mgmt_irk_info);
        if (expected_len != len) {
                BT_ERR("load_irks: expected %u bytes, got %u bytes",
                       expected_len, len);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        BT_DBG("%s irk_count %u", hdev->name, irk_count);
@@ -5077,9 +5434,9 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
                struct mgmt_irk_info *key = &cp->irks[i];
 
                if (!irk_is_valid(key))
-                       return cmd_status(sk, hdev->id,
-                                         MGMT_OP_LOAD_IRKS,
-                                         MGMT_STATUS_INVALID_PARAMS);
+                       return mgmt_cmd_status(sk, hdev->id,
+                                              MGMT_OP_LOAD_IRKS,
+                                              MGMT_STATUS_INVALID_PARAMS);
        }
 
        hci_dev_lock(hdev);
@@ -5099,9 +5456,9 @@ static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data,
                            BDADDR_ANY);
        }
 
-       set_bit(HCI_RPA_RESOLVING, &hdev->dev_flags);
+       hci_dev_set_flag(hdev, HCI_RPA_RESOLVING);
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0);
 
        hci_dev_unlock(hdev);
 
@@ -5139,14 +5496,14 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
        BT_DBG("request for %s", hdev->name);
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        key_count = __le16_to_cpu(cp->key_count);
        if (key_count > max_key_count) {
                BT_ERR("load_ltks: too big key_count value %u", key_count);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        expected_len = sizeof(*cp) + key_count *
@@ -5154,8 +5511,8 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
        if (expected_len != len) {
                BT_ERR("load_keys: expected %u bytes, got %u bytes",
                       expected_len, len);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        BT_DBG("%s key_count %u", hdev->name, key_count);
@@ -5164,9 +5521,9 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                struct mgmt_ltk_info *key = &cp->keys[i];
 
                if (!ltk_is_valid(key))
-                       return cmd_status(sk, hdev->id,
-                                         MGMT_OP_LOAD_LONG_TERM_KEYS,
-                                         MGMT_STATUS_INVALID_PARAMS);
+                       return mgmt_cmd_status(sk, hdev->id,
+                                              MGMT_OP_LOAD_LONG_TERM_KEYS,
+                                              MGMT_STATUS_INVALID_PARAMS);
        }
 
        hci_dev_lock(hdev);
@@ -5211,7 +5568,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
                            key->rand);
        }
 
-       err = cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0,
                           NULL, 0);
 
        hci_dev_unlock(hdev);
@@ -5219,7 +5576,7 @@ static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev,
        return err;
 }
 
-static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
+static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
 {
        struct hci_conn *conn = cmd->user_data;
        struct mgmt_rp_get_conn_info rp;
@@ -5237,8 +5594,8 @@ static int conn_info_cmd_complete(struct pending_cmd *cmd, u8 status)
                rp.max_tx_power = HCI_TX_POWER_INVALID;
        }
 
-       err = cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status,
-                          &rp, sizeof(rp));
+       err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO,
+                               status, &rp, sizeof(rp));
 
        hci_conn_drop(conn);
        hci_conn_put(conn);
@@ -5250,7 +5607,7 @@ static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
                                       u16 opcode)
 {
        struct hci_cp_read_rssi *cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
        u16 handle;
        u8 status;
@@ -5288,7 +5645,7 @@ static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
                goto unlock;
        }
 
-       cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
+       cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
        if (!cmd)
                goto unlock;
 
@@ -5315,15 +5672,16 @@ static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.addr.type = cp->addr.type;
 
        if (!bdaddr_type_is_valid(cp->addr.type))
-               return cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
-                                  MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                       MGMT_STATUS_NOT_POWERED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
@@ -5334,14 +5692,15 @@ static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
                conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
 
        if (!conn || conn->state != BT_CONNECTED) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
-                                  MGMT_STATUS_NOT_CONNECTED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                       MGMT_STATUS_NOT_CONNECTED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
-       if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
-                                  MGMT_STATUS_BUSY, &rp, sizeof(rp));
+       if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                       MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto unlock;
        }
 
@@ -5361,7 +5720,7 @@ static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
                struct hci_request req;
                struct hci_cp_read_tx_power req_txp_cp;
                struct hci_cp_read_rssi req_rssi_cp;
-               struct pending_cmd *cmd;
+               struct mgmt_pending_cmd *cmd;
 
                hci_req_init(&req, hdev);
                req_rssi_cp.handle = cpu_to_le16(conn->handle);
@@ -5409,8 +5768,8 @@ static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
                rp.tx_power = conn->tx_power;
                rp.max_tx_power = conn->max_tx_power;
 
-               err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
-                                  MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
+                                       MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
        }
 
 unlock:
@@ -5418,7 +5777,7 @@ unlock:
        return err;
 }
 
-static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
+static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status)
 {
        struct hci_conn *conn = cmd->user_data;
        struct mgmt_rp_get_clock_info rp;
@@ -5443,8 +5802,8 @@ static int clock_info_cmd_complete(struct pending_cmd *cmd, u8 status)
        }
 
 complete:
-       err = cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
-                          sizeof(rp));
+       err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp,
+                               sizeof(rp));
 
        if (conn) {
                hci_conn_drop(conn);
@@ -5457,7 +5816,7 @@ complete:
 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
        struct hci_cp_read_clock *hci_cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_conn *conn;
 
        BT_DBG("%s status %u", hdev->name, status);
@@ -5475,7 +5834,7 @@ static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
                conn = NULL;
        }
 
-       cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
+       cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
        if (!cmd)
                goto unlock;
 
@@ -5492,7 +5851,7 @@ static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
        struct mgmt_cp_get_clock_info *cp = data;
        struct mgmt_rp_get_clock_info rp;
        struct hci_cp_read_clock hci_cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        struct hci_conn *conn;
        int err;
@@ -5504,15 +5863,16 @@ static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
        rp.addr.type = cp->addr.type;
 
        if (cp->addr.type != BDADDR_BREDR)
-               return cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &rp, sizeof(rp));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &rp, sizeof(rp));
 
        hci_dev_lock(hdev);
 
        if (!hdev_is_powered(hdev)) {
-               err = cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
-                                  MGMT_STATUS_NOT_POWERED, &rp, sizeof(rp));
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO,
+                                       MGMT_STATUS_NOT_POWERED, &rp,
+                                       sizeof(rp));
                goto unlock;
        }
 
@@ -5520,10 +5880,10 @@ static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data,
                conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
                                               &cp->addr.bdaddr);
                if (!conn || conn->state != BT_CONNECTED) {
-                       err = cmd_complete(sk, hdev->id,
-                                          MGMT_OP_GET_CLOCK_INFO,
-                                          MGMT_STATUS_NOT_CONNECTED,
-                                          &rp, sizeof(rp));
+                       err = mgmt_cmd_complete(sk, hdev->id,
+                                               MGMT_OP_GET_CLOCK_INFO,
+                                               MGMT_STATUS_NOT_CONNECTED,
+                                               &rp, sizeof(rp));
                        goto unlock;
                }
        } else {
@@ -5634,13 +5994,13 @@ static void device_added(struct sock *sk, struct hci_dev *hdev,
 
 static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status 0x%02x", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -5655,7 +6015,7 @@ static int add_device(struct sock *sk, struct hci_dev *hdev,
                      void *data, u16 len)
 {
        struct mgmt_cp_add_device *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        u8 auto_conn, addr_type;
        int err;
@@ -5664,14 +6024,14 @@ static int add_device(struct sock *sk, struct hci_dev *hdev,
 
        if (!bdaddr_type_is_valid(cp->addr.type) ||
            !bacmp(&cp->addr.bdaddr, BDADDR_ANY))
-               return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &cp->addr, sizeof(cp->addr));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &cp->addr, sizeof(cp->addr));
 
        if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02)
-               return cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
-                                   MGMT_STATUS_INVALID_PARAMS,
-                                   &cp->addr, sizeof(cp->addr));
+               return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE,
+                                        MGMT_STATUS_INVALID_PARAMS,
+                                        &cp->addr, sizeof(cp->addr));
 
        hci_req_init(&req, hdev);
 
@@ -5757,13 +6117,13 @@ static void device_removed(struct sock *sk, struct hci_dev *hdev,
 
 static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        BT_DBG("status 0x%02x", status);
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -5778,7 +6138,7 @@ static int remove_device(struct sock *sk, struct hci_dev *hdev,
                         void *data, u16 len)
 {
        struct mgmt_cp_remove_device *cp = data;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct hci_request req;
        int err;
 
@@ -5911,15 +6271,15 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
        int i;
 
        if (!lmp_le_capable(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
+                                      MGMT_STATUS_NOT_SUPPORTED);
 
        param_count = __le16_to_cpu(cp->param_count);
        if (param_count > max_param_count) {
                BT_ERR("load_conn_param: too big param_count value %u",
                       param_count);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        expected_len = sizeof(*cp) + param_count *
@@ -5927,8 +6287,8 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
        if (expected_len != len) {
                BT_ERR("load_conn_param: expected %u bytes, got %u bytes",
                       expected_len, len);
-               return cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
-                                 MGMT_STATUS_INVALID_PARAMS);
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM,
+                                      MGMT_STATUS_INVALID_PARAMS);
        }
 
        BT_DBG("%s param_count %u", hdev->name, param_count);
@@ -5981,328 +6341,966 @@ static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data,
                hci_param->supervision_timeout = timeout;
        }
 
-       hci_dev_unlock(hdev);
+       hci_dev_unlock(hdev);
+
+       return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0,
+                                NULL, 0);
+}
+
+static int set_external_config(struct sock *sk, struct hci_dev *hdev,
+                              void *data, u16 len)
+{
+       struct mgmt_cp_set_external_config *cp = data;
+       bool changed;
+       int err;
+
+       BT_DBG("%s", hdev->name);
+
+       if (hdev_is_powered(hdev))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
+                                      MGMT_STATUS_REJECTED);
+
+       if (cp->config != 0x00 && cp->config != 0x01)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
+                                        MGMT_STATUS_INVALID_PARAMS);
+
+       if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
+                                      MGMT_STATUS_NOT_SUPPORTED);
+
+       hci_dev_lock(hdev);
+
+       if (cp->config)
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED);
+       else
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED);
+
+       err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
+       if (err < 0)
+               goto unlock;
+
+       if (!changed)
+               goto unlock;
+
+       err = new_options(hdev, sk);
+
+       if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) {
+               mgmt_index_removed(hdev);
+
+               if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) {
+                       hci_dev_set_flag(hdev, HCI_CONFIG);
+                       hci_dev_set_flag(hdev, HCI_AUTO_OFF);
+
+                       queue_work(hdev->req_workqueue, &hdev->power_on);
+               } else {
+                       set_bit(HCI_RAW, &hdev->flags);
+                       mgmt_index_added(hdev);
+               }
+       }
+
+unlock:
+       hci_dev_unlock(hdev);
+       return err;
+}
+
+static int set_public_address(struct sock *sk, struct hci_dev *hdev,
+                             void *data, u16 len)
+{
+       struct mgmt_cp_set_public_address *cp = data;
+       bool changed;
+       int err;
+
+       BT_DBG("%s", hdev->name);
+
+       if (hdev_is_powered(hdev))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
+                                      MGMT_STATUS_REJECTED);
+
+       if (!bacmp(&cp->bdaddr, BDADDR_ANY))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
+                                      MGMT_STATUS_INVALID_PARAMS);
+
+       if (!hdev->set_bdaddr)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
+                                      MGMT_STATUS_NOT_SUPPORTED);
+
+       hci_dev_lock(hdev);
+
+       changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
+       bacpy(&hdev->public_addr, &cp->bdaddr);
+
+       err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
+       if (err < 0)
+               goto unlock;
+
+       if (!changed)
+               goto unlock;
+
+       if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
+               err = new_options(hdev, sk);
+
+       if (is_configured(hdev)) {
+               mgmt_index_removed(hdev);
+
+               hci_dev_clear_flag(hdev, HCI_UNCONFIGURED);
+
+               hci_dev_set_flag(hdev, HCI_CONFIG);
+               hci_dev_set_flag(hdev, HCI_AUTO_OFF);
+
+               queue_work(hdev->req_workqueue, &hdev->power_on);
+       }
+
+unlock:
+       hci_dev_unlock(hdev);
+       return err;
+}
+
+static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
+                                 u8 data_len)
+{
+       eir[eir_len++] = sizeof(type) + data_len;
+       eir[eir_len++] = type;
+       memcpy(&eir[eir_len], data, data_len);
+       eir_len += data_len;
+
+       return eir_len;
+}
+
+static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
+                                            u16 opcode, struct sk_buff *skb)
+{
+       const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
+       struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
+       u8 *h192, *r192, *h256, *r256;
+       struct mgmt_pending_cmd *cmd;
+       u16 eir_len;
+       int err;
+
+       BT_DBG("%s status %u", hdev->name, status);
+
+       cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
+       if (!cmd)
+               return;
+
+       mgmt_cp = cmd->param;
+
+       if (status) {
+               status = mgmt_status(status);
+               eir_len = 0;
+
+               h192 = NULL;
+               r192 = NULL;
+               h256 = NULL;
+               r256 = NULL;
+       } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
+               struct hci_rp_read_local_oob_data *rp;
+
+               if (skb->len != sizeof(*rp)) {
+                       status = MGMT_STATUS_FAILED;
+                       eir_len = 0;
+               } else {
+                       status = MGMT_STATUS_SUCCESS;
+                       rp = (void *)skb->data;
+
+                       eir_len = 5 + 18 + 18;
+                       h192 = rp->hash;
+                       r192 = rp->rand;
+                       h256 = NULL;
+                       r256 = NULL;
+               }
+       } else {
+               struct hci_rp_read_local_oob_ext_data *rp;
+
+               if (skb->len != sizeof(*rp)) {
+                       status = MGMT_STATUS_FAILED;
+                       eir_len = 0;
+               } else {
+                       status = MGMT_STATUS_SUCCESS;
+                       rp = (void *)skb->data;
+
+                       if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
+                               eir_len = 5 + 18 + 18;
+                               h192 = NULL;
+                               r192 = NULL;
+                       } else {
+                               eir_len = 5 + 18 + 18 + 18 + 18;
+                               h192 = rp->hash192;
+                               r192 = rp->rand192;
+                       }
+
+                       h256 = rp->hash256;
+                       r256 = rp->rand256;
+               }
+       }
+
+       mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
+       if (!mgmt_rp)
+               goto done;
+
+       if (status)
+               goto send_rsp;
+
+       eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
+                                 hdev->dev_class, 3);
+
+       if (h192 && r192) {
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_HASH_C192, h192, 16);
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_RAND_R192, r192, 16);
+       }
+
+       if (h256 && r256) {
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_HASH_C256, h256, 16);
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_RAND_R256, r256, 16);
+       }
+
+send_rsp:
+       mgmt_rp->type = mgmt_cp->type;
+       mgmt_rp->eir_len = cpu_to_le16(eir_len);
+
+       err = mgmt_cmd_complete(cmd->sk, hdev->id,
+                               MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
+                               mgmt_rp, sizeof(*mgmt_rp) + eir_len);
+       if (err < 0 || status)
+               goto done;
+
+       hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
+
+       err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
+                                mgmt_rp, sizeof(*mgmt_rp) + eir_len,
+                                HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
+done:
+       kfree(mgmt_rp);
+       mgmt_pending_remove(cmd);
+}
+
+static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
+                                 struct mgmt_cp_read_local_oob_ext_data *cp)
+{
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
+       int err;
+
+       cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
+                              cp, sizeof(*cp));
+       if (!cmd)
+               return -ENOMEM;
+
+       hci_req_init(&req, hdev);
+
+       if (bredr_sc_enabled(hdev))
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
+       else
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+
+       err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
+       if (err < 0) {
+               mgmt_pending_remove(cmd);
+               return err;
+       }
+
+       return 0;
+}
+
+static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
+                                  void *data, u16 data_len)
+{
+       struct mgmt_cp_read_local_oob_ext_data *cp = data;
+       struct mgmt_rp_read_local_oob_ext_data *rp;
+       size_t rp_len;
+       u16 eir_len;
+       u8 status, flags, role, addr[7], hash[16], rand[16];
+       int err;
+
+       BT_DBG("%s", hdev->name);
+
+       if (hdev_is_powered(hdev)) {
+               switch (cp->type) {
+               case BIT(BDADDR_BREDR):
+                       status = mgmt_bredr_support(hdev);
+                       if (status)
+                               eir_len = 0;
+                       else
+                               eir_len = 5;
+                       break;
+               case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
+                       status = mgmt_le_support(hdev);
+                       if (status)
+                               eir_len = 0;
+                       else
+                               eir_len = 9 + 3 + 18 + 18 + 3;
+                       break;
+               default:
+                       status = MGMT_STATUS_INVALID_PARAMS;
+                       eir_len = 0;
+                       break;
+               }
+       } else {
+               status = MGMT_STATUS_NOT_POWERED;
+               eir_len = 0;
+       }
+
+       rp_len = sizeof(*rp) + eir_len;
+       rp = kmalloc(rp_len, GFP_ATOMIC);
+       if (!rp)
+               return -ENOMEM;
+
+       if (status)
+               goto complete;
+
+       hci_dev_lock(hdev);
+
+       eir_len = 0;
+       switch (cp->type) {
+       case BIT(BDADDR_BREDR):
+               if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
+                       err = read_local_ssp_oob_req(hdev, sk, cp);
+                       hci_dev_unlock(hdev);
+                       if (!err)
+                               goto done;
+
+                       status = MGMT_STATUS_FAILED;
+                       goto complete;
+               } else {
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_CLASS_OF_DEV,
+                                                 hdev->dev_class, 3);
+               }
+               break;
+       case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
+               if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
+                   smp_generate_oob(hdev, hash, rand) < 0) {
+                       hci_dev_unlock(hdev);
+                       status = MGMT_STATUS_FAILED;
+                       goto complete;
+               }
+
+               /* This should return the active RPA, but since the RPA
+                * is only programmed on demand, it is really hard to fill
+                * this in at the moment. For now disallow retrieving
+                * local out-of-band data when privacy is in use.
+                *
+                * Returning the identity address will not help here since
+                * pairing happens before the identity resolving key is
+                * known and thus the connection establishment happens
+                * based on the RPA and not the identity address.
+                */
+               if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
+                       hci_dev_unlock(hdev);
+                       status = MGMT_STATUS_REJECTED;
+                       goto complete;
+               }
+
+               if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
+                  !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
+                  (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
+                   bacmp(&hdev->static_addr, BDADDR_ANY))) {
+                       memcpy(addr, &hdev->static_addr, 6);
+                       addr[6] = 0x01;
+               } else {
+                       memcpy(addr, &hdev->bdaddr, 6);
+                       addr[6] = 0x00;
+               }
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
+                                         addr, sizeof(addr));
+
+               if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+                       role = 0x02;
+               else
+                       role = 0x01;
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
+                                         &role, sizeof(role));
+
+               if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_LE_SC_CONFIRM,
+                                                 hash, sizeof(hash));
+
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_LE_SC_RANDOM,
+                                                 rand, sizeof(rand));
+               }
+
+               flags = get_adv_discov_flags(hdev);
+
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+                       flags |= LE_AD_NO_BREDR;
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
+                                         &flags, sizeof(flags));
+               break;
+       }
+
+       hci_dev_unlock(hdev);
+
+       hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
+
+       status = MGMT_STATUS_SUCCESS;
+
+complete:
+       rp->type = cp->type;
+       rp->eir_len = cpu_to_le16(eir_len);
+
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
+                               status, rp, sizeof(*rp) + eir_len);
+       if (err < 0 || status)
+               goto done;
+
+       err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
+                                rp, sizeof(*rp) + eir_len,
+                                HCI_MGMT_OOB_DATA_EVENTS, sk);
+
+done:
+       kfree(rp);
+
+       return err;
+}
+
+static u32 get_supported_adv_flags(struct hci_dev *hdev)
+{
+       u32 flags = 0;
+
+       flags |= MGMT_ADV_FLAG_CONNECTABLE;
+       flags |= MGMT_ADV_FLAG_DISCOV;
+       flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
+       flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
+               flags |= MGMT_ADV_FLAG_TX_POWER;
+
+       return flags;
+}
+
+static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
+                            void *data, u16 data_len)
+{
+       struct mgmt_rp_read_adv_features *rp;
+       size_t rp_len;
+       int err;
+       bool instance;
+       u32 supported_flags;
+
+       BT_DBG("%s", hdev->name);
+
+       if (!lmp_le_capable(hdev))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
+                                      MGMT_STATUS_REJECTED);
+
+       hci_dev_lock(hdev);
+
+       rp_len = sizeof(*rp);
+
+       /* Currently only one instance is supported, so just add 1 to the
+        * response length.
+        */
+       instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
+       if (instance)
+               rp_len++;
+
+       rp = kmalloc(rp_len, GFP_ATOMIC);
+       if (!rp) {
+               hci_dev_unlock(hdev);
+               return -ENOMEM;
+       }
+
+       supported_flags = get_supported_adv_flags(hdev);
+
+       rp->supported_flags = cpu_to_le32(supported_flags);
+       rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
+       rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
+       rp->max_instances = 1;
+
+       /* Currently only one instance is supported, so simply return the
+        * current instance number.
+        */
+       if (instance) {
+               rp->num_instances = 1;
+               rp->instance[0] = 1;
+       } else {
+               rp->num_instances = 0;
+       }
+
+       hci_dev_unlock(hdev);
+
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
+                               MGMT_STATUS_SUCCESS, rp, rp_len);
+
+       kfree(rp);
+
+       return err;
+}
+
+static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
+                             u8 len, bool is_adv_data)
+{
+       u8 max_len = HCI_MAX_AD_LENGTH;
+       int i, cur_len;
+       bool flags_managed = false;
+       bool tx_power_managed = false;
+       u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
+                          MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       if (is_adv_data && (adv_flags & flags_params)) {
+               flags_managed = true;
+               max_len -= 3;
+       }
+
+       if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
+               tx_power_managed = true;
+               max_len -= 3;
+       }
+
+       if (len > max_len)
+               return false;
+
+       /* Make sure that the data is correctly formatted. */
+       for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
+               cur_len = data[i];
+
+               if (flags_managed && data[i + 1] == EIR_FLAGS)
+                       return false;
+
+               if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
+                       return false;
+
+               /* If the current field length would exceed the total data
+                * length, then it's invalid.
+                */
+               if (i + cur_len >= len)
+                       return false;
+       }
+
+       return true;
+}
+
+static void add_advertising_complete(struct hci_dev *hdev, u8 status,
+                                    u16 opcode)
+{
+       struct mgmt_pending_cmd *cmd;
+       struct mgmt_rp_add_advertising rp;
+
+       BT_DBG("status %d", status);
+
+       hci_dev_lock(hdev);
+
+       cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
+
+       if (status) {
+               hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
+               memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
+               advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
+       }
+
+       if (!cmd)
+               goto unlock;
+
+       rp.instance = 0x01;
+
+       if (status)
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
+                               mgmt_status(status));
+       else
+               mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
+                                 mgmt_status(status), &rp, sizeof(rp));
+
+       mgmt_pending_remove(cmd);
+
+unlock:
+       hci_dev_unlock(hdev);
+}
+
+static void adv_timeout_expired(struct work_struct *work)
+{
+       struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                           adv_instance.timeout_exp.work);
+
+       hdev->adv_instance.timeout = 0;
 
-       return cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, NULL, 0);
+       hci_dev_lock(hdev);
+       clear_adv_instance(hdev);
+       hci_dev_unlock(hdev);
 }
 
-static int set_external_config(struct sock *sk, struct hci_dev *hdev,
-                              void *data, u16 len)
+static int add_advertising(struct sock *sk, struct hci_dev *hdev,
+                          void *data, u16 data_len)
 {
-       struct mgmt_cp_set_external_config *cp = data;
-       bool changed;
+       struct mgmt_cp_add_advertising *cp = data;
+       struct mgmt_rp_add_advertising rp;
+       u32 flags;
+       u32 supported_flags;
+       u8 status;
+       u16 timeout;
        int err;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
 
        BT_DBG("%s", hdev->name);
 
-       if (hdev_is_powered(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
-                                 MGMT_STATUS_REJECTED);
+       status = mgmt_le_support(hdev);
+       if (status)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                      status);
 
-       if (cp->config != 0x00 && cp->config != 0x01)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
-                                   MGMT_STATUS_INVALID_PARAMS);
+       flags = __le32_to_cpu(cp->flags);
+       timeout = __le16_to_cpu(cp->timeout);
 
-       if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+       /* The current implementation only supports adding one instance and only
+        * a subset of the specified flags.
+        */
+       supported_flags = get_supported_adv_flags(hdev);
+       if (cp->instance != 0x01 || (flags & ~supported_flags))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
        hci_dev_lock(hdev);
 
-       if (cp->config)
-               changed = !test_and_set_bit(HCI_EXT_CONFIGURED,
-                                           &hdev->dev_flags);
-       else
-               changed = test_and_clear_bit(HCI_EXT_CONFIGURED,
-                                            &hdev->dev_flags);
+       if (timeout && !hdev_is_powered(hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_REJECTED);
+               goto unlock;
+       }
 
-       err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev);
-       if (err < 0)
+       if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_BUSY);
                goto unlock;
+       }
 
-       if (!changed)
+       if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
+           !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
+                              cp->scan_rsp_len, false)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_INVALID_PARAMS);
                goto unlock;
+       }
 
-       err = new_options(hdev, sk);
+       INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
 
-       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) == is_configured(hdev)) {
-               mgmt_index_removed(hdev);
+       hdev->adv_instance.flags = flags;
+       hdev->adv_instance.adv_data_len = cp->adv_data_len;
+       hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
 
-               if (test_and_change_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
-                       set_bit(HCI_CONFIG, &hdev->dev_flags);
-                       set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+       if (cp->adv_data_len)
+               memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
 
-                       queue_work(hdev->req_workqueue, &hdev->power_on);
-               } else {
-                       set_bit(HCI_RAW, &hdev->flags);
-                       mgmt_index_added(hdev);
-               }
-       }
+       if (cp->scan_rsp_len)
+               memcpy(hdev->adv_instance.scan_rsp_data,
+                      cp->data + cp->adv_data_len, cp->scan_rsp_len);
 
-unlock:
-       hci_dev_unlock(hdev);
-       return err;
-}
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
 
-static int set_public_address(struct sock *sk, struct hci_dev *hdev,
-                             void *data, u16 len)
-{
-       struct mgmt_cp_set_public_address *cp = data;
-       bool changed;
-       int err;
+       hdev->adv_instance.timeout = timeout;
 
-       BT_DBG("%s", hdev->name);
+       if (timeout)
+               queue_delayed_work(hdev->workqueue,
+                                  &hdev->adv_instance.timeout_exp,
+                                  msecs_to_jiffies(timeout * 1000));
 
-       if (hdev_is_powered(hdev))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
-                                 MGMT_STATUS_REJECTED);
+       if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               advertising_added(sk, hdev, 1);
 
-       if (!bacmp(&cp->bdaddr, BDADDR_ANY))
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
-                                 MGMT_STATUS_INVALID_PARAMS);
+       /* If the HCI_ADVERTISING flag is set or the device isn't powered then
+        * we have no HCI communication to make. Simply return.
+        */
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+               rp.instance = 0x01;
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                       MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+               goto unlock;
+       }
 
-       if (!hdev->set_bdaddr)
-               return cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS,
-                                 MGMT_STATUS_NOT_SUPPORTED);
+       /* We're good to go, update advertising data, parameters, and start
+        * advertising.
+        */
+       cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
+                              data_len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto unlock;
+       }
 
-       hci_dev_lock(hdev);
+       hci_req_init(&req, hdev);
 
-       changed = !!bacmp(&hdev->public_addr, &cp->bdaddr);
-       bacpy(&hdev->public_addr, &cp->bdaddr);
+       update_adv_data(&req);
+       update_scan_rsp_data(&req);
+       enable_advertising(&req);
 
-       err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev);
+       err = hci_req_run(&req, add_advertising_complete);
        if (err < 0)
-               goto unlock;
+               mgmt_pending_remove(cmd);
 
-       if (!changed)
-               goto unlock;
+unlock:
+       hci_dev_unlock(hdev);
 
-       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
-               err = new_options(hdev, sk);
+       return err;
+}
 
-       if (is_configured(hdev)) {
-               mgmt_index_removed(hdev);
+static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
+                                       u16 opcode)
+{
+       struct mgmt_pending_cmd *cmd;
+       struct mgmt_rp_remove_advertising rp;
 
-               clear_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
+       BT_DBG("status %d", status);
 
-               set_bit(HCI_CONFIG, &hdev->dev_flags);
-               set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+       hci_dev_lock(hdev);
 
-               queue_work(hdev->req_workqueue, &hdev->power_on);
-       }
+       /* A failure status here only means that we failed to disable
+        * advertising. Otherwise, the advertising instance has been removed,
+        * so report success.
+        */
+       cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
+       if (!cmd)
+               goto unlock;
+
+       rp.instance = 1;
+
+       mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
+                         &rp, sizeof(rp));
+       mgmt_pending_remove(cmd);
 
 unlock:
        hci_dev_unlock(hdev);
-       return err;
 }
 
-static const struct mgmt_handler {
-       int (*func) (struct sock *sk, struct hci_dev *hdev, void *data,
-                    u16 data_len);
-       bool var_len;
-       size_t data_len;
-} mgmt_handlers[] = {
-       { NULL }, /* 0x0000 (no command) */
-       { read_version,           false, MGMT_READ_VERSION_SIZE },
-       { read_commands,          false, MGMT_READ_COMMANDS_SIZE },
-       { read_index_list,        false, MGMT_READ_INDEX_LIST_SIZE },
-       { read_controller_info,   false, MGMT_READ_INFO_SIZE },
-       { set_powered,            false, MGMT_SETTING_SIZE },
-       { set_discoverable,       false, MGMT_SET_DISCOVERABLE_SIZE },
-       { set_connectable,        false, MGMT_SETTING_SIZE },
-       { set_fast_connectable,   false, MGMT_SETTING_SIZE },
-       { set_bondable,           false, MGMT_SETTING_SIZE },
-       { set_link_security,      false, MGMT_SETTING_SIZE },
-       { set_ssp,                false, MGMT_SETTING_SIZE },
-       { set_hs,                 false, MGMT_SETTING_SIZE },
-       { set_le,                 false, MGMT_SETTING_SIZE },
-       { set_dev_class,          false, MGMT_SET_DEV_CLASS_SIZE },
-       { set_local_name,         false, MGMT_SET_LOCAL_NAME_SIZE },
-       { add_uuid,               false, MGMT_ADD_UUID_SIZE },
-       { remove_uuid,            false, MGMT_REMOVE_UUID_SIZE },
-       { load_link_keys,         true,  MGMT_LOAD_LINK_KEYS_SIZE },
-       { load_long_term_keys,    true,  MGMT_LOAD_LONG_TERM_KEYS_SIZE },
-       { disconnect,             false, MGMT_DISCONNECT_SIZE },
-       { get_connections,        false, MGMT_GET_CONNECTIONS_SIZE },
-       { pin_code_reply,         false, MGMT_PIN_CODE_REPLY_SIZE },
-       { pin_code_neg_reply,     false, MGMT_PIN_CODE_NEG_REPLY_SIZE },
-       { set_io_capability,      false, MGMT_SET_IO_CAPABILITY_SIZE },
-       { pair_device,            false, MGMT_PAIR_DEVICE_SIZE },
-       { cancel_pair_device,     false, MGMT_CANCEL_PAIR_DEVICE_SIZE },
-       { unpair_device,          false, MGMT_UNPAIR_DEVICE_SIZE },
-       { user_confirm_reply,     false, MGMT_USER_CONFIRM_REPLY_SIZE },
-       { user_confirm_neg_reply, false, MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
-       { user_passkey_reply,     false, MGMT_USER_PASSKEY_REPLY_SIZE },
-       { user_passkey_neg_reply, false, MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
-       { read_local_oob_data,    false, MGMT_READ_LOCAL_OOB_DATA_SIZE },
-       { add_remote_oob_data,    true,  MGMT_ADD_REMOTE_OOB_DATA_SIZE },
-       { remove_remote_oob_data, false, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
-       { start_discovery,        false, MGMT_START_DISCOVERY_SIZE },
-       { stop_discovery,         false, MGMT_STOP_DISCOVERY_SIZE },
-       { confirm_name,           false, MGMT_CONFIRM_NAME_SIZE },
-       { block_device,           false, MGMT_BLOCK_DEVICE_SIZE },
-       { unblock_device,         false, MGMT_UNBLOCK_DEVICE_SIZE },
-       { set_device_id,          false, MGMT_SET_DEVICE_ID_SIZE },
-       { set_advertising,        false, MGMT_SETTING_SIZE },
-       { set_bredr,              false, MGMT_SETTING_SIZE },
-       { set_static_address,     false, MGMT_SET_STATIC_ADDRESS_SIZE },
-       { set_scan_params,        false, MGMT_SET_SCAN_PARAMS_SIZE },
-       { set_secure_conn,        false, MGMT_SETTING_SIZE },
-       { set_debug_keys,         false, MGMT_SETTING_SIZE },
-       { set_privacy,            false, MGMT_SET_PRIVACY_SIZE },
-       { load_irks,              true,  MGMT_LOAD_IRKS_SIZE },
-       { get_conn_info,          false, MGMT_GET_CONN_INFO_SIZE },
-       { get_clock_info,         false, MGMT_GET_CLOCK_INFO_SIZE },
-       { add_device,             false, MGMT_ADD_DEVICE_SIZE },
-       { remove_device,          false, MGMT_REMOVE_DEVICE_SIZE },
-       { load_conn_param,        true,  MGMT_LOAD_CONN_PARAM_SIZE },
-       { read_unconf_index_list, false, MGMT_READ_UNCONF_INDEX_LIST_SIZE },
-       { read_config_info,       false, MGMT_READ_CONFIG_INFO_SIZE },
-       { set_external_config,    false, MGMT_SET_EXTERNAL_CONFIG_SIZE },
-       { set_public_address,     false, MGMT_SET_PUBLIC_ADDRESS_SIZE },
-       { start_service_discovery,true,  MGMT_START_SERVICE_DISCOVERY_SIZE },
-};
-
-int mgmt_control(struct sock *sk, struct msghdr *msg, size_t msglen)
+static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
+                             void *data, u16 data_len)
 {
-       void *buf;
-       u8 *cp;
-       struct mgmt_hdr *hdr;
-       u16 opcode, index, len;
-       struct hci_dev *hdev = NULL;
-       const struct mgmt_handler *handler;
+       struct mgmt_cp_remove_advertising *cp = data;
+       struct mgmt_rp_remove_advertising rp;
        int err;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
 
-       BT_DBG("got %zu bytes", msglen);
+       BT_DBG("%s", hdev->name);
 
-       if (msglen < sizeof(*hdr))
-               return -EINVAL;
+       /* The current implementation only allows modifying instance no 1. A
+        * value of 0 indicates that all instances should be cleared.
+        */
+       if (cp->instance > 1)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                      MGMT_STATUS_INVALID_PARAMS);
 
-       buf = kmalloc(msglen, GFP_KERNEL);
-       if (!buf)
-               return -ENOMEM;
+       hci_dev_lock(hdev);
 
-       if (memcpy_from_msg(buf, msg, msglen)) {
-               err = -EFAULT;
-               goto done;
+       if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                     MGMT_STATUS_BUSY);
+               goto unlock;
        }
 
-       hdr = buf;
-       opcode = __le16_to_cpu(hdr->opcode);
-       index = __le16_to_cpu(hdr->index);
-       len = __le16_to_cpu(hdr->len);
-
-       if (len != msglen - sizeof(*hdr)) {
-               err = -EINVAL;
-               goto done;
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                     MGMT_STATUS_INVALID_PARAMS);
+               goto unlock;
        }
 
-       if (index != MGMT_INDEX_NONE) {
-               hdev = hci_dev_get(index);
-               if (!hdev) {
-                       err = cmd_status(sk, index, opcode,
-                                        MGMT_STATUS_INVALID_INDEX);
-                       goto done;
-               }
-
-               if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
-                   test_bit(HCI_CONFIG, &hdev->dev_flags) ||
-                   test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
-                       err = cmd_status(sk, index, opcode,
-                                        MGMT_STATUS_INVALID_INDEX);
-                       goto done;
-               }
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
 
-               if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
-                   opcode != MGMT_OP_READ_CONFIG_INFO &&
-                   opcode != MGMT_OP_SET_EXTERNAL_CONFIG &&
-                   opcode != MGMT_OP_SET_PUBLIC_ADDRESS) {
-                       err = cmd_status(sk, index, opcode,
-                                        MGMT_STATUS_INVALID_INDEX);
-                       goto done;
-               }
-       }
+       memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
 
-       if (opcode >= ARRAY_SIZE(mgmt_handlers) ||
-           mgmt_handlers[opcode].func == NULL) {
-               BT_DBG("Unknown op %u", opcode);
-               err = cmd_status(sk, index, opcode,
-                                MGMT_STATUS_UNKNOWN_COMMAND);
-               goto done;
-       }
+       advertising_removed(sk, hdev, 1);
 
-       if (hdev && (opcode <= MGMT_OP_READ_INDEX_LIST ||
-                    opcode == MGMT_OP_READ_UNCONF_INDEX_LIST)) {
-               err = cmd_status(sk, index, opcode,
-                                MGMT_STATUS_INVALID_INDEX);
-               goto done;
-       }
+       hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
 
-       if (!hdev && (opcode > MGMT_OP_READ_INDEX_LIST &&
-                     opcode != MGMT_OP_READ_UNCONF_INDEX_LIST)) {
-               err = cmd_status(sk, index, opcode,
-                                MGMT_STATUS_INVALID_INDEX);
-               goto done;
+       /* If the HCI_ADVERTISING flag is set or the device isn't powered then
+        * we have no HCI communication to make. Simply return.
+        */
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+               rp.instance = 1;
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_REMOVE_ADVERTISING,
+                                       MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+               goto unlock;
        }
 
-       handler = &mgmt_handlers[opcode];
-
-       if ((handler->var_len && len < handler->data_len) ||
-           (!handler->var_len && len != handler->data_len)) {
-               err = cmd_status(sk, index, opcode,
-                                MGMT_STATUS_INVALID_PARAMS);
-               goto done;
+       cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
+                              data_len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto unlock;
        }
 
-       if (hdev)
-               mgmt_init_hdev(sk, hdev);
-
-       cp = buf + sizeof(*hdr);
+       hci_req_init(&req, hdev);
+       disable_advertising(&req);
 
-       err = handler->func(sk, hdev, cp, len);
+       err = hci_req_run(&req, remove_advertising_complete);
        if (err < 0)
-               goto done;
-
-       err = msglen;
+               mgmt_pending_remove(cmd);
 
-done:
-       if (hdev)
-               hci_dev_put(hdev);
+unlock:
+       hci_dev_unlock(hdev);
 
-       kfree(buf);
        return err;
 }
 
+static const struct hci_mgmt_handler mgmt_handlers[] = {
+       { NULL }, /* 0x0000 (no command) */
+       { read_version,            MGMT_READ_VERSION_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_commands,           MGMT_READ_COMMANDS_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_controller_info,    MGMT_READ_INFO_SIZE,
+                                               HCI_MGMT_UNTRUSTED },
+       { set_powered,             MGMT_SETTING_SIZE },
+       { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
+       { set_connectable,         MGMT_SETTING_SIZE },
+       { set_fast_connectable,    MGMT_SETTING_SIZE },
+       { set_bondable,            MGMT_SETTING_SIZE },
+       { set_link_security,       MGMT_SETTING_SIZE },
+       { set_ssp,                 MGMT_SETTING_SIZE },
+       { set_hs,                  MGMT_SETTING_SIZE },
+       { set_le,                  MGMT_SETTING_SIZE },
+       { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
+       { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
+       { add_uuid,                MGMT_ADD_UUID_SIZE },
+       { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
+       { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { disconnect,              MGMT_DISCONNECT_SIZE },
+       { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
+       { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
+       { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
+       { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
+       { pair_device,             MGMT_PAIR_DEVICE_SIZE },
+       { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
+       { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
+       { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
+       { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
+       { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
+       { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
+       { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
+       { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
+       { start_discovery,         MGMT_START_DISCOVERY_SIZE },
+       { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
+       { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
+       { block_device,            MGMT_BLOCK_DEVICE_SIZE },
+       { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
+       { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
+       { set_advertising,         MGMT_SETTING_SIZE },
+       { set_bredr,               MGMT_SETTING_SIZE },
+       { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
+       { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
+       { set_secure_conn,         MGMT_SETTING_SIZE },
+       { set_debug_keys,          MGMT_SETTING_SIZE },
+       { set_privacy,             MGMT_SET_PRIVACY_SIZE },
+       { load_irks,               MGMT_LOAD_IRKS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
+       { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
+       { add_device,              MGMT_ADD_DEVICE_SIZE },
+       { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
+       { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
+                                               HCI_MGMT_UNCONFIGURED |
+                                               HCI_MGMT_UNTRUSTED },
+       { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
+                                               HCI_MGMT_UNCONFIGURED },
+       { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
+                                               HCI_MGMT_UNCONFIGURED },
+       { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
+       { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
+       { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
+};
+
 void mgmt_index_added(struct hci_dev *hdev)
 {
-       if (hdev->dev_type != HCI_BREDR)
-               return;
+       struct mgmt_ev_ext_index ev;
 
        if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                return;
 
-       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
-               mgmt_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, NULL);
-       else
-               mgmt_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, NULL);
+       switch (hdev->dev_type) {
+       case HCI_BREDR:
+               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+                       mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
+                                        NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
+                       ev.type = 0x01;
+               } else {
+                       mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
+                                        HCI_MGMT_INDEX_EVENTS);
+                       ev.type = 0x00;
+               }
+               break;
+       case HCI_AMP:
+               ev.type = 0x02;
+               break;
+       default:
+               return;
+       }
+
+       ev.bus = hdev->bus;
+
+       mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
+                        HCI_MGMT_EXT_INDEX_EVENTS);
 }
 
 void mgmt_index_removed(struct hci_dev *hdev)
 {
+       struct mgmt_ev_ext_index ev;
        u8 status = MGMT_STATUS_INVALID_INDEX;
 
-       if (hdev->dev_type != HCI_BREDR)
+       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                return;
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+       switch (hdev->dev_type) {
+       case HCI_BREDR:
+               mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+
+               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+                       mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
+                                        NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
+                       ev.type = 0x01;
+               } else {
+                       mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0,
+                                        HCI_MGMT_INDEX_EVENTS);
+                       ev.type = 0x00;
+               }
+               break;
+       case HCI_AMP:
+               ev.type = 0x02;
+               break;
+       default:
                return;
+       }
 
-       mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+       ev.bus = hdev->bus;
 
-       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
-               mgmt_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, NULL);
-       else
-               mgmt_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, NULL);
+       mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev),
+                        HCI_MGMT_EXT_INDEX_EVENTS);
 }
 
 /* This function requires the caller holds hdev->lock */
@@ -6367,7 +7365,7 @@ static int powered_update_hci(struct hci_dev *hdev)
 
        hci_req_init(&req, hdev);
 
-       if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
+       if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
            !lmp_host_ssp_capable(hdev)) {
                u8 mode = 0x01;
 
@@ -6381,7 +7379,7 @@ static int powered_update_hci(struct hci_dev *hdev)
                }
        }
 
-       if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
+       if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
            lmp_bredr_capable(hdev)) {
                struct hci_cp_write_le_host_supported cp;
 
@@ -6402,24 +7400,28 @@ static int powered_update_hci(struct hci_dev *hdev)
                 * advertising data. This also applies to the case
                 * where BR/EDR was toggled during the AUTO_OFF phase.
                 */
-               if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+               if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
                        update_adv_data(&req);
                        update_scan_rsp_data(&req);
                }
 
-               if (test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+               if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+                   hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                        enable_advertising(&req);
 
                restart_le_actions(&req);
        }
 
-       link_sec = test_bit(HCI_LINK_SECURITY, &hdev->dev_flags);
+       link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
        if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
                hci_req_add(&req, HCI_OP_WRITE_AUTH_ENABLE,
                            sizeof(link_sec), &link_sec);
 
        if (lmp_bredr_capable(hdev)) {
-               write_fast_connectable(&req, false);
+               if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
+                       write_fast_connectable(&req, true);
+               else
+                       write_fast_connectable(&req, false);
                __hci_update_page_scan(&req);
                update_class(&req);
                update_name(&req);
@@ -6435,7 +7437,7 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
        u8 status, zero_cod[] = { 0, 0, 0 };
        int err;
 
-       if (!test_bit(HCI_MGMT, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_MGMT))
                return 0;
 
        if (powered) {
@@ -6456,7 +7458,7 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
         * been triggered, potentially causing misleading DISCONNECTED
         * status responses.
         */
-       if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
                status = MGMT_STATUS_INVALID_INDEX;
        else
                status = MGMT_STATUS_NOT_POWERED;
@@ -6464,8 +7466,8 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
 
        if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
-               mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
-                          zero_cod, sizeof(zero_cod), NULL);
+               mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                  zero_cod, sizeof(zero_cod), NULL);
 
 new_settings:
        err = new_settings(hdev, match.sk);
@@ -6478,10 +7480,10 @@ new_settings:
 
 void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        u8 status;
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+       cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
        if (!cmd)
                return;
 
@@ -6490,7 +7492,7 @@ void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
        else
                status = MGMT_STATUS_FAILED;
 
-       cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
+       mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status);
 
        mgmt_pending_remove(cmd);
 }
@@ -6506,17 +7508,23 @@ void mgmt_discoverable_timeout(struct hci_dev *hdev)
         * of a timeout triggered from general discoverable, it is
         * safe to unconditionally clear the flag.
         */
-       clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
-       clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
+       hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
+       hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
 
        hci_req_init(&req, hdev);
-       if (test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
+       if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
                u8 scan = SCAN_PAGE;
                hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE,
                            sizeof(scan), &scan);
        }
        update_class(&req);
-       update_adv_data(&req);
+
+       /* Advertising instances don't use the global discoverable setting, so
+        * only update AD if advertising was enabled using Set Advertising.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               update_adv_data(&req);
+
        hci_req_run(&req, NULL);
 
        hdev->discov_timeout = 0;
@@ -6654,7 +7662,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
 
        bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
        ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
-       ev.key.master = csrk->master;
+       ev.key.type = csrk->type;
        memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
 
        mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL);
@@ -6681,17 +7689,6 @@ void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
        mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
 }
 
-static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
-                                 u8 data_len)
-{
-       eir[eir_len++] = sizeof(type) + data_len;
-       eir[eir_len++] = type;
-       memcpy(&eir[eir_len], data, data_len);
-       eir_len += data_len;
-
-       return eir_len;
-}
-
 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
                           u32 flags, u8 *name, u8 name_len)
 {
@@ -6729,7 +7726,7 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
                    sizeof(*ev) + eir_len, NULL);
 }
 
-static void disconnect_rsp(struct pending_cmd *cmd, void *data)
+static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
        struct sock **sk = data;
 
@@ -6741,7 +7738,7 @@ static void disconnect_rsp(struct pending_cmd *cmd, void *data)
        mgmt_pending_remove(cmd);
 }
 
-static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
+static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data)
 {
        struct hci_dev *hdev = data;
        struct mgmt_cp_unpair_device *cp = cmd->param;
@@ -6754,10 +7751,10 @@ static void unpair_device_rsp(struct pending_cmd *cmd, void *data)
 
 bool mgmt_powering_down(struct hci_dev *hdev)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        struct mgmt_mode *cp;
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+       cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
        if (!cmd)
                return false;
 
@@ -6809,12 +7806,12 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
        u8 bdaddr_type = link_to_bdaddr(link_type, addr_type);
        struct mgmt_cp_disconnect *cp;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
                             hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
+       cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
        if (!cmd)
                return;
 
@@ -6864,9 +7861,9 @@ void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure)
 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                  u8 status)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
+       cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
        if (!cmd)
                return;
 
@@ -6877,9 +7874,9 @@ void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 status)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
+       cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
        if (!cmd)
                return;
 
@@ -6922,9 +7919,9 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
                                      u8 link_type, u8 addr_type, u8 status,
                                      u8 opcode)
 {
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(opcode, hdev);
+       cmd = pending_find(opcode, hdev);
        if (!cmd)
                return -ENOENT;
 
@@ -6983,7 +7980,7 @@ int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr,
 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
 {
        struct mgmt_ev_auth_failed ev;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
        u8 status = mgmt_status(hci_status);
 
        bacpy(&ev.addr.bdaddr, &conn->dst);
@@ -7014,11 +8011,9 @@ void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
        }
 
        if (test_bit(HCI_AUTH, &hdev->flags))
-               changed = !test_and_set_bit(HCI_LINK_SECURITY,
-                                           &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY);
        else
-               changed = test_and_clear_bit(HCI_LINK_SECURITY,
-                                            &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY);
 
        mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp,
                             &match);
@@ -7054,9 +8049,9 @@ void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
        if (status) {
                u8 mgmt_err = mgmt_status(status);
 
-               if (enable && test_and_clear_bit(HCI_SSP_ENABLED,
-                                                &hdev->dev_flags)) {
-                       clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+               if (enable && hci_dev_test_and_clear_flag(hdev,
+                                                         HCI_SSP_ENABLED)) {
+                       hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
                        new_settings(hdev, NULL);
                }
 
@@ -7066,14 +8061,14 @@ void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
        }
 
        if (enable) {
-               changed = !test_and_set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+               changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
        } else {
-               changed = test_and_clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
+               changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
                if (!changed)
-                       changed = test_and_clear_bit(HCI_HS_ENABLED,
-                                                    &hdev->dev_flags);
+                       changed = hci_dev_test_and_clear_flag(hdev,
+                                                             HCI_HS_ENABLED);
                else
-                       clear_bit(HCI_HS_ENABLED, &hdev->dev_flags);
+                       hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
        }
 
        mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
@@ -7086,8 +8081,8 @@ void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
 
        hci_req_init(&req, hdev);
 
-       if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
-               if (test_bit(HCI_USE_DEBUG_KEYS, &hdev->dev_flags))
+       if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
+               if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS))
                        hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE,
                                    sizeof(enable), &enable);
                update_eir(&req);
@@ -7098,7 +8093,7 @@ void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status)
        hci_req_run(&req, NULL);
 }
 
-static void sk_lookup(struct pending_cmd *cmd, void *data)
+static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data)
 {
        struct cmd_lookup *match = data;
 
@@ -7118,8 +8113,8 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
        mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
 
        if (!status)
-               mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
-                          NULL);
+               mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                  dev_class, 3, NULL);
 
        if (match.sk)
                sock_put(match.sk);
@@ -7128,7 +8123,7 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
 {
        struct mgmt_cp_set_local_name ev;
-       struct pending_cmd *cmd;
+       struct mgmt_pending_cmd *cmd;
 
        if (status)
                return;
@@ -7137,55 +8132,19 @@ void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
        memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
+       cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
        if (!cmd) {
                memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
 
                /* If this is a HCI command related to powering on the
                 * HCI dev don't send any mgmt signals.
                 */
-               if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+               if (pending_find(MGMT_OP_SET_POWERED, hdev))
                        return;
        }
 
-       mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
-                  cmd ? cmd->sk : NULL);
-}
-
-void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
-                                      u8 *rand192, u8 *hash256, u8 *rand256,
-                                      u8 status)
-{
-       struct pending_cmd *cmd;
-
-       BT_DBG("%s status %u", hdev->name, status);
-
-       cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
-       if (!cmd)
-               return;
-
-       if (status) {
-               cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                          mgmt_status(status));
-       } else {
-               struct mgmt_rp_read_local_oob_data rp;
-               size_t rp_size = sizeof(rp);
-
-               memcpy(rp.hash192, hash192, sizeof(rp.hash192));
-               memcpy(rp.rand192, rand192, sizeof(rp.rand192));
-
-               if (bredr_sc_enabled(hdev) && hash256 && rand256) {
-                       memcpy(rp.hash256, hash256, sizeof(rp.hash256));
-                       memcpy(rp.rand256, rand256, sizeof(rp.rand256));
-               } else {
-                       rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
-               }
-
-               cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 0,
-                            &rp, rp_size);
-       }
-
-       mgmt_pending_remove(cmd);
+       mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
+                          cmd ? cmd->sk : NULL);
 }
 
 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
@@ -7258,7 +8217,7 @@ static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16])
 static void restart_le_scan(struct hci_dev *hdev)
 {
        /* If controller is not scanning we are done. */
-       if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
                return;
 
        if (time_after(jiffies + DISCOV_LE_RESTART_DELAY,
@@ -7270,14 +8229,58 @@ static void restart_le_scan(struct hci_dev *hdev)
                           DISCOV_LE_RESTART_DELAY);
 }
 
+static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir,
+                           u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
+{
+       /* If a RSSI threshold has been specified, and
+        * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with
+        * a RSSI smaller than the RSSI threshold will be dropped. If the quirk
+        * is set, let it through for further processing, as we might need to
+        * restart the scan.
+        *
+        * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
+        * the results are also dropped.
+        */
+       if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
+           (rssi == HCI_RSSI_INVALID ||
+           (rssi < hdev->discovery.rssi &&
+            !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
+               return  false;
+
+       if (hdev->discovery.uuid_count != 0) {
+               /* If a list of UUIDs is provided in filter, results with no
+                * matching UUID should be dropped.
+                */
+               if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count,
+                                  hdev->discovery.uuids) &&
+                   !eir_has_uuids(scan_rsp, scan_rsp_len,
+                                  hdev->discovery.uuid_count,
+                                  hdev->discovery.uuids))
+                       return false;
+       }
+
+       /* If duplicate filtering does not report RSSI changes, then restart
+        * scanning to ensure updated result with updated RSSI values.
+        */
+       if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) {
+               restart_le_scan(hdev);
+
+               /* Validate RSSI value against the RSSI threshold once more. */
+               if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
+                   rssi < hdev->discovery.rssi)
+                       return false;
+       }
+
+       return true;
+}
+
 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                       u8 addr_type, u8 *dev_class, s8 rssi, u32 flags,
                       u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len)
 {
        char buf[512];
-       struct mgmt_ev_device_found *ev = (void *) buf;
+       struct mgmt_ev_device_found *ev = (void *)buf;
        size_t ev_size;
-       bool match;
 
        /* Don't send events for a non-kernel initiated discovery. With
         * LE one exception is if we have pend_le_reports > 0 in which
@@ -7290,21 +8293,12 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                        return;
        }
 
-       /* When using service discovery with a RSSI threshold, then check
-        * if such a RSSI threshold is specified. If a RSSI threshold has
-        * been specified, and HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set,
-        * then all results with a RSSI smaller than the RSSI threshold will be
-        * dropped. If the quirk is set, let it through for further processing,
-        * as we might need to restart the scan.
-        *
-        * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry,
-        * the results are also dropped.
-        */
-       if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
-           (rssi == HCI_RSSI_INVALID ||
-           (rssi < hdev->discovery.rssi &&
-            !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks))))
-               return;
+       if (hdev->discovery.result_filtering) {
+               /* We are using service discovery */
+               if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp,
+                                    scan_rsp_len))
+                       return;
+       }
 
        /* Make sure that the buffer is big enough. The 5 extra bytes
         * are for the potential CoD field.
@@ -7331,87 +8325,17 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
        ev->rssi = rssi;
        ev->flags = cpu_to_le32(flags);
 
-       if (eir_len > 0) {
-               /* When using service discovery and a list of UUID is
-                * provided, results with no matching UUID should be
-                * dropped. In case there is a match the result is
-                * kept and checking possible scan response data
-                * will be skipped.
-                */
-               if (hdev->discovery.uuid_count > 0) {
-                       match = eir_has_uuids(eir, eir_len,
-                                             hdev->discovery.uuid_count,
-                                             hdev->discovery.uuids);
-                       /* If duplicate filtering does not report RSSI changes,
-                        * then restart scanning to ensure updated result with
-                        * updated RSSI values.
-                        */
-                       if (match && test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
-                                             &hdev->quirks))
-                               restart_le_scan(hdev);
-               } else {
-                       match = true;
-               }
-
-               if (!match && !scan_rsp_len)
-                       return;
-
+       if (eir_len > 0)
                /* Copy EIR or advertising data into event */
                memcpy(ev->eir, eir, eir_len);
-       } else {
-               /* When using service discovery and a list of UUID is
-                * provided, results with empty EIR or advertising data
-                * should be dropped since they do not match any UUID.
-                */
-               if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
-                       return;
-
-               match = false;
-       }
 
        if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
                eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV,
                                          dev_class, 3);
 
-       if (scan_rsp_len > 0) {
-               /* When using service discovery and a list of UUID is
-                * provided, results with no matching UUID should be
-                * dropped if there is no previous match from the
-                * advertising data.
-                */
-               if (hdev->discovery.uuid_count > 0) {
-                       if (!match && !eir_has_uuids(scan_rsp, scan_rsp_len,
-                                                    hdev->discovery.uuid_count,
-                                                    hdev->discovery.uuids))
-                               return;
-
-                       /* If duplicate filtering does not report RSSI changes,
-                        * then restart scanning to ensure updated result with
-                        * updated RSSI values.
-                        */
-                       if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER,
-                                    &hdev->quirks))
-                               restart_le_scan(hdev);
-               }
-
+       if (scan_rsp_len > 0)
                /* Append scan response data to event */
                memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len);
-       } else {
-               /* When using service discovery and a list of UUID is
-                * provided, results with empty scan response and no
-                * previous matched advertising data should be dropped.
-                */
-               if (hdev->discovery.uuid_count > 0 && !match)
-                       return;
-       }
-
-       /* Validate the reported RSSI value against the RSSI threshold once more
-        * incase HCI_QUIRK_STRICT_DUPLICATE_FILTER forced a restart of LE
-        * scanning.
-        */
-       if (hdev->discovery.rssi != HCI_RSSI_INVALID &&
-           rssi < hdev->discovery.rssi)
-               return;
 
        ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len);
        ev_size = sizeof(*ev) + eir_len + scan_rsp_len;
@@ -7464,10 +8388,28 @@ void mgmt_reenable_advertising(struct hci_dev *hdev)
 {
        struct hci_request req;
 
-       if (!test_bit(HCI_ADVERTISING, &hdev->dev_flags))
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                return;
 
        hci_req_init(&req, hdev);
        enable_advertising(&req);
        hci_req_run(&req, adv_enable_complete);
 }
+
+static struct hci_mgmt_chan chan = {
+       .channel        = HCI_CHANNEL_CONTROL,
+       .handler_count  = ARRAY_SIZE(mgmt_handlers),
+       .handlers       = mgmt_handlers,
+       .hdev_init      = mgmt_init_hdev,
+};
+
+int mgmt_init(void)
+{
+       return hci_mgmt_chan_register(&chan);
+}
+
+void mgmt_exit(void)
+{
+       hci_mgmt_chan_unregister(&chan);
+}