Merge Linus master into drm-next
[firefly-linux-kernel-4.4.55.git] / net / bluetooth / mgmt.c
index ff636bd9523b2d224e8b85823d3d58d0506ddc64..7fd87e7135b52753c0bcefd58cb4a290c57c77ba 100644 (file)
@@ -35,6 +35,7 @@
 
 #include "hci_request.h"
 #include "smp.h"
+#include "mgmt_util.h"
 
 #define MGMT_VERSION   1
 #define MGMT_REVISION  9
@@ -96,7 +97,11 @@ static const u16 mgmt_commands[] = {
        MGMT_OP_SET_EXTERNAL_CONFIG,
        MGMT_OP_SET_PUBLIC_ADDRESS,
        MGMT_OP_START_SERVICE_DISCOVERY,
+       MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
        MGMT_OP_READ_EXT_INDEX_LIST,
+       MGMT_OP_READ_ADV_FEATURES,
+       MGMT_OP_ADD_ADVERTISING,
+       MGMT_OP_REMOVE_ADVERTISING,
 };
 
 static const u16 mgmt_events[] = {
@@ -131,6 +136,30 @@ static const u16 mgmt_events[] = {
        MGMT_EV_NEW_CONFIG_OPTIONS,
        MGMT_EV_EXT_INDEX_ADDED,
        MGMT_EV_EXT_INDEX_REMOVED,
+       MGMT_EV_LOCAL_OOB_DATA_UPDATED,
+       MGMT_EV_ADVERTISING_ADDED,
+       MGMT_EV_ADVERTISING_REMOVED,
+};
+
+static const u16 mgmt_untrusted_commands[] = {
+       MGMT_OP_READ_INDEX_LIST,
+       MGMT_OP_READ_INFO,
+       MGMT_OP_READ_UNCONF_INDEX_LIST,
+       MGMT_OP_READ_CONFIG_INFO,
+       MGMT_OP_READ_EXT_INDEX_LIST,
+};
+
+static const u16 mgmt_untrusted_events[] = {
+       MGMT_EV_INDEX_ADDED,
+       MGMT_EV_INDEX_REMOVED,
+       MGMT_EV_NEW_SETTINGS,
+       MGMT_EV_CLASS_OF_DEV_CHANGED,
+       MGMT_EV_LOCAL_NAME_CHANGED,
+       MGMT_EV_UNCONF_INDEX_ADDED,
+       MGMT_EV_UNCONF_INDEX_REMOVED,
+       MGMT_EV_NEW_CONFIG_OPTIONS,
+       MGMT_EV_EXT_INDEX_ADDED,
+       MGMT_EV_EXT_INDEX_REMOVED,
 };
 
 #define CACHE_TIMEOUT  msecs_to_jiffies(2 * 1000)
@@ -138,17 +167,6 @@ static const u16 mgmt_events[] = {
 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
                 "\x00\x00\x00\x00\x00\x00\x00\x00"
 
-struct mgmt_pending_cmd {
-       struct list_head list;
-       u16 opcode;
-       int index;
-       void *param;
-       size_t param_len;
-       struct sock *sk;
-       void *user_data;
-       int (*cmd_complete)(struct mgmt_pending_cmd *cmd, u8 status);
-};
-
 /* HCI to MGMT error code conversion table */
 static u8 mgmt_status_table[] = {
        MGMT_STATUS_SUCCESS,
@@ -222,133 +240,32 @@ static u8 mgmt_status(u8 hci_status)
        return MGMT_STATUS_FAILED;
 }
 
-static int mgmt_send_event(u16 event, struct hci_dev *hdev,
-                          unsigned short channel, void *data, u16 data_len,
-                          struct sock *skip_sk)
-{
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-
-       skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-       hdr->opcode = cpu_to_le16(event);
-       if (hdev)
-               hdr->index = cpu_to_le16(hdev->id);
-       else
-               hdr->index = cpu_to_le16(MGMT_INDEX_NONE);
-       hdr->len = cpu_to_le16(data_len);
-
-       if (data)
-               memcpy(skb_put(skb, data_len), data, data_len);
-
-       /* Time stamp */
-       __net_timestamp(skb);
-
-       hci_send_to_channel(channel, skb, skip_sk);
-       kfree_skb(skb);
-
-       return 0;
-}
-
-static int mgmt_index_event(u16 event, struct hci_dev *hdev,
-                           void *data, u16 data_len, int flag)
+static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data,
+                           u16 len, int flag)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-
-       skb = alloc_skb(sizeof(*hdr) + data_len, GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-       hdr->opcode = cpu_to_le16(event);
-       hdr->index = cpu_to_le16(hdev->id);
-       hdr->len = cpu_to_le16(data_len);
-
-       if (data)
-               memcpy(skb_put(skb, data_len), data, data_len);
-
-       /* Time stamp */
-       __net_timestamp(skb);
-
-       hci_send_to_flagged_channel(HCI_CHANNEL_CONTROL, skb, flag);
-       kfree_skb(skb);
-
-       return 0;
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              flag, NULL);
 }
 
-static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
-                     struct sock *skip_sk)
+static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data,
+                             u16 len, int flag, struct sock *skip_sk)
 {
        return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
-                              skip_sk);
+                              flag, skip_sk);
 }
 
-static int mgmt_cmd_status(struct sock *sk, u16 index, u16 cmd, u8 status)
+static int mgmt_generic_event(u16 event, struct hci_dev *hdev, void *data,
+                             u16 len, struct sock *skip_sk)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-       struct mgmt_ev_cmd_status *ev;
-       int err;
-
-       BT_DBG("sock %p, index %u, cmd %u, status %u", sk, index, cmd, status);
-
-       skb = alloc_skb(sizeof(*hdr) + sizeof(*ev), GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-
-       hdr->opcode = cpu_to_le16(MGMT_EV_CMD_STATUS);
-       hdr->index = cpu_to_le16(index);
-       hdr->len = cpu_to_le16(sizeof(*ev));
-
-       ev = (void *) skb_put(skb, sizeof(*ev));
-       ev->status = status;
-       ev->opcode = cpu_to_le16(cmd);
-
-       err = sock_queue_rcv_skb(sk, skb);
-       if (err < 0)
-               kfree_skb(skb);
-
-       return err;
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              HCI_MGMT_GENERIC_EVENTS, skip_sk);
 }
 
-static int mgmt_cmd_complete(struct sock *sk, u16 index, u16 cmd, u8 status,
-                            void *rp, size_t rp_len)
+static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len,
+                     struct sock *skip_sk)
 {
-       struct sk_buff *skb;
-       struct mgmt_hdr *hdr;
-       struct mgmt_ev_cmd_complete *ev;
-       int err;
-
-       BT_DBG("sock %p", sk);
-
-       skb = alloc_skb(sizeof(*hdr) + sizeof(*ev) + rp_len, GFP_KERNEL);
-       if (!skb)
-               return -ENOMEM;
-
-       hdr = (void *) skb_put(skb, sizeof(*hdr));
-
-       hdr->opcode = cpu_to_le16(MGMT_EV_CMD_COMPLETE);
-       hdr->index = cpu_to_le16(index);
-       hdr->len = cpu_to_le16(sizeof(*ev) + rp_len);
-
-       ev = (void *) skb_put(skb, sizeof(*ev) + rp_len);
-       ev->opcode = cpu_to_le16(cmd);
-       ev->status = status;
-
-       if (rp)
-               memcpy(ev->data, rp, rp_len);
-
-       err = sock_queue_rcv_skb(sk, skb);
-       if (err < 0)
-               kfree_skb(skb);
-
-       return err;
+       return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len,
+                              HCI_SOCK_TRUSTED, skip_sk);
 }
 
 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -369,14 +286,20 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
                         u16 data_len)
 {
        struct mgmt_rp_read_commands *rp;
-       const u16 num_commands = ARRAY_SIZE(mgmt_commands);
-       const u16 num_events = ARRAY_SIZE(mgmt_events);
-       __le16 *opcode;
+       u16 num_commands, num_events;
        size_t rp_size;
        int i, err;
 
        BT_DBG("sock %p", sk);
 
+       if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
+               num_commands = ARRAY_SIZE(mgmt_commands);
+               num_events = ARRAY_SIZE(mgmt_events);
+       } else {
+               num_commands = ARRAY_SIZE(mgmt_untrusted_commands);
+               num_events = ARRAY_SIZE(mgmt_untrusted_events);
+       }
+
        rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16));
 
        rp = kmalloc(rp_size, GFP_KERNEL);
@@ -386,11 +309,23 @@ static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data,
        rp->num_commands = cpu_to_le16(num_commands);
        rp->num_events = cpu_to_le16(num_events);
 
-       for (i = 0, opcode = rp->opcodes; i < num_commands; i++, opcode++)
-               put_unaligned_le16(mgmt_commands[i], opcode);
+       if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) {
+               __le16 *opcode = rp->opcodes;
+
+               for (i = 0; i < num_commands; i++, opcode++)
+                       put_unaligned_le16(mgmt_commands[i], opcode);
+
+               for (i = 0; i < num_events; i++, opcode++)
+                       put_unaligned_le16(mgmt_events[i], opcode);
+       } else {
+               __le16 *opcode = rp->opcodes;
+
+               for (i = 0; i < num_commands; i++, opcode++)
+                       put_unaligned_le16(mgmt_untrusted_commands[i], opcode);
 
-       for (i = 0; i < num_events; i++, opcode++)
-               put_unaligned_le16(mgmt_events[i], opcode);
+               for (i = 0; i < num_events; i++, opcode++)
+                       put_unaligned_le16(mgmt_untrusted_events[i], opcode);
+       }
 
        err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0,
                                rp, rp_size);
@@ -627,8 +562,8 @@ static int new_options(struct hci_dev *hdev, struct sock *skip)
 {
        __le32 options = get_missing_options(hdev);
 
-       return mgmt_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
-                         sizeof(options), skip);
+       return mgmt_generic_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options,
+                                 sizeof(options), skip);
 }
 
 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
@@ -758,7 +693,7 @@ static u32 get_current_settings(struct hci_dev *hdev)
         * the second is to indicate if it is actually set.
         *
         * This means if the static address is not configured, this flag
-        * will never bet set. If the address is configured, then if the
+        * will never be set. If the address is configured, then if the
         * address is actually used decides if the flag is set or not.
         *
         * For single mode LE only controllers and dual-mode controllers
@@ -885,36 +820,19 @@ static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
        return ptr;
 }
 
-static struct mgmt_pending_cmd *mgmt_pending_find(u16 opcode,
-                                                 struct hci_dev *hdev)
+static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev)
 {
-       struct mgmt_pending_cmd *cmd;
-
-       list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
-               if (cmd->opcode == opcode)
-                       return cmd;
-       }
-
-       return NULL;
+       return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev);
 }
 
-static struct mgmt_pending_cmd *mgmt_pending_find_data(u16 opcode,
-                                                      struct hci_dev *hdev,
-                                                      const void *data)
+static struct mgmt_pending_cmd *pending_find_data(u16 opcode,
+                                                 struct hci_dev *hdev,
+                                                 const void *data)
 {
-       struct mgmt_pending_cmd *cmd;
-
-       list_for_each_entry(cmd, &hdev->mgmt_pending, list) {
-               if (cmd->user_data != data)
-                       continue;
-               if (cmd->opcode == opcode)
-                       return cmd;
-       }
-
-       return NULL;
+       return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data);
 }
 
-static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
+static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
 {
        u8 ad_len = 0;
        size_t name_len;
@@ -940,7 +858,19 @@ static u8 create_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
        return ad_len;
 }
 
-static void update_scan_rsp_data(struct hci_request *req)
+static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
+{
+       /* TODO: Set the appropriate entries based on advertising instance flags
+        * here once flags other than 0 are supported.
+        */
+       memcpy(ptr, hdev->adv_instance.scan_rsp_data,
+              hdev->adv_instance.scan_rsp_len);
+
+       return hdev->adv_instance.scan_rsp_len;
+}
+
+static void update_scan_rsp_data_for_instance(struct hci_request *req,
+                                             u8 instance)
 {
        struct hci_dev *hdev = req->hdev;
        struct hci_cp_le_set_scan_rsp_data cp;
@@ -951,10 +881,13 @@ static void update_scan_rsp_data(struct hci_request *req)
 
        memset(&cp, 0, sizeof(cp));
 
-       len = create_scan_rsp_data(hdev, cp.data);
+       if (instance)
+               len = create_instance_scan_rsp_data(hdev, cp.data);
+       else
+               len = create_default_scan_rsp_data(hdev, cp.data);
 
        if (hdev->scan_rsp_data_len == len &&
-           memcmp(cp.data, hdev->scan_rsp_data, len) == 0)
+           !memcmp(cp.data, hdev->scan_rsp_data, len))
                return;
 
        memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
@@ -965,6 +898,25 @@ static void update_scan_rsp_data(struct hci_request *req)
        hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
 }
 
+static void update_scan_rsp_data(struct hci_request *req)
+{
+       struct hci_dev *hdev = req->hdev;
+       u8 instance;
+
+       /* The "Set Advertising" setting supersedes the "Add Advertising"
+        * setting. Here we set the scan response data based on which
+        * setting was set. When neither apply, default to the global settings,
+        * represented by instance "0".
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               instance = 0x01;
+       else
+               instance = 0x00;
+
+       update_scan_rsp_data_for_instance(req, instance);
+}
+
 static u8 get_adv_discov_flags(struct hci_dev *hdev)
 {
        struct mgmt_pending_cmd *cmd;
@@ -972,7 +924,7 @@ static u8 get_adv_discov_flags(struct hci_dev *hdev)
        /* If there's a pending mgmt command the flags will not yet have
         * their final values, so check for this first.
         */
-       cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
        if (cmd) {
                struct mgmt_mode *cp = cmd->param;
                if (cp->val == 0x01)
@@ -989,30 +941,122 @@ static u8 get_adv_discov_flags(struct hci_dev *hdev)
        return 0;
 }
 
-static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
+static u8 get_current_adv_instance(struct hci_dev *hdev)
+{
+       /* The "Set Advertising" setting supersedes the "Add Advertising"
+        * setting. Here we set the advertising data based on which
+        * setting was set. When neither apply, default to the global settings,
+        * represented by instance "0".
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               return 0x01;
+
+       return 0x00;
+}
+
+static bool get_connectable(struct hci_dev *hdev)
+{
+       struct mgmt_pending_cmd *cmd;
+
+       /* If there's a pending mgmt command the flag will not yet have
+        * it's final value, so check for this first.
+        */
+       cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+       if (cmd) {
+               struct mgmt_mode *cp = cmd->param;
+
+               return cp->val;
+       }
+
+       return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
+}
+
+static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
+{
+       u32 flags;
+
+       if (instance > 0x01)
+               return 0;
+
+       if (instance == 0x01)
+               return hdev->adv_instance.flags;
+
+       /* Instance 0 always manages the "Tx Power" and "Flags" fields */
+       flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting corresponds
+        * to the "connectable" instance flag.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
+               flags |= MGMT_ADV_FLAG_CONNECTABLE;
+
+       return flags;
+}
+
+static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance)
+{
+       /* Ignore instance 0 and other unsupported instances */
+       if (instance != 0x01)
+               return 0;
+
+       /* TODO: Take into account the "appearance" and "local-name" flags here.
+        * These are currently being ignored as they are not supported.
+        */
+       return hdev->adv_instance.scan_rsp_len;
+}
+
+static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
 {
        u8 ad_len = 0, flags = 0;
+       u32 instance_flags = get_adv_instance_flags(hdev, instance);
 
-       flags |= get_adv_discov_flags(hdev);
+       /* The Add Advertising command allows userspace to set both the general
+        * and limited discoverable flags.
+        */
+       if (instance_flags & MGMT_ADV_FLAG_DISCOV)
+               flags |= LE_AD_GENERAL;
 
-       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
-               flags |= LE_AD_NO_BREDR;
+       if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
+               flags |= LE_AD_LIMITED;
 
-       if (flags) {
-               BT_DBG("adv flags 0x%02x", flags);
+       if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
+               /* If a discovery flag wasn't provided, simply use the global
+                * settings.
+                */
+               if (!flags)
+                       flags |= get_adv_discov_flags(hdev);
 
-               ptr[0] = 2;
-               ptr[1] = EIR_FLAGS;
-               ptr[2] = flags;
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+                       flags |= LE_AD_NO_BREDR;
 
-               ad_len += 3;
-               ptr += 3;
+               /* If flags would still be empty, then there is no need to
+                * include the "Flags" AD field".
+                */
+               if (flags) {
+                       ptr[0] = 0x02;
+                       ptr[1] = EIR_FLAGS;
+                       ptr[2] = flags;
+
+                       ad_len += 3;
+                       ptr += 3;
+               }
        }
 
-       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
-               ptr[0] = 2;
+       if (instance) {
+               memcpy(ptr, hdev->adv_instance.adv_data,
+                      hdev->adv_instance.adv_data_len);
+
+               ad_len += hdev->adv_instance.adv_data_len;
+               ptr += hdev->adv_instance.adv_data_len;
+       }
+
+       /* Provide Tx Power only if we can provide a valid value for it */
+       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
+           (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
+               ptr[0] = 0x02;
                ptr[1] = EIR_TX_POWER;
-               ptr[2] = (u8) hdev->adv_tx_power;
+               ptr[2] = (u8)hdev->adv_tx_power;
 
                ad_len += 3;
                ptr += 3;
@@ -1021,7 +1065,7 @@ static u8 create_adv_data(struct hci_dev *hdev, u8 *ptr)
        return ad_len;
 }
 
-static void update_adv_data(struct hci_request *req)
+static void update_adv_data_for_instance(struct hci_request *req, u8 instance)
 {
        struct hci_dev *hdev = req->hdev;
        struct hci_cp_le_set_adv_data cp;
@@ -1032,8 +1076,9 @@ static void update_adv_data(struct hci_request *req)
 
        memset(&cp, 0, sizeof(cp));
 
-       len = create_adv_data(hdev, cp.data);
+       len = create_instance_adv_data(hdev, instance, cp.data);
 
+       /* There's nothing to do if the data hasn't changed */
        if (hdev->adv_data_len == len &&
            memcmp(cp.data, hdev->adv_data, len) == 0)
                return;
@@ -1046,6 +1091,14 @@ static void update_adv_data(struct hci_request *req)
        hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
 }
 
+static void update_adv_data(struct hci_request *req)
+{
+       struct hci_dev *hdev = req->hdev;
+       u8 instance = get_current_adv_instance(hdev);
+
+       update_adv_data_for_instance(req, instance);
+}
+
 int mgmt_update_adv_data(struct hci_dev *hdev)
 {
        struct hci_request req;
@@ -1173,22 +1226,6 @@ static void update_class(struct hci_request *req)
        hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
 }
 
-static bool get_connectable(struct hci_dev *hdev)
-{
-       struct mgmt_pending_cmd *cmd;
-
-       /* If there's a pending mgmt command the flag will not yet have
-        * it's final value, so check for this first.
-        */
-       cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
-       if (cmd) {
-               struct mgmt_mode *cp = cmd->param;
-               return cp->val;
-       }
-
-       return hci_dev_test_flag(hdev, HCI_CONNECTABLE);
-}
-
 static void disable_advertising(struct hci_request *req)
 {
        u8 enable = 0x00;
@@ -1202,6 +1239,8 @@ static void enable_advertising(struct hci_request *req)
        struct hci_cp_le_set_adv_param cp;
        u8 own_addr_type, enable = 0x01;
        bool connectable;
+       u8 instance;
+       u32 flags;
 
        if (hci_conn_num(hdev, LE_LINK) > 0)
                return;
@@ -1216,10 +1255,14 @@ static void enable_advertising(struct hci_request *req)
         */
        hci_dev_clear_flag(hdev, HCI_LE_ADV);
 
-       if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
-               connectable = true;
-       else
-               connectable = get_connectable(hdev);
+       instance = get_current_adv_instance(hdev);
+       flags = get_adv_instance_flags(hdev, instance);
+
+       /* If the "connectable" instance flag was not set, then choose between
+        * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
+        */
+       connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
+                     get_connectable(hdev);
 
        /* Set require_privacy to true only when non-connectable
         * advertising is used. In that case it is fine to use a
@@ -1231,7 +1274,14 @@ static void enable_advertising(struct hci_request *req)
        memset(&cp, 0, sizeof(cp));
        cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
        cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
-       cp.type = connectable ? LE_ADV_IND : LE_ADV_NONCONN_IND;
+
+       if (connectable)
+               cp.type = LE_ADV_IND;
+       else if (get_adv_instance_scan_rsp_len(hdev, instance))
+               cp.type = LE_ADV_SCAN_IND;
+       else
+               cp.type = LE_ADV_NONCONN_IND;
+
        cp.own_address_type = own_addr_type;
        cp.channel_map = hdev->le_adv_channel_map;
 
@@ -1328,63 +1378,6 @@ static int read_controller_info(struct sock *sk, struct hci_dev *hdev,
                                 sizeof(rp));
 }
 
-static void mgmt_pending_free(struct mgmt_pending_cmd *cmd)
-{
-       sock_put(cmd->sk);
-       kfree(cmd->param);
-       kfree(cmd);
-}
-
-static struct mgmt_pending_cmd *mgmt_pending_add(struct sock *sk, u16 opcode,
-                                                struct hci_dev *hdev,
-                                                void *data, u16 len)
-{
-       struct mgmt_pending_cmd *cmd;
-
-       cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
-       if (!cmd)
-               return NULL;
-
-       cmd->opcode = opcode;
-       cmd->index = hdev->id;
-
-       cmd->param = kmemdup(data, len, GFP_KERNEL);
-       if (!cmd->param) {
-               kfree(cmd);
-               return NULL;
-       }
-
-       cmd->param_len = len;
-
-       cmd->sk = sk;
-       sock_hold(sk);
-
-       list_add(&cmd->list, &hdev->mgmt_pending);
-
-       return cmd;
-}
-
-static void mgmt_pending_foreach(u16 opcode, struct hci_dev *hdev,
-                                void (*cb)(struct mgmt_pending_cmd *cmd,
-                                           void *data),
-                                void *data)
-{
-       struct mgmt_pending_cmd *cmd, *tmp;
-
-       list_for_each_entry_safe(cmd, tmp, &hdev->mgmt_pending, list) {
-               if (opcode > 0 && cmd->opcode != opcode)
-                       continue;
-
-               cb(cmd, data);
-       }
-}
-
-static void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
-{
-       list_del(&cmd->list);
-       mgmt_pending_free(cmd);
-}
-
 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev)
 {
        __le32 settings = cpu_to_le32(get_current_settings(hdev));
@@ -1411,9 +1404,10 @@ static bool hci_stop_discovery(struct hci_request *req)
 
        switch (hdev->discovery.state) {
        case DISCOVERY_FINDING:
-               if (test_bit(HCI_INQUIRY, &hdev->flags)) {
+               if (test_bit(HCI_INQUIRY, &hdev->flags))
                        hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
-               } else {
+
+               if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
                        cancel_delayed_work(&hdev->le_scan_disable);
                        hci_req_add_le_scan_disable(req);
                }
@@ -1445,6 +1439,49 @@ static bool hci_stop_discovery(struct hci_request *req)
        return false;
 }
 
+static void advertising_added(struct sock *sk, struct hci_dev *hdev,
+                             u8 instance)
+{
+       struct mgmt_ev_advertising_added ev;
+
+       ev.instance = instance;
+
+       mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk);
+}
+
+static void advertising_removed(struct sock *sk, struct hci_dev *hdev,
+                               u8 instance)
+{
+       struct mgmt_ev_advertising_removed ev;
+
+       ev.instance = instance;
+
+       mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk);
+}
+
+static void clear_adv_instance(struct hci_dev *hdev)
+{
+       struct hci_request req;
+
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               return;
+
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
+
+       memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
+       advertising_removed(NULL, hdev, 1);
+       hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
+
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               return;
+
+       hci_req_init(&req, hdev);
+       disable_advertising(&req);
+       hci_req_run(&req, NULL);
+}
+
 static int clean_up_hci_state(struct hci_dev *hdev)
 {
        struct hci_request req;
@@ -1460,6 +1497,9 @@ static int clean_up_hci_state(struct hci_dev *hdev)
                hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
        }
 
+       if (hdev->adv_instance.timeout)
+               clear_adv_instance(hdev);
+
        if (hci_dev_test_flag(hdev, HCI_LE_ADV))
                disable_advertising(&req);
 
@@ -1519,7 +1559,7 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
 
        hci_dev_lock(hdev);
 
-       if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev)) {
+       if (pending_find(MGMT_OP_SET_POWERED, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -1572,11 +1612,10 @@ failed:
 
 static int new_settings(struct hci_dev *hdev, struct sock *skip)
 {
-       __le32 ev;
+       __le32 ev = cpu_to_le32(get_current_settings(hdev));
 
-       ev = cpu_to_le32(get_current_settings(hdev));
-
-       return mgmt_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, sizeof(ev), skip);
+       return mgmt_generic_event(MGMT_EV_NEW_SETTINGS, hdev, &ev,
+                                 sizeof(ev), skip);
 }
 
 int mgmt_new_settings(struct hci_dev *hdev)
@@ -1672,7 +1711,7 @@ static void set_discoverable_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -1757,8 +1796,8 @@ static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+       if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
+           pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -1929,7 +1968,7 @@ static void set_connectable_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -2024,8 +2063,8 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
+       if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) ||
+           pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -2076,7 +2115,8 @@ static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data,
 
 no_scan_update:
        /* Update the advertising parameters if necessary */
-       if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                enable_advertising(&req);
 
        err = hci_req_run(&req, set_connectable_complete);
@@ -2164,7 +2204,7 @@ static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
+       if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -2243,7 +2283,7 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+       if (pending_find(MGMT_OP_SET_SSP, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -2302,7 +2342,7 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
 
        hci_dev_lock(hdev);
 
-       if (mgmt_pending_find(MGMT_OP_SET_SSP, hdev)) {
+       if (pending_find(MGMT_OP_SET_SSP, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -2391,10 +2431,22 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                       MGMT_STATUS_INVALID_PARAMS);
 
-       /* LE-only devices do not allow toggling LE on/off */
-       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+       /* Bluetooth single mode LE only controllers or dual-mode
+        * controllers configured as LE only devices, do not allow
+        * switching LE off. These have either LE enabled explicitly
+        * or BR/EDR has been previously switched off.
+        *
+        * When trying to enable an already enabled LE, then gracefully
+        * send a positive response. Trying to disable it however will
+        * result into rejection.
+        */
+       if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
+               if (cp->val == 0x01)
+                       return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev);
+
                return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                       MGMT_STATUS_REJECTED);
+       }
 
        hci_dev_lock(hdev);
 
@@ -2424,8 +2476,8 @@ static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_LE, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
+       if (pending_find(MGMT_OP_SET_LE, hdev) ||
+           pending_find(MGMT_OP_SET_ADVERTISING, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -2509,7 +2561,7 @@ static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(mgmt_op, hdev);
+       cmd = pending_find(mgmt_op, hdev);
        if (!cmd)
                goto unlock;
 
@@ -3003,7 +3055,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_DISCONNECT, hdev)) {
+       if (pending_find(MGMT_OP_DISCONNECT, hdev)) {
                err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT,
                                        MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto failed;
@@ -3467,7 +3519,7 @@ static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                goto unlock;
        }
 
-       cmd = mgmt_pending_find(MGMT_OP_PAIR_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev);
        if (!cmd) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE,
                                      MGMT_STATUS_INVALID_PARAMS);
@@ -3645,7 +3697,7 @@ static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
+       cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
        if (!cmd)
                goto unlock;
 
@@ -3697,8 +3749,8 @@ static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data,
                if (err < 0)
                        goto failed;
 
-               err = mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, len,
-                                sk);
+               err = mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev,
+                                        data, len, sk);
 
                goto failed;
        }
@@ -3733,10 +3785,70 @@ failed:
        return err;
 }
 
-static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
+static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status,
+                                        u16 opcode, struct sk_buff *skb)
+{
+       struct mgmt_rp_read_local_oob_data mgmt_rp;
+       size_t rp_size = sizeof(mgmt_rp);
+       struct mgmt_pending_cmd *cmd;
+
+       BT_DBG("%s status %u", hdev->name, status);
+
+       cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
+       if (!cmd)
+               return;
+
+       if (status || !skb) {
+               mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                               status ? mgmt_status(status) : MGMT_STATUS_FAILED);
+               goto remove;
+       }
+
+       memset(&mgmt_rp, 0, sizeof(mgmt_rp));
+
+       if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
+               struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
+
+               if (skb->len < sizeof(*rp)) {
+                       mgmt_cmd_status(cmd->sk, hdev->id,
+                                       MGMT_OP_READ_LOCAL_OOB_DATA,
+                                       MGMT_STATUS_FAILED);
+                       goto remove;
+               }
+
+               memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash));
+               memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand));
+
+               rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256);
+       } else {
+               struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
+
+               if (skb->len < sizeof(*rp)) {
+                       mgmt_cmd_status(cmd->sk, hdev->id,
+                                       MGMT_OP_READ_LOCAL_OOB_DATA,
+                                       MGMT_STATUS_FAILED);
+                       goto remove;
+               }
+
+               memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192));
+               memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192));
+
+               memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256));
+               memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256));
+       }
+
+       mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+                         MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size);
+
+remove:
+       mgmt_pending_remove(cmd);
+}
+
+static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                               void *data, u16 data_len)
 {
        struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
        int err;
 
        BT_DBG("%s", hdev->name);
@@ -3755,7 +3867,7 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
+       if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -3767,12 +3879,14 @@ static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev,
                goto unlock;
        }
 
+       hci_req_init(&req, hdev);
+
        if (bredr_sc_enabled(hdev))
-               err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_EXT_DATA,
-                                  0, NULL);
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
        else
-               err = hci_send_cmd(hdev, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
 
+       err = hci_req_run_skb(&req, read_local_oob_data_complete);
        if (err < 0)
                mgmt_pending_remove(cmd);
 
@@ -3925,93 +4039,129 @@ done:
        return err;
 }
 
-static bool trigger_discovery(struct hci_request *req, u8 *status)
+static bool trigger_bredr_inquiry(struct hci_request *req, u8 *status)
 {
        struct hci_dev *hdev = req->hdev;
-       struct hci_cp_le_set_scan_param param_cp;
-       struct hci_cp_le_set_scan_enable enable_cp;
-       struct hci_cp_inquiry inq_cp;
+       struct hci_cp_inquiry cp;
        /* General inquiry access code (GIAC) */
        u8 lap[3] = { 0x33, 0x8b, 0x9e };
+
+       *status = mgmt_bredr_support(hdev);
+       if (*status)
+               return false;
+
+       if (hci_dev_test_flag(hdev, HCI_INQUIRY)) {
+               *status = MGMT_STATUS_BUSY;
+               return false;
+       }
+
+       hci_inquiry_cache_flush(hdev);
+
+       memset(&cp, 0, sizeof(cp));
+       memcpy(&cp.lap, lap, sizeof(cp.lap));
+       cp.length = DISCOV_BREDR_INQUIRY_LEN;
+
+       hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
+
+       return true;
+}
+
+static bool trigger_le_scan(struct hci_request *req, u16 interval, u8 *status)
+{
+       struct hci_dev *hdev = req->hdev;
+       struct hci_cp_le_set_scan_param param_cp;
+       struct hci_cp_le_set_scan_enable enable_cp;
        u8 own_addr_type;
        int err;
 
-       switch (hdev->discovery.type) {
-       case DISCOV_TYPE_BREDR:
-               *status = mgmt_bredr_support(hdev);
-               if (*status)
-                       return false;
+       *status = mgmt_le_support(hdev);
+       if (*status)
+               return false;
 
-               if (test_bit(HCI_INQUIRY, &hdev->flags)) {
-                       *status = MGMT_STATUS_BUSY;
+       if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
+               /* Don't let discovery abort an outgoing connection attempt
+                * that's using directed advertising.
+                */
+               if (hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
+                       *status = MGMT_STATUS_REJECTED;
                        return false;
                }
 
-               hci_inquiry_cache_flush(hdev);
+               disable_advertising(req);
+       }
 
-               memset(&inq_cp, 0, sizeof(inq_cp));
-               memcpy(&inq_cp.lap, lap, sizeof(inq_cp.lap));
-               inq_cp.length = DISCOV_BREDR_INQUIRY_LEN;
-               hci_req_add(req, HCI_OP_INQUIRY, sizeof(inq_cp), &inq_cp);
-               break;
+       /* If controller is scanning, it means the background scanning is
+        * running. Thus, we should temporarily stop it in order to set the
+        * discovery scanning parameters.
+        */
+       if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
+               hci_req_add_le_scan_disable(req);
 
-       case DISCOV_TYPE_LE:
-       case DISCOV_TYPE_INTERLEAVED:
-               *status = mgmt_le_support(hdev);
-               if (*status)
-                       return false;
+       /* All active scans will be done with either a resolvable private
+        * address (when privacy feature has been enabled) or non-resolvable
+        * private address.
+        */
+       err = hci_update_random_address(req, true, &own_addr_type);
+       if (err < 0) {
+               *status = MGMT_STATUS_FAILED;
+               return false;
+       }
 
-               if (hdev->discovery.type == DISCOV_TYPE_INTERLEAVED &&
-                   !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
-                       *status = MGMT_STATUS_NOT_SUPPORTED;
+       memset(&param_cp, 0, sizeof(param_cp));
+       param_cp.type = LE_SCAN_ACTIVE;
+       param_cp.interval = cpu_to_le16(interval);
+       param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
+       param_cp.own_address_type = own_addr_type;
+
+       hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
+                   &param_cp);
+
+       memset(&enable_cp, 0, sizeof(enable_cp));
+       enable_cp.enable = LE_SCAN_ENABLE;
+       enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
+
+       hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
+                   &enable_cp);
+
+       return true;
+}
+
+static bool trigger_discovery(struct hci_request *req, u8 *status)
+{
+       struct hci_dev *hdev = req->hdev;
+
+       switch (hdev->discovery.type) {
+       case DISCOV_TYPE_BREDR:
+               if (!trigger_bredr_inquiry(req, status))
                        return false;
-               }
+               break;
 
-               if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
-                       /* Don't let discovery abort an outgoing
-                        * connection attempt that's using directed
-                        * advertising.
+       case DISCOV_TYPE_INTERLEAVED:
+               if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
+                            &hdev->quirks)) {
+                       /* During simultaneous discovery, we double LE scan
+                        * interval. We must leave some time for the controller
+                        * to do BR/EDR inquiry.
                         */
-                       if (hci_conn_hash_lookup_state(hdev, LE_LINK,
-                                                      BT_CONNECT)) {
-                               *status = MGMT_STATUS_REJECTED;
+                       if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT * 2,
+                                            status))
                                return false;
-                       }
-
-                       disable_advertising(req);
-               }
 
-               /* If controller is scanning, it means the background scanning
-                * is running. Thus, we should temporarily stop it in order to
-                * set the discovery scanning parameters.
-                */
-               if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
-                       hci_req_add_le_scan_disable(req);
+                       if (!trigger_bredr_inquiry(req, status))
+                               return false;
 
-               memset(&param_cp, 0, sizeof(param_cp));
+                       return true;
+               }
 
-               /* All active scans will be done with either a resolvable
-                * private address (when privacy feature has been enabled)
-                * or non-resolvable private address.
-                */
-               err = hci_update_random_address(req, true, &own_addr_type);
-               if (err < 0) {
-                       *status = MGMT_STATUS_FAILED;
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
+                       *status = MGMT_STATUS_NOT_SUPPORTED;
                        return false;
                }
+               /* fall through */
 
-               param_cp.type = LE_SCAN_ACTIVE;
-               param_cp.interval = cpu_to_le16(DISCOV_LE_SCAN_INT);
-               param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
-               param_cp.own_address_type = own_addr_type;
-               hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
-                           &param_cp);
-
-               memset(&enable_cp, 0, sizeof(enable_cp));
-               enable_cp.enable = LE_SCAN_ENABLE;
-               enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
-               hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
-                           &enable_cp);
+       case DISCOV_TYPE_LE:
+               if (!trigger_le_scan(req, DISCOV_LE_SCAN_INT, status))
+                       return false;
                break;
 
        default:
@@ -4032,9 +4182,9 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_START_DISCOVERY, hdev);
+       cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev);
        if (!cmd)
-               cmd = mgmt_pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
+               cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev);
 
        if (cmd) {
                cmd->cmd_complete(cmd, mgmt_status(status));
@@ -4056,7 +4206,18 @@ static void start_discovery_complete(struct hci_dev *hdev, u8 status,
                timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
                break;
        case DISCOV_TYPE_INTERLEAVED:
-               timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
+                /* When running simultaneous discovery, the LE scanning time
+                * should occupy the whole discovery time sine BR/EDR inquiry
+                * and LE scanning are scheduled by the controller.
+                *
+                * For interleaving discovery in comparison, BR/EDR inquiry
+                * and LE scanning are done sequentially with separate
+                * timeouts.
+                */
+               if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
+                       timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
+               else
+                       timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
                break;
        case DISCOV_TYPE_BREDR:
                timeout = 0;
@@ -4278,7 +4439,7 @@ static void stop_discovery_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
+       cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev);
        if (cmd) {
                cmd->cmd_complete(cmd, mgmt_status(status));
                mgmt_pending_remove(cmd);
@@ -4497,10 +4658,17 @@ static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data,
        return err;
 }
 
+static void enable_advertising_instance(struct hci_dev *hdev, u8 status,
+                                       u16 opcode)
+{
+       BT_DBG("status %d", status);
+}
+
 static void set_advertising_complete(struct hci_dev *hdev, u8 status,
                                     u16 opcode)
 {
        struct cmd_lookup match = { NULL, hdev };
+       struct hci_request req;
 
        hci_dev_lock(hdev);
 
@@ -4525,6 +4693,21 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status,
        if (match.sk)
                sock_put(match.sk);
 
+       /* If "Set Advertising" was just disabled and instance advertising was
+        * set up earlier, then enable the advertising instance.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               goto unlock;
+
+       hci_req_init(&req, hdev);
+
+       update_adv_data(&req);
+       enable_advertising(&req);
+
+       if (hci_req_run(&req, enable_advertising_instance) < 0)
+               BT_ERR("Failed to re-configure advertising");
+
 unlock:
        hci_dev_unlock(hdev);
 }
@@ -4587,8 +4770,8 @@ static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
                goto unlock;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
-           mgmt_pending_find(MGMT_OP_SET_LE, hdev)) {
+       if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -4607,10 +4790,14 @@ static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
        else
                hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
 
-       if (val)
+       if (val) {
+               /* Switch to instance "0" for the Set Advertising setting. */
+               update_adv_data_for_instance(&req, 0);
+               update_scan_rsp_data_for_instance(&req, 0);
                enable_advertising(&req);
-       else
+       } else {
                disable_advertising(&req);
+       }
 
        err = hci_req_run(&req, set_advertising_complete);
        if (err < 0)
@@ -4731,7 +4918,7 @@ static void fast_connectable_complete(struct hci_dev *hdev, u8 status,
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
+       cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -4777,7 +4964,7 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
 
        hci_dev_lock(hdev);
 
-       if (mgmt_pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
+       if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -4829,7 +5016,7 @@ static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_BREDR, hdev);
+       cmd = pending_find(MGMT_OP_SET_BREDR, hdev);
        if (!cmd)
                goto unlock;
 
@@ -4929,7 +5116,7 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
                }
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_BREDR, hdev)) {
+       if (pending_find(MGMT_OP_SET_BREDR, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR,
                                      MGMT_STATUS_BUSY);
                goto unlock;
@@ -4974,7 +5161,7 @@ static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
+       cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev);
        if (!cmd)
                goto unlock;
 
@@ -5065,7 +5252,7 @@ static int set_secure_conn(struct sock *sk, struct hci_dev *hdev,
                goto failed;
        }
 
-       if (mgmt_pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
+       if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) {
                err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN,
                                      MGMT_STATUS_BUSY);
                goto failed;
@@ -5458,7 +5645,7 @@ static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status,
                goto unlock;
        }
 
-       cmd = mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
+       cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn);
        if (!cmd)
                goto unlock;
 
@@ -5511,7 +5698,7 @@ static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data,
                goto unlock;
        }
 
-       if (mgmt_pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
+       if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) {
                err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO,
                                        MGMT_STATUS_BUSY, &rp, sizeof(rp));
                goto unlock;
@@ -5647,7 +5834,7 @@ static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode)
                conn = NULL;
        }
 
-       cmd = mgmt_pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
+       cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn);
        if (!cmd)
                goto unlock;
 
@@ -5813,7 +6000,7 @@ static void add_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_ADD_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_ADD_DEVICE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -5936,7 +6123,7 @@ static void remove_device_complete(struct hci_dev *hdev, u8 status, u16 opcode)
 
        hci_dev_lock(hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
+       cmd = pending_find(MGMT_OP_REMOVE_DEVICE, hdev);
        if (!cmd)
                goto unlock;
 
@@ -6268,233 +6455,832 @@ unlock:
        return err;
 }
 
-static const struct hci_mgmt_handler mgmt_handlers[] = {
-       { NULL }, /* 0x0000 (no command) */
-       { read_version,            MGMT_READ_VERSION_SIZE,
-                                               HCI_MGMT_NO_HDEV },
-       { read_commands,           MGMT_READ_COMMANDS_SIZE,
-                                               HCI_MGMT_NO_HDEV },
-       { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
-                                               HCI_MGMT_NO_HDEV },
-       { read_controller_info,    MGMT_READ_INFO_SIZE,                 0 },
-       { set_powered,             MGMT_SETTING_SIZE,                   0 },
-       { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE,          0 },
-       { set_connectable,         MGMT_SETTING_SIZE,                   0 },
-       { set_fast_connectable,    MGMT_SETTING_SIZE,                   0 },
-       { set_bondable,            MGMT_SETTING_SIZE,                   0 },
-       { set_link_security,       MGMT_SETTING_SIZE,                   0 },
-       { set_ssp,                 MGMT_SETTING_SIZE,                   0 },
-       { set_hs,                  MGMT_SETTING_SIZE,                   0 },
-       { set_le,                  MGMT_SETTING_SIZE,                   0 },
-       { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE,             0 },
-       { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE,            0 },
-       { add_uuid,                MGMT_ADD_UUID_SIZE,                  0 },
-       { remove_uuid,             MGMT_REMOVE_UUID_SIZE,               0 },
-       { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { disconnect,              MGMT_DISCONNECT_SIZE,                0 },
-       { get_connections,         MGMT_GET_CONNECTIONS_SIZE,           0 },
-       { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE,            0 },
-       { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE,        0 },
-       { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE,         0 },
-       { pair_device,             MGMT_PAIR_DEVICE_SIZE,               0 },
-       { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE,        0 },
-       { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE,             0 },
-       { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE,        0 },
-       { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE,    0 },
-       { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE,        0 },
-       { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE,    0 },
-       { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
-       { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE,    0 },
-       { start_discovery,         MGMT_START_DISCOVERY_SIZE,           0 },
-       { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE,            0 },
-       { confirm_name,            MGMT_CONFIRM_NAME_SIZE,              0 },
-       { block_device,            MGMT_BLOCK_DEVICE_SIZE,              0 },
-       { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE,            0 },
-       { set_device_id,           MGMT_SET_DEVICE_ID_SIZE,             0 },
-       { set_advertising,         MGMT_SETTING_SIZE,                   0 },
-       { set_bredr,               MGMT_SETTING_SIZE,                   0 },
-       { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE,        0 },
-       { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE,           0 },
-       { set_secure_conn,         MGMT_SETTING_SIZE,                   0 },
-       { set_debug_keys,          MGMT_SETTING_SIZE,                   0 },
-       { set_privacy,             MGMT_SET_PRIVACY_SIZE,               0 },
-       { load_irks,               MGMT_LOAD_IRKS_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { get_conn_info,           MGMT_GET_CONN_INFO_SIZE,             0 },
-       { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE,            0 },
-       { add_device,              MGMT_ADD_DEVICE_SIZE,                0 },
-       { remove_device,           MGMT_REMOVE_DEVICE_SIZE,             0 },
-       { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
-                                               HCI_MGMT_NO_HDEV },
-       { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
-                                               HCI_MGMT_UNCONFIGURED },
-       { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
-                                               HCI_MGMT_UNCONFIGURED },
-       { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
-                                               HCI_MGMT_UNCONFIGURED },
-       { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
-                                               HCI_MGMT_VAR_LEN },
-       { NULL },
-       { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
-                                               HCI_MGMT_NO_HDEV },
-};
-
-int mgmt_control(struct hci_mgmt_chan *chan, struct sock *sk,
-                struct msghdr *msg, size_t msglen)
+static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
+                                 u8 data_len)
 {
-       void *buf;
-       u8 *cp;
-       struct mgmt_hdr *hdr;
-       u16 opcode, index, len;
-       struct hci_dev *hdev = NULL;
-       const struct hci_mgmt_handler *handler;
-       bool var_len, no_hdev;
-       int err;
+       eir[eir_len++] = sizeof(type) + data_len;
+       eir[eir_len++] = type;
+       memcpy(&eir[eir_len], data, data_len);
+       eir_len += data_len;
 
-       BT_DBG("got %zu bytes", msglen);
+       return eir_len;
+}
 
-       if (msglen < sizeof(*hdr))
-               return -EINVAL;
+static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status,
+                                            u16 opcode, struct sk_buff *skb)
+{
+       const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp;
+       struct mgmt_rp_read_local_oob_ext_data *mgmt_rp;
+       u8 *h192, *r192, *h256, *r256;
+       struct mgmt_pending_cmd *cmd;
+       u16 eir_len;
+       int err;
 
-       buf = kmalloc(msglen, GFP_KERNEL);
-       if (!buf)
-               return -ENOMEM;
+       BT_DBG("%s status %u", hdev->name, status);
 
-       if (memcpy_from_msg(buf, msg, msglen)) {
-               err = -EFAULT;
-               goto done;
-       }
+       cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev);
+       if (!cmd)
+               return;
 
-       hdr = buf;
-       opcode = __le16_to_cpu(hdr->opcode);
-       index = __le16_to_cpu(hdr->index);
-       len = __le16_to_cpu(hdr->len);
+       mgmt_cp = cmd->param;
 
-       if (len != msglen - sizeof(*hdr)) {
-               err = -EINVAL;
-               goto done;
-       }
+       if (status) {
+               status = mgmt_status(status);
+               eir_len = 0;
 
-       if (opcode >= chan->handler_count ||
-           chan->handlers[opcode].func == NULL) {
-               BT_DBG("Unknown op %u", opcode);
-               err = mgmt_cmd_status(sk, index, opcode,
-                                     MGMT_STATUS_UNKNOWN_COMMAND);
-               goto done;
-       }
+               h192 = NULL;
+               r192 = NULL;
+               h256 = NULL;
+               r256 = NULL;
+       } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) {
+               struct hci_rp_read_local_oob_data *rp;
 
-       handler = &chan->handlers[opcode];
+               if (skb->len != sizeof(*rp)) {
+                       status = MGMT_STATUS_FAILED;
+                       eir_len = 0;
+               } else {
+                       status = MGMT_STATUS_SUCCESS;
+                       rp = (void *)skb->data;
 
-       if (index != MGMT_INDEX_NONE) {
-               hdev = hci_dev_get(index);
-               if (!hdev) {
-                       err = mgmt_cmd_status(sk, index, opcode,
-                                             MGMT_STATUS_INVALID_INDEX);
-                       goto done;
+                       eir_len = 5 + 18 + 18;
+                       h192 = rp->hash;
+                       r192 = rp->rand;
+                       h256 = NULL;
+                       r256 = NULL;
                }
+       } else {
+               struct hci_rp_read_local_oob_ext_data *rp;
 
-               if (hci_dev_test_flag(hdev, HCI_SETUP) ||
-                   hci_dev_test_flag(hdev, HCI_CONFIG) ||
-                   hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
-                       err = mgmt_cmd_status(sk, index, opcode,
-                                             MGMT_STATUS_INVALID_INDEX);
-                       goto done;
-               }
+               if (skb->len != sizeof(*rp)) {
+                       status = MGMT_STATUS_FAILED;
+                       eir_len = 0;
+               } else {
+                       status = MGMT_STATUS_SUCCESS;
+                       rp = (void *)skb->data;
+
+                       if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
+                               eir_len = 5 + 18 + 18;
+                               h192 = NULL;
+                               r192 = NULL;
+                       } else {
+                               eir_len = 5 + 18 + 18 + 18 + 18;
+                               h192 = rp->hash192;
+                               r192 = rp->rand192;
+                       }
 
-               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
-                   !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
-                       err = mgmt_cmd_status(sk, index, opcode,
-                                             MGMT_STATUS_INVALID_INDEX);
-                       goto done;
+                       h256 = rp->hash256;
+                       r256 = rp->rand256;
                }
        }
 
-       no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
-       if (no_hdev != !hdev) {
-               err = mgmt_cmd_status(sk, index, opcode,
-                                     MGMT_STATUS_INVALID_INDEX);
+       mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL);
+       if (!mgmt_rp)
                goto done;
-       }
 
-       var_len = (handler->flags & HCI_MGMT_VAR_LEN);
-       if ((var_len && len < handler->data_len) ||
-           (!var_len && len != handler->data_len)) {
-               err = mgmt_cmd_status(sk, index, opcode,
-                                     MGMT_STATUS_INVALID_PARAMS);
-               goto done;
+       if (status)
+               goto send_rsp;
+
+       eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV,
+                                 hdev->dev_class, 3);
+
+       if (h192 && r192) {
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_HASH_C192, h192, 16);
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_RAND_R192, r192, 16);
        }
 
-       if (hdev)
-               mgmt_init_hdev(sk, hdev);
+       if (h256 && r256) {
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_HASH_C256, h256, 16);
+               eir_len = eir_append_data(mgmt_rp->eir, eir_len,
+                                         EIR_SSP_RAND_R256, r256, 16);
+       }
 
-       cp = buf + sizeof(*hdr);
+send_rsp:
+       mgmt_rp->type = mgmt_cp->type;
+       mgmt_rp->eir_len = cpu_to_le16(eir_len);
 
-       err = handler->func(sk, hdev, cp, len);
-       if (err < 0)
+       err = mgmt_cmd_complete(cmd->sk, hdev->id,
+                               MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status,
+                               mgmt_rp, sizeof(*mgmt_rp) + eir_len);
+       if (err < 0 || status)
                goto done;
 
-       err = msglen;
+       hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS);
 
+       err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
+                                mgmt_rp, sizeof(*mgmt_rp) + eir_len,
+                                HCI_MGMT_OOB_DATA_EVENTS, cmd->sk);
 done:
-       if (hdev)
-               hci_dev_put(hdev);
-
-       kfree(buf);
-       return err;
+       kfree(mgmt_rp);
+       mgmt_pending_remove(cmd);
 }
 
-void mgmt_index_added(struct hci_dev *hdev)
+static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
+                                 struct mgmt_cp_read_local_oob_ext_data *cp)
 {
-       struct mgmt_ev_ext_index ev;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
+       int err;
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-               return;
+       cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
+                              cp, sizeof(*cp));
+       if (!cmd)
+               return -ENOMEM;
 
-       switch (hdev->dev_type) {
-       case HCI_BREDR:
-               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
-                       mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
-                                        NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
-                       ev.type = 0x01;
-               } else {
-                       mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
-                                        HCI_MGMT_INDEX_EVENTS);
-                       ev.type = 0x00;
-               }
-               break;
-       case HCI_AMP:
-               ev.type = 0x02;
-               break;
-       default:
-               return;
-       }
+       hci_req_init(&req, hdev);
 
-       ev.bus = hdev->bus;
+       if (bredr_sc_enabled(hdev))
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL);
+       else
+               hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL);
 
-       mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
-                        HCI_MGMT_EXT_INDEX_EVENTS);
+       err = hci_req_run_skb(&req, read_local_oob_ext_data_complete);
+       if (err < 0) {
+               mgmt_pending_remove(cmd);
+               return err;
+       }
+
+       return 0;
 }
 
-void mgmt_index_removed(struct hci_dev *hdev)
+static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev,
+                                  void *data, u16 data_len)
 {
-       struct mgmt_ev_ext_index ev;
-       u8 status = MGMT_STATUS_INVALID_INDEX;
+       struct mgmt_cp_read_local_oob_ext_data *cp = data;
+       struct mgmt_rp_read_local_oob_ext_data *rp;
+       size_t rp_len;
+       u16 eir_len;
+       u8 status, flags, role, addr[7], hash[16], rand[16];
+       int err;
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-               return;
+       BT_DBG("%s", hdev->name);
 
-       switch (hdev->dev_type) {
-       case HCI_BREDR:
-               mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+       if (hdev_is_powered(hdev)) {
+               switch (cp->type) {
+               case BIT(BDADDR_BREDR):
+                       status = mgmt_bredr_support(hdev);
+                       if (status)
+                               eir_len = 0;
+                       else
+                               eir_len = 5;
+                       break;
+               case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
+                       status = mgmt_le_support(hdev);
+                       if (status)
+                               eir_len = 0;
+                       else
+                               eir_len = 9 + 3 + 18 + 18 + 3;
+                       break;
+               default:
+                       status = MGMT_STATUS_INVALID_PARAMS;
+                       eir_len = 0;
+                       break;
+               }
+       } else {
+               status = MGMT_STATUS_NOT_POWERED;
+               eir_len = 0;
+       }
 
-               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+       rp_len = sizeof(*rp) + eir_len;
+       rp = kmalloc(rp_len, GFP_ATOMIC);
+       if (!rp)
+               return -ENOMEM;
+
+       if (status)
+               goto complete;
+
+       hci_dev_lock(hdev);
+
+       eir_len = 0;
+       switch (cp->type) {
+       case BIT(BDADDR_BREDR):
+               if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
+                       err = read_local_ssp_oob_req(hdev, sk, cp);
+                       hci_dev_unlock(hdev);
+                       if (!err)
+                               goto done;
+
+                       status = MGMT_STATUS_FAILED;
+                       goto complete;
+               } else {
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_CLASS_OF_DEV,
+                                                 hdev->dev_class, 3);
+               }
+               break;
+       case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)):
+               if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) &&
+                   smp_generate_oob(hdev, hash, rand) < 0) {
+                       hci_dev_unlock(hdev);
+                       status = MGMT_STATUS_FAILED;
+                       goto complete;
+               }
+
+               /* This should return the active RPA, but since the RPA
+                * is only programmed on demand, it is really hard to fill
+                * this in at the moment. For now disallow retrieving
+                * local out-of-band data when privacy is in use.
+                *
+                * Returning the identity address will not help here since
+                * pairing happens before the identity resolving key is
+                * known and thus the connection establishment happens
+                * based on the RPA and not the identity address.
+                */
+               if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
+                       hci_dev_unlock(hdev);
+                       status = MGMT_STATUS_REJECTED;
+                       goto complete;
+               }
+
+               if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
+                  !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
+                  (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
+                   bacmp(&hdev->static_addr, BDADDR_ANY))) {
+                       memcpy(addr, &hdev->static_addr, 6);
+                       addr[6] = 0x01;
+               } else {
+                       memcpy(addr, &hdev->bdaddr, 6);
+                       addr[6] = 0x00;
+               }
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR,
+                                         addr, sizeof(addr));
+
+               if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+                       role = 0x02;
+               else
+                       role = 0x01;
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE,
+                                         &role, sizeof(role));
+
+               if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) {
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_LE_SC_CONFIRM,
+                                                 hash, sizeof(hash));
+
+                       eir_len = eir_append_data(rp->eir, eir_len,
+                                                 EIR_LE_SC_RANDOM,
+                                                 rand, sizeof(rand));
+               }
+
+               flags = get_adv_discov_flags(hdev);
+
+               if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
+                       flags |= LE_AD_NO_BREDR;
+
+               eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS,
+                                         &flags, sizeof(flags));
+               break;
+       }
+
+       hci_dev_unlock(hdev);
+
+       hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS);
+
+       status = MGMT_STATUS_SUCCESS;
+
+complete:
+       rp->type = cp->type;
+       rp->eir_len = cpu_to_le16(eir_len);
+
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
+                               status, rp, sizeof(*rp) + eir_len);
+       if (err < 0 || status)
+               goto done;
+
+       err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev,
+                                rp, sizeof(*rp) + eir_len,
+                                HCI_MGMT_OOB_DATA_EVENTS, sk);
+
+done:
+       kfree(rp);
+
+       return err;
+}
+
+static u32 get_supported_adv_flags(struct hci_dev *hdev)
+{
+       u32 flags = 0;
+
+       flags |= MGMT_ADV_FLAG_CONNECTABLE;
+       flags |= MGMT_ADV_FLAG_DISCOV;
+       flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
+       flags |= MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       if (hdev->adv_tx_power != HCI_TX_POWER_INVALID)
+               flags |= MGMT_ADV_FLAG_TX_POWER;
+
+       return flags;
+}
+
+static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
+                            void *data, u16 data_len)
+{
+       struct mgmt_rp_read_adv_features *rp;
+       size_t rp_len;
+       int err;
+       bool instance;
+       u32 supported_flags;
+
+       BT_DBG("%s", hdev->name);
+
+       if (!lmp_le_capable(hdev))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
+                                      MGMT_STATUS_REJECTED);
+
+       hci_dev_lock(hdev);
+
+       rp_len = sizeof(*rp);
+
+       /* Currently only one instance is supported, so just add 1 to the
+        * response length.
+        */
+       instance = hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE);
+       if (instance)
+               rp_len++;
+
+       rp = kmalloc(rp_len, GFP_ATOMIC);
+       if (!rp) {
+               hci_dev_unlock(hdev);
+               return -ENOMEM;
+       }
+
+       supported_flags = get_supported_adv_flags(hdev);
+
+       rp->supported_flags = cpu_to_le32(supported_flags);
+       rp->max_adv_data_len = HCI_MAX_AD_LENGTH;
+       rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH;
+       rp->max_instances = 1;
+
+       /* Currently only one instance is supported, so simply return the
+        * current instance number.
+        */
+       if (instance) {
+               rp->num_instances = 1;
+               rp->instance[0] = 1;
+       } else {
+               rp->num_instances = 0;
+       }
+
+       hci_dev_unlock(hdev);
+
+       err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES,
+                               MGMT_STATUS_SUCCESS, rp, rp_len);
+
+       kfree(rp);
+
+       return err;
+}
+
+static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data,
+                             u8 len, bool is_adv_data)
+{
+       u8 max_len = HCI_MAX_AD_LENGTH;
+       int i, cur_len;
+       bool flags_managed = false;
+       bool tx_power_managed = false;
+       u32 flags_params = MGMT_ADV_FLAG_DISCOV | MGMT_ADV_FLAG_LIMITED_DISCOV |
+                          MGMT_ADV_FLAG_MANAGED_FLAGS;
+
+       if (is_adv_data && (adv_flags & flags_params)) {
+               flags_managed = true;
+               max_len -= 3;
+       }
+
+       if (is_adv_data && (adv_flags & MGMT_ADV_FLAG_TX_POWER)) {
+               tx_power_managed = true;
+               max_len -= 3;
+       }
+
+       if (len > max_len)
+               return false;
+
+       /* Make sure that the data is correctly formatted. */
+       for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) {
+               cur_len = data[i];
+
+               if (flags_managed && data[i + 1] == EIR_FLAGS)
+                       return false;
+
+               if (tx_power_managed && data[i + 1] == EIR_TX_POWER)
+                       return false;
+
+               /* If the current field length would exceed the total data
+                * length, then it's invalid.
+                */
+               if (i + cur_len >= len)
+                       return false;
+       }
+
+       return true;
+}
+
+static void add_advertising_complete(struct hci_dev *hdev, u8 status,
+                                    u16 opcode)
+{
+       struct mgmt_pending_cmd *cmd;
+       struct mgmt_rp_add_advertising rp;
+
+       BT_DBG("status %d", status);
+
+       hci_dev_lock(hdev);
+
+       cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev);
+
+       if (status) {
+               hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
+               memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
+               advertising_removed(cmd ? cmd->sk : NULL, hdev, 1);
+       }
+
+       if (!cmd)
+               goto unlock;
+
+       rp.instance = 0x01;
+
+       if (status)
+               mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode,
+                               mgmt_status(status));
+       else
+               mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
+                                 mgmt_status(status), &rp, sizeof(rp));
+
+       mgmt_pending_remove(cmd);
+
+unlock:
+       hci_dev_unlock(hdev);
+}
+
+static void adv_timeout_expired(struct work_struct *work)
+{
+       struct hci_dev *hdev = container_of(work, struct hci_dev,
+                                           adv_instance.timeout_exp.work);
+
+       hdev->adv_instance.timeout = 0;
+
+       hci_dev_lock(hdev);
+       clear_adv_instance(hdev);
+       hci_dev_unlock(hdev);
+}
+
+static int add_advertising(struct sock *sk, struct hci_dev *hdev,
+                          void *data, u16 data_len)
+{
+       struct mgmt_cp_add_advertising *cp = data;
+       struct mgmt_rp_add_advertising rp;
+       u32 flags;
+       u32 supported_flags;
+       u8 status;
+       u16 timeout;
+       int err;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
+
+       BT_DBG("%s", hdev->name);
+
+       status = mgmt_le_support(hdev);
+       if (status)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                      status);
+
+       flags = __le32_to_cpu(cp->flags);
+       timeout = __le16_to_cpu(cp->timeout);
+
+       /* The current implementation only supports adding one instance and only
+        * a subset of the specified flags.
+        */
+       supported_flags = get_supported_adv_flags(hdev);
+       if (cp->instance != 0x01 || (flags & ~supported_flags))
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                      MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       if (timeout && !hdev_is_powered(hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_REJECTED);
+               goto unlock;
+       }
+
+       if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_BUSY);
+               goto unlock;
+       }
+
+       if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) ||
+           !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len,
+                              cp->scan_rsp_len, false)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                     MGMT_STATUS_INVALID_PARAMS);
+               goto unlock;
+       }
+
+       INIT_DELAYED_WORK(&hdev->adv_instance.timeout_exp, adv_timeout_expired);
+
+       hdev->adv_instance.flags = flags;
+       hdev->adv_instance.adv_data_len = cp->adv_data_len;
+       hdev->adv_instance.scan_rsp_len = cp->scan_rsp_len;
+
+       if (cp->adv_data_len)
+               memcpy(hdev->adv_instance.adv_data, cp->data, cp->adv_data_len);
+
+       if (cp->scan_rsp_len)
+               memcpy(hdev->adv_instance.scan_rsp_data,
+                      cp->data + cp->adv_data_len, cp->scan_rsp_len);
+
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
+
+       hdev->adv_instance.timeout = timeout;
+
+       if (timeout)
+               queue_delayed_work(hdev->workqueue,
+                                  &hdev->adv_instance.timeout_exp,
+                                  msecs_to_jiffies(timeout * 1000));
+
+       if (!hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING_INSTANCE))
+               advertising_added(sk, hdev, 1);
+
+       /* If the HCI_ADVERTISING flag is set or the device isn't powered then
+        * we have no HCI communication to make. Simply return.
+        */
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+               rp.instance = 0x01;
+               err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
+                                       MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+               goto unlock;
+       }
+
+       /* We're good to go, update advertising data, parameters, and start
+        * advertising.
+        */
+       cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data,
+                              data_len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto unlock;
+       }
+
+       hci_req_init(&req, hdev);
+
+       update_adv_data(&req);
+       update_scan_rsp_data(&req);
+       enable_advertising(&req);
+
+       err = hci_req_run(&req, add_advertising_complete);
+       if (err < 0)
+               mgmt_pending_remove(cmd);
+
+unlock:
+       hci_dev_unlock(hdev);
+
+       return err;
+}
+
+static void remove_advertising_complete(struct hci_dev *hdev, u8 status,
+                                       u16 opcode)
+{
+       struct mgmt_pending_cmd *cmd;
+       struct mgmt_rp_remove_advertising rp;
+
+       BT_DBG("status %d", status);
+
+       hci_dev_lock(hdev);
+
+       /* A failure status here only means that we failed to disable
+        * advertising. Otherwise, the advertising instance has been removed,
+        * so report success.
+        */
+       cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev);
+       if (!cmd)
+               goto unlock;
+
+       rp.instance = 1;
+
+       mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS,
+                         &rp, sizeof(rp));
+       mgmt_pending_remove(cmd);
+
+unlock:
+       hci_dev_unlock(hdev);
+}
+
+static int remove_advertising(struct sock *sk, struct hci_dev *hdev,
+                             void *data, u16 data_len)
+{
+       struct mgmt_cp_remove_advertising *cp = data;
+       struct mgmt_rp_remove_advertising rp;
+       int err;
+       struct mgmt_pending_cmd *cmd;
+       struct hci_request req;
+
+       BT_DBG("%s", hdev->name);
+
+       /* The current implementation only allows modifying instance no 1. A
+        * value of 0 indicates that all instances should be cleared.
+        */
+       if (cp->instance > 1)
+               return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                      MGMT_STATUS_INVALID_PARAMS);
+
+       hci_dev_lock(hdev);
+
+       if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) ||
+           pending_find(MGMT_OP_SET_LE, hdev)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                     MGMT_STATUS_BUSY);
+               goto unlock;
+       }
+
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE)) {
+               err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING,
+                                     MGMT_STATUS_INVALID_PARAMS);
+               goto unlock;
+       }
+
+       if (hdev->adv_instance.timeout)
+               cancel_delayed_work(&hdev->adv_instance.timeout_exp);
+
+       memset(&hdev->adv_instance, 0, sizeof(hdev->adv_instance));
+
+       advertising_removed(sk, hdev, 1);
+
+       hci_dev_clear_flag(hdev, HCI_ADVERTISING_INSTANCE);
+
+       /* If the HCI_ADVERTISING flag is set or the device isn't powered then
+        * we have no HCI communication to make. Simply return.
+        */
+       if (!hdev_is_powered(hdev) ||
+           hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
+               rp.instance = 1;
+               err = mgmt_cmd_complete(sk, hdev->id,
+                                       MGMT_OP_REMOVE_ADVERTISING,
+                                       MGMT_STATUS_SUCCESS, &rp, sizeof(rp));
+               goto unlock;
+       }
+
+       cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data,
+                              data_len);
+       if (!cmd) {
+               err = -ENOMEM;
+               goto unlock;
+       }
+
+       hci_req_init(&req, hdev);
+       disable_advertising(&req);
+
+       err = hci_req_run(&req, remove_advertising_complete);
+       if (err < 0)
+               mgmt_pending_remove(cmd);
+
+unlock:
+       hci_dev_unlock(hdev);
+
+       return err;
+}
+
+static const struct hci_mgmt_handler mgmt_handlers[] = {
+       { NULL }, /* 0x0000 (no command) */
+       { read_version,            MGMT_READ_VERSION_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_commands,           MGMT_READ_COMMANDS_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_index_list,         MGMT_READ_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_controller_info,    MGMT_READ_INFO_SIZE,
+                                               HCI_MGMT_UNTRUSTED },
+       { set_powered,             MGMT_SETTING_SIZE },
+       { set_discoverable,        MGMT_SET_DISCOVERABLE_SIZE },
+       { set_connectable,         MGMT_SETTING_SIZE },
+       { set_fast_connectable,    MGMT_SETTING_SIZE },
+       { set_bondable,            MGMT_SETTING_SIZE },
+       { set_link_security,       MGMT_SETTING_SIZE },
+       { set_ssp,                 MGMT_SETTING_SIZE },
+       { set_hs,                  MGMT_SETTING_SIZE },
+       { set_le,                  MGMT_SETTING_SIZE },
+       { set_dev_class,           MGMT_SET_DEV_CLASS_SIZE },
+       { set_local_name,          MGMT_SET_LOCAL_NAME_SIZE },
+       { add_uuid,                MGMT_ADD_UUID_SIZE },
+       { remove_uuid,             MGMT_REMOVE_UUID_SIZE },
+       { load_link_keys,          MGMT_LOAD_LINK_KEYS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { load_long_term_keys,     MGMT_LOAD_LONG_TERM_KEYS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { disconnect,              MGMT_DISCONNECT_SIZE },
+       { get_connections,         MGMT_GET_CONNECTIONS_SIZE },
+       { pin_code_reply,          MGMT_PIN_CODE_REPLY_SIZE },
+       { pin_code_neg_reply,      MGMT_PIN_CODE_NEG_REPLY_SIZE },
+       { set_io_capability,       MGMT_SET_IO_CAPABILITY_SIZE },
+       { pair_device,             MGMT_PAIR_DEVICE_SIZE },
+       { cancel_pair_device,      MGMT_CANCEL_PAIR_DEVICE_SIZE },
+       { unpair_device,           MGMT_UNPAIR_DEVICE_SIZE },
+       { user_confirm_reply,      MGMT_USER_CONFIRM_REPLY_SIZE },
+       { user_confirm_neg_reply,  MGMT_USER_CONFIRM_NEG_REPLY_SIZE },
+       { user_passkey_reply,      MGMT_USER_PASSKEY_REPLY_SIZE },
+       { user_passkey_neg_reply,  MGMT_USER_PASSKEY_NEG_REPLY_SIZE },
+       { read_local_oob_data,     MGMT_READ_LOCAL_OOB_DATA_SIZE },
+       { add_remote_oob_data,     MGMT_ADD_REMOTE_OOB_DATA_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { remove_remote_oob_data,  MGMT_REMOVE_REMOTE_OOB_DATA_SIZE },
+       { start_discovery,         MGMT_START_DISCOVERY_SIZE },
+       { stop_discovery,          MGMT_STOP_DISCOVERY_SIZE },
+       { confirm_name,            MGMT_CONFIRM_NAME_SIZE },
+       { block_device,            MGMT_BLOCK_DEVICE_SIZE },
+       { unblock_device,          MGMT_UNBLOCK_DEVICE_SIZE },
+       { set_device_id,           MGMT_SET_DEVICE_ID_SIZE },
+       { set_advertising,         MGMT_SETTING_SIZE },
+       { set_bredr,               MGMT_SETTING_SIZE },
+       { set_static_address,      MGMT_SET_STATIC_ADDRESS_SIZE },
+       { set_scan_params,         MGMT_SET_SCAN_PARAMS_SIZE },
+       { set_secure_conn,         MGMT_SETTING_SIZE },
+       { set_debug_keys,          MGMT_SETTING_SIZE },
+       { set_privacy,             MGMT_SET_PRIVACY_SIZE },
+       { load_irks,               MGMT_LOAD_IRKS_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { get_conn_info,           MGMT_GET_CONN_INFO_SIZE },
+       { get_clock_info,          MGMT_GET_CLOCK_INFO_SIZE },
+       { add_device,              MGMT_ADD_DEVICE_SIZE },
+       { remove_device,           MGMT_REMOVE_DEVICE_SIZE },
+       { load_conn_param,         MGMT_LOAD_CONN_PARAM_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { read_unconf_index_list,  MGMT_READ_UNCONF_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_config_info,        MGMT_READ_CONFIG_INFO_SIZE,
+                                               HCI_MGMT_UNCONFIGURED |
+                                               HCI_MGMT_UNTRUSTED },
+       { set_external_config,     MGMT_SET_EXTERNAL_CONFIG_SIZE,
+                                               HCI_MGMT_UNCONFIGURED },
+       { set_public_address,      MGMT_SET_PUBLIC_ADDRESS_SIZE,
+                                               HCI_MGMT_UNCONFIGURED },
+       { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE },
+       { read_ext_index_list,     MGMT_READ_EXT_INDEX_LIST_SIZE,
+                                               HCI_MGMT_NO_HDEV |
+                                               HCI_MGMT_UNTRUSTED },
+       { read_adv_features,       MGMT_READ_ADV_FEATURES_SIZE },
+       { add_advertising,         MGMT_ADD_ADVERTISING_SIZE,
+                                               HCI_MGMT_VAR_LEN },
+       { remove_advertising,      MGMT_REMOVE_ADVERTISING_SIZE },
+};
+
+void mgmt_index_added(struct hci_dev *hdev)
+{
+       struct mgmt_ev_ext_index ev;
+
+       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+               return;
+
+       switch (hdev->dev_type) {
+       case HCI_BREDR:
+               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
+                       mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev,
+                                        NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
+                       ev.type = 0x01;
+               } else {
+                       mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0,
+                                        HCI_MGMT_INDEX_EVENTS);
+                       ev.type = 0x00;
+               }
+               break;
+       case HCI_AMP:
+               ev.type = 0x02;
+               break;
+       default:
+               return;
+       }
+
+       ev.bus = hdev->bus;
+
+       mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev),
+                        HCI_MGMT_EXT_INDEX_EVENTS);
+}
+
+void mgmt_index_removed(struct hci_dev *hdev)
+{
+       struct mgmt_ev_ext_index ev;
+       u8 status = MGMT_STATUS_INVALID_INDEX;
+
+       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+               return;
+
+       switch (hdev->dev_type) {
+       case HCI_BREDR:
+               mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
+
+               if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
                        mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev,
                                         NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS);
                        ev.type = 0x01;
@@ -6619,7 +7405,8 @@ static int powered_update_hci(struct hci_dev *hdev)
                        update_scan_rsp_data(&req);
                }
 
-               if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
+                   hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                        enable_advertising(&req);
 
                restart_le_actions(&req);
@@ -6679,8 +7466,8 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
 
        if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
-               mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
-                          zero_cod, sizeof(zero_cod), NULL);
+               mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                  zero_cod, sizeof(zero_cod), NULL);
 
 new_settings:
        err = new_settings(hdev, match.sk);
@@ -6696,7 +7483,7 @@ void mgmt_set_powered_failed(struct hci_dev *hdev, int err)
        struct mgmt_pending_cmd *cmd;
        u8 status;
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+       cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
        if (!cmd)
                return;
 
@@ -6731,7 +7518,13 @@ void mgmt_discoverable_timeout(struct hci_dev *hdev)
                            sizeof(scan), &scan);
        }
        update_class(&req);
-       update_adv_data(&req);
+
+       /* Advertising instances don't use the global discoverable setting, so
+        * only update AD if advertising was enabled using Set Advertising.
+        */
+       if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+               update_adv_data(&req);
+
        hci_req_run(&req, NULL);
 
        hdev->discov_timeout = 0;
@@ -6896,17 +7689,6 @@ void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,
        mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL);
 }
 
-static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type, u8 *data,
-                                 u8 data_len)
-{
-       eir[eir_len++] = sizeof(type) + data_len;
-       eir[eir_len++] = type;
-       memcpy(&eir[eir_len], data, data_len);
-       eir_len += data_len;
-
-       return eir_len;
-}
-
 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
                           u32 flags, u8 *name, u8 name_len)
 {
@@ -6972,7 +7754,7 @@ bool mgmt_powering_down(struct hci_dev *hdev)
        struct mgmt_pending_cmd *cmd;
        struct mgmt_mode *cp;
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_POWERED, hdev);
+       cmd = pending_find(MGMT_OP_SET_POWERED, hdev);
        if (!cmd)
                return false;
 
@@ -7029,7 +7811,7 @@ void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr,
        mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp,
                             hdev);
 
-       cmd = mgmt_pending_find(MGMT_OP_DISCONNECT, hdev);
+       cmd = pending_find(MGMT_OP_DISCONNECT, hdev);
        if (!cmd)
                return;
 
@@ -7081,7 +7863,7 @@ void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
        struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
+       cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev);
        if (!cmd)
                return;
 
@@ -7094,7 +7876,7 @@ void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
        struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
+       cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev);
        if (!cmd)
                return;
 
@@ -7139,7 +7921,7 @@ static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr,
 {
        struct mgmt_pending_cmd *cmd;
 
-       cmd = mgmt_pending_find(opcode, hdev);
+       cmd = pending_find(opcode, hdev);
        if (!cmd)
                return -ENOENT;
 
@@ -7331,8 +8113,8 @@ void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class,
        mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match);
 
        if (!status)
-               mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 3,
-                          NULL);
+               mgmt_generic_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
+                                  dev_class, 3, NULL);
 
        if (match.sk)
                sock_put(match.sk);
@@ -7350,56 +8132,19 @@ void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status)
        memcpy(ev.name, name, HCI_MAX_NAME_LENGTH);
        memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH);
 
-       cmd = mgmt_pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
+       cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev);
        if (!cmd) {
                memcpy(hdev->dev_name, name, sizeof(hdev->dev_name));
 
                /* If this is a HCI command related to powering on the
                 * HCI dev don't send any mgmt signals.
                 */
-               if (mgmt_pending_find(MGMT_OP_SET_POWERED, hdev))
+               if (pending_find(MGMT_OP_SET_POWERED, hdev))
                        return;
        }
 
-       mgmt_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
-                  cmd ? cmd->sk : NULL);
-}
-
-void mgmt_read_local_oob_data_complete(struct hci_dev *hdev, u8 *hash192,
-                                      u8 *rand192, u8 *hash256, u8 *rand256,
-                                      u8 status)
-{
-       struct mgmt_pending_cmd *cmd;
-
-       BT_DBG("%s status %u", hdev->name, status);
-
-       cmd = mgmt_pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev);
-       if (!cmd)
-               return;
-
-       if (status) {
-               mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
-                               mgmt_status(status));
-       } else {
-               struct mgmt_rp_read_local_oob_data rp;
-               size_t rp_size = sizeof(rp);
-
-               memcpy(rp.hash192, hash192, sizeof(rp.hash192));
-               memcpy(rp.rand192, rand192, sizeof(rp.rand192));
-
-               if (bredr_sc_enabled(hdev) && hash256 && rand256) {
-                       memcpy(rp.hash256, hash256, sizeof(rp.hash256));
-                       memcpy(rp.rand256, rand256, sizeof(rp.rand256));
-               } else {
-                       rp_size -= sizeof(rp.hash256) + sizeof(rp.rand256);
-               }
-
-               mgmt_cmd_complete(cmd->sk, hdev->id,
-                                 MGMT_OP_READ_LOCAL_OOB_DATA, 0,
-                                 &rp, rp_size);
-       }
-
-       mgmt_pending_remove(cmd);
+       mgmt_generic_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev),
+                          cmd ? cmd->sk : NULL);
 }
 
 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16])
@@ -7643,7 +8388,8 @@ void mgmt_reenable_advertising(struct hci_dev *hdev)
 {
        struct hci_request req;
 
-       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING))
+       if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
+           !hci_dev_test_flag(hdev, HCI_ADVERTISING_INSTANCE))
                return;
 
        hci_req_init(&req, hdev);
@@ -7655,6 +8401,7 @@ static struct hci_mgmt_chan chan = {
        .channel        = HCI_CHANNEL_CONTROL,
        .handler_count  = ARRAY_SIZE(mgmt_handlers),
        .handlers       = mgmt_handlers,
+       .hdev_init      = mgmt_init_hdev,
 };
 
 int mgmt_init(void)