6 files changed, 319 insertions, 151 deletions

diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index 4afae20df512..9fe8a875a827 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -30,3 +30,5 @@ hci_uart-$(CONFIG_BT_HCIUART_LL)	+= hci_ll.o
 hci_uart-$(CONFIG_BT_HCIUART_ATH3K)     += hci_ath.o
 hci_uart-$(CONFIG_BT_HCIUART_3WIRE)     += hci_h5.o
 hci_uart-objs                           := $(hci_uart-y)
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/bluetooth/btmrvl_drv.h b/drivers/bluetooth/btmrvl_drv.h
index 27068d149380..f9d183387f45 100644
--- a/drivers/bluetooth/btmrvl_drv.h
+++ b/drivers/bluetooth/btmrvl_drv.h
@@ -23,6 +23,8 @@
 #include <linux/bitops.h>
 #include <linux/slab.h>
 #include <net/bluetooth/bluetooth.h>
+#include <linux/ctype.h>
+#include <linux/firmware.h>
 
 #define BTM_HEADER_LEN                  4
 #define BTM_UPLD_SIZE                   2312
@@ -41,6 +43,8 @@ struct btmrvl_thread {
 struct btmrvl_device {
         void *card;
         struct hci_dev *hcidev;
+        struct device *dev;
+        const char *cal_data;
 
         u8 dev_type;
 
@@ -91,6 +95,7 @@ struct btmrvl_private {
 #define BT_CMD_HOST_SLEEP_CONFIG        0x59
 #define BT_CMD_HOST_SLEEP_ENABLE        0x5A
 #define BT_CMD_MODULE_CFG_REQ           0x5B
+#define BT_CMD_LOAD_CONFIG_DATA         0x61
 
 /* Sub-commands: Module Bringup/Shutdown Request/Response */
 #define MODULE_BRINGUP_REQ              0xF1
@@ -116,11 +121,8 @@ struct btmrvl_private {
 #define PS_SLEEP                        0x01
 #define PS_AWAKE                        0x00
 
-struct btmrvl_cmd {
-        __le16 ocf_ogf;
-        u8 length;
-        u8 data[4];
-} __packed;
+#define BT_CMD_DATA_SIZE                32
+#define BT_CAL_DATA_SIZE                28
 
 struct btmrvl_event {
         u8 ec;          /* event counter */
diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index 9a9f51875df5..6e7bd4e4adbb 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -57,8 +57,7 @@ bool btmrvl_check_evtpkt(struct btmrvl_private *priv, struct sk_buff *skb)
                 ocf = hci_opcode_ocf(opcode);
                 ogf = hci_opcode_ogf(opcode);
 
-                if (ocf == BT_CMD_MODULE_CFG_REQ &&
-                                        priv->btmrvl_dev.sendcmdflag) {
+                if (priv->btmrvl_dev.sendcmdflag) {
                         priv->btmrvl_dev.sendcmdflag = false;
                         priv->adapter->cmd_complete = true;
                         wake_up_interruptible(&priv->adapter->cmd_wait_q);
@@ -116,7 +115,6 @@ int btmrvl_process_event(struct btmrvl_private *priv, struct sk_buff *skb)
                         adapter->hs_state = HS_ACTIVATED;
                         if (adapter->psmode)
                                 adapter->ps_state = PS_SLEEP;
-                        wake_up_interruptible(&adapter->cmd_wait_q);
                         BT_DBG("HS ACTIVATED!");
                 } else {
                         BT_DBG("HS Enable failed");
@@ -168,22 +166,24 @@ exit:
 }
 EXPORT_SYMBOL_GPL(btmrvl_process_event);
 
-int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+static int btmrvl_send_sync_cmd(struct btmrvl_private *priv, u16 cmd_no,
+                                const void *param, u8 len)
 {
         struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
+        struct hci_command_hdr *hdr;
 
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
+        skb = bt_skb_alloc(HCI_COMMAND_HDR_SIZE + len, GFP_ATOMIC);
         if (skb == NULL) {
                 BT_ERR("No free skb");
                 return -ENOMEM;
         }
 
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_MODULE_CFG_REQ));
-        cmd->length = 1;
-        cmd->data[0] = subcmd;
+        hdr = (struct hci_command_hdr *)skb_put(skb, HCI_COMMAND_HDR_SIZE);
+        hdr->opcode = cpu_to_le16(hci_opcode_pack(OGF, cmd_no));
+        hdr->plen = len;
+
+        if (len)
+                memcpy(skb_put(skb, len), param, len);
 
         bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
 
@@ -194,19 +194,23 @@ int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
 
         priv->adapter->cmd_complete = false;
 
-        BT_DBG("Queue module cfg Command");
-
         wake_up_interruptible(&priv->main_thread.wait_q);
 
         if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
                                 priv->adapter->cmd_complete,
-                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("module_cfg_cmd(%x): timeout: %d",
-                                        subcmd, priv->btmrvl_dev.sendcmdflag);
-        }
+                                msecs_to_jiffies(WAIT_UNTIL_CMD_RESP)))
+                return -ETIMEDOUT;
 
-        BT_DBG("module cfg Command done");
+        return 0;
+}
+
+int btmrvl_send_module_cfg_cmd(struct btmrvl_private *priv, int subcmd)
+{
+        int ret;
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_MODULE_CFG_REQ, &subcmd, 1);
+        if (ret)
+                BT_ERR("module_cfg_cmd(%x) failed\n", subcmd);
 
         return ret;
 }
@@ -214,61 +218,36 @@ EXPORT_SYMBOL_GPL(btmrvl_send_module_cfg_cmd);
 
 int btmrvl_send_hscfg_cmd(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (!skb) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                                   BT_CMD_HOST_SLEEP_CONFIG));
-        cmd->length = 2;
-        cmd->data[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
-        cmd->data[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
+        int ret;
+        u8 param[2];
 
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+        param[0] = (priv->btmrvl_dev.gpio_gap & 0xff00) >> 8;
+        param[1] = (u8) (priv->btmrvl_dev.gpio_gap & 0x00ff);
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
+        BT_DBG("Sending HSCFG Command, gpio=0x%x, gap=0x%x",
+               param[0], param[1]);
 
-        BT_DBG("Queue HSCFG Command, gpio=0x%x, gap=0x%x", cmd->data[0],
-               cmd->data[1]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_CONFIG, param, 2);
+        if (ret)
+                BT_ERR("HSCFG command failed\n");
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_send_hscfg_cmd);
 
 int btmrvl_enable_ps(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF,
-                                        BT_CMD_AUTO_SLEEP_MODE));
-        cmd->length = 1;
+        int ret;
+        u8 param;
 
         if (priv->btmrvl_dev.psmode)
-                cmd->data[0] = BT_PS_ENABLE;
+                param = BT_PS_ENABLE;
         else
-                cmd->data[0] = BT_PS_DISABLE;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
+                param = BT_PS_DISABLE;
 
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue PSMODE Command:%d", cmd->data[0]);
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_AUTO_SLEEP_MODE, &param, 1);
+        if (ret)
+                BT_ERR("PSMODE command failed\n");
 
         return 0;
 }
@@ -276,37 +255,11 @@ EXPORT_SYMBOL_GPL(btmrvl_enable_ps);
 
 int btmrvl_enable_hs(struct btmrvl_private *priv)
 {
-        struct sk_buff *skb;
-        struct btmrvl_cmd *cmd;
-        int ret = 0;
-
-        skb = bt_skb_alloc(sizeof(*cmd), GFP_ATOMIC);
-        if (skb == NULL) {
-                BT_ERR("No free skb");
-                return -ENOMEM;
-        }
-
-        cmd = (struct btmrvl_cmd *) skb_put(skb, sizeof(*cmd));
-        cmd->ocf_ogf = cpu_to_le16(hci_opcode_pack(OGF, BT_CMD_HOST_SLEEP_ENABLE));
-        cmd->length = 0;
-
-        bt_cb(skb)->pkt_type = MRVL_VENDOR_PKT;
-
-        skb->dev = (void *) priv->btmrvl_dev.hcidev;
-        skb_queue_head(&priv->adapter->tx_queue, skb);
-
-        BT_DBG("Queue hs enable Command");
-
-        wake_up_interruptible(&priv->main_thread.wait_q);
+        int ret;
 
-        if (!wait_event_interruptible_timeout(priv->adapter->cmd_wait_q,
-                        priv->adapter->hs_state,
-                        msecs_to_jiffies(WAIT_UNTIL_HS_STATE_CHANGED))) {
-                ret = -ETIMEDOUT;
-                BT_ERR("timeout: %d, %d,%d", priv->adapter->hs_state,
-                                                priv->adapter->ps_state,
-                                                priv->adapter->wakeup_tries);
-        }
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_HOST_SLEEP_ENABLE, NULL, 0);
+        if (ret)
+                BT_ERR("Host sleep enable command failed\n");
 
         return ret;
 }
@@ -480,6 +433,137 @@ static int btmrvl_open(struct hci_dev *hdev)
 }
 
 /*
+ * This function parses provided calibration data input. It should contain
+ * hex bytes separated by space or new line character. Here is an example.
+ * 00 1C 01 37 FF FF FF FF 02 04 7F 01
+ * CE BA 00 00 00 2D C6 C0 00 00 00 00
+ * 00 F0 00 00
+ */
+static int btmrvl_parse_cal_cfg(const u8 *src, u32 len, u8 *dst, u32 dst_size)
+{
+        const u8 *s = src;
+        u8 *d = dst;
+        int ret;
+        u8 tmp[3];
+
+        tmp[2] = '\0';
+        while ((s - src) <= len - 2) {
+                if (isspace(*s)) {
+                        s++;
+                        continue;
+                }
+
+                if (isxdigit(*s)) {
+                        if ((d - dst) >= dst_size) {
+                                BT_ERR("calibration data file too big!!!");
+                                return -EINVAL;
+                        }
+
+                        memcpy(tmp, s, 2);
+
+                        ret = kstrtou8(tmp, 16, d++);
+                        if (ret < 0)
+                                return ret;
+
+                        s += 2;
+                } else {
+                        return -EINVAL;
+                }
+        }
+        if (d == dst)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int btmrvl_load_cal_data(struct btmrvl_private *priv,
+                                u8 *config_data)
+{
+        int i, ret;
+        u8 data[BT_CMD_DATA_SIZE];
+
+        data[0] = 0x00;
+        data[1] = 0x00;
+        data[2] = 0x00;
+        data[3] = BT_CMD_DATA_SIZE - 4;
+
+        /* Swap cal-data bytes. Each four bytes are swapped. Considering 4
+         * byte SDIO header offset, mapping of input and output bytes will be
+         * {3, 2, 1, 0} -> {0+4, 1+4, 2+4, 3+4},
+         * {7, 6, 5, 4} -> {4+4, 5+4, 6+4, 7+4} */
+        for (i = 4; i < BT_CMD_DATA_SIZE; i++)
+                data[i] = config_data[(i / 4) * 8 - 1 - i];
+
+        print_hex_dump_bytes("Calibration data: ",
+                             DUMP_PREFIX_OFFSET, data, BT_CMD_DATA_SIZE);
+
+        ret = btmrvl_send_sync_cmd(priv, BT_CMD_LOAD_CONFIG_DATA, data,
+                                   BT_CMD_DATA_SIZE);
+        if (ret)
+                BT_ERR("Failed to download caibration data\n");
+
+        return 0;
+}
+
+static int
+btmrvl_process_cal_cfg(struct btmrvl_private *priv, u8 *data, u32 size)
+{
+        u8 cal_data[BT_CAL_DATA_SIZE];
+        int ret;
+
+        ret = btmrvl_parse_cal_cfg(data, size, cal_data, sizeof(cal_data));
+        if (ret)
+                return ret;
+
+        ret = btmrvl_load_cal_data(priv, cal_data);
+        if (ret) {
+                BT_ERR("Fail to load calibrate data");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int btmrvl_cal_data_config(struct btmrvl_private *priv)
+{
+        const struct firmware *cfg;
+        int ret;
+        const char *cal_data = priv->btmrvl_dev.cal_data;
+
+        if (!cal_data)
+                return 0;
+
+        ret = request_firmware(&cfg, cal_data, priv->btmrvl_dev.dev);
+        if (ret < 0) {
+                BT_DBG("Failed to get %s file, skipping cal data download",
+                       cal_data);
+                return 0;
+        }
+
+        ret = btmrvl_process_cal_cfg(priv, (u8 *)cfg->data, cfg->size);
+        release_firmware(cfg);
+        return ret;
+}
+
+static int btmrvl_setup(struct hci_dev *hdev)
+{
+        struct btmrvl_private *priv = hci_get_drvdata(hdev);
+
+        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+
+        if (btmrvl_cal_data_config(priv))
+                BT_ERR("Set cal data failed");
+
+        priv->btmrvl_dev.psmode = 1;
+        btmrvl_enable_ps(priv);
+
+        priv->btmrvl_dev.gpio_gap = 0xffff;
+        btmrvl_send_hscfg_cmd(priv);
+
+        return 0;
+}
+
+/*
  * This function handles the event generated by firmware, rx data
  * received from firmware, and tx data sent from kernel.
  */
@@ -572,8 +656,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
         hdev->flush = btmrvl_flush;
         hdev->send = btmrvl_send_frame;
         hdev->ioctl = btmrvl_ioctl;
-
-        btmrvl_send_module_cfg_cmd(priv, MODULE_BRINGUP_REQ);
+        hdev->setup = btmrvl_setup;
 
         hdev->dev_type = priv->btmrvl_dev.dev_type;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index 00da6df9f71e..332475e400cf 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -18,7 +18,6 @@
  * this warranty disclaimer.
  **/
 
-#include <linux/firmware.h>
 #include <linux/slab.h>
 
 #include <linux/mmc/sdio_ids.h>
@@ -102,6 +101,7 @@ static const struct btmrvl_sdio_card_reg btmrvl_reg_88xx = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
         .helper         = "mrvl/sd8688_helper.bin",
         .firmware       = "mrvl/sd8688.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_8688,
         .sd_blksz_fw_dl = 64,
 };
@@ -109,6 +109,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8688 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8787_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -116,6 +117,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8787 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8797_uapsta.bin",
+        .cal_data       = "mrvl/sd8797_caldata.conf",
         .reg            = &btmrvl_reg_87xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -123,6 +125,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8797 = {
 static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = {
         .helper         = NULL,
         .firmware       = "mrvl/sd8897_uapsta.bin",
+        .cal_data       = NULL,
         .reg            = &btmrvl_reg_88xx,
         .sd_blksz_fw_dl = 256,
 };
@@ -1006,6 +1009,7 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 struct btmrvl_sdio_device *data = (void *) id->driver_data;
                 card->helper = data->helper;
                 card->firmware = data->firmware;
+                card->cal_data = data->cal_data;
                 card->reg = data->reg;
                 card->sd_blksz_fw_dl = data->sd_blksz_fw_dl;
         }
@@ -1034,6 +1038,8 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
         }
 
         card->priv = priv;
+        priv->btmrvl_dev.dev = &card->func->dev;
+        priv->btmrvl_dev.cal_data = card->cal_data;
 
         /* Initialize the interface specific function pointers */
         priv->hw_host_to_card = btmrvl_sdio_host_to_card;
@@ -1046,12 +1052,6 @@ static int btmrvl_sdio_probe(struct sdio_func *func,
                 goto disable_host_int;
         }
 
-        priv->btmrvl_dev.psmode = 1;
-        btmrvl_enable_ps(priv);
-
-        priv->btmrvl_dev.gpio_gap = 0xffff;
-        btmrvl_send_hscfg_cmd(priv);
-
         return 0;
 
 disable_host_int:
@@ -1222,4 +1222,5 @@ MODULE_FIRMWARE("mrvl/sd8688_helper.bin");
 MODULE_FIRMWARE("mrvl/sd8688.bin");
 MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin");
 MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin");
+MODULE_FIRMWARE("mrvl/sd8797_caldata.conf");
 MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin");
diff --git a/drivers/bluetooth/btmrvl_sdio.h b/drivers/bluetooth/btmrvl_sdio.h
index 43d35a609ca9..6872d9ecac07 100644
--- a/drivers/bluetooth/btmrvl_sdio.h
+++ b/drivers/bluetooth/btmrvl_sdio.h
@@ -85,6 +85,7 @@ struct btmrvl_sdio_card {
         u32 ioport;
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
         u8 rx_unit;
@@ -94,6 +95,7 @@ struct btmrvl_sdio_card {
 struct btmrvl_sdio_device {
         const char *helper;
         const char *firmware;
+        const char *cal_data;
         const struct btmrvl_sdio_card_reg *reg;
         u16 sd_blksz_fw_dl;
 };
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index d8b7aed6e4a9..c04a3e6fb37c 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -24,6 +24,7 @@
  */
 
 #include <linux/module.h>
+#include <asm/unaligned.h>
 
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -39,17 +40,17 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-#define VERSION "1.3"
+#define VERSION "1.4"
 
 static bool amp;
 
 struct vhci_data {
         struct hci_dev *hdev;
 
-        unsigned long flags;
-
         wait_queue_head_t read_wait;
         struct sk_buff_head readq;
+
+        struct delayed_work open_timeout;
 };
 
 static int vhci_open_dev(struct hci_dev *hdev)
@@ -99,16 +100,62 @@ static int vhci_send_frame(struct sk_buff *skb)
         skb_queue_tail(&data->readq, skb);
 
         wake_up_interruptible(&data->read_wait);
+        return 0;
+}
+
+static int vhci_create_device(struct vhci_data *data, __u8 dev_type)
+{
+        struct hci_dev *hdev;
+        struct sk_buff *skb;
+
+        skb = bt_skb_alloc(4, GFP_KERNEL);
+        if (!skb)
+                return -ENOMEM;
+
+        hdev = hci_alloc_dev();
+        if (!hdev) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        data->hdev = hdev;
+
+        hdev->bus = HCI_VIRTUAL;
+        hdev->dev_type = dev_type;
+        hci_set_drvdata(hdev, data);
+
+        hdev->open  = vhci_open_dev;
+        hdev->close = vhci_close_dev;
+        hdev->flush = vhci_flush;
+        hdev->send  = vhci_send_frame;
 
+        if (hci_register_dev(hdev) < 0) {
+                BT_ERR("Can't register HCI device");
+                hci_free_dev(hdev);
+                data->hdev = NULL;
+                kfree_skb(skb);
+                return -EBUSY;
+        }
+
+        bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
+
+        *skb_put(skb, 1) = 0xff;
+        *skb_put(skb, 1) = dev_type;
+        put_unaligned_le16(hdev->id, skb_put(skb, 2));
+        skb_queue_tail(&data->readq, skb);
+
+        wake_up_interruptible(&data->read_wait);
         return 0;
 }
 
 static inline ssize_t vhci_get_user(struct vhci_data *data,
-                                        const char __user *buf, size_t count)
+                                    const char __user *buf, size_t count)
 {
         struct sk_buff *skb;
+        __u8 pkt_type, dev_type;
+        int ret;
 
-        if (count > HCI_MAX_FRAME_SIZE)
+        if (count < 2 || count > HCI_MAX_FRAME_SIZE)
                 return -EINVAL;
 
         skb = bt_skb_alloc(count, GFP_KERNEL);
@@ -120,27 +167,70 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
                 return -EFAULT;
         }
 
-        skb->dev = (void *) data->hdev;
-        bt_cb(skb)->pkt_type = *((__u8 *) skb->data);
+        pkt_type = *((__u8 *) skb->data);
         skb_pull(skb, 1);
 
-        hci_recv_frame(skb);
+        switch (pkt_type) {
+        case HCI_EVENT_PKT:
+        case HCI_ACLDATA_PKT:
+        case HCI_SCODATA_PKT:
+                if (!data->hdev) {
+                        kfree_skb(skb);
+                        return -ENODEV;
+                }
+
+                skb->dev = (void *) data->hdev;
+                bt_cb(skb)->pkt_type = pkt_type;
+
+                ret = hci_recv_frame(skb);
+                break;
+
+        case HCI_VENDOR_PKT:
+                if (data->hdev) {
+                        kfree_skb(skb);
+                        return -EBADFD;
+                }
 
-        return count;
+                cancel_delayed_work_sync(&data->open_timeout);
+
+                dev_type = *((__u8 *) skb->data);
+                skb_pull(skb, 1);
+
+                if (skb->len > 0) {
+                        kfree_skb(skb);
+                        return -EINVAL;
+                }
+
+                kfree_skb(skb);
+
+                if (dev_type != HCI_BREDR && dev_type != HCI_AMP)
+                        return -EINVAL;
+
+                ret = vhci_create_device(data, dev_type);
+                break;
+
+        default:
+                kfree_skb(skb);
+                return -EINVAL;
+        }
+
+        return (ret < 0) ? ret : count;
 }
 
 static inline ssize_t vhci_put_user(struct vhci_data *data,
-                        struct sk_buff *skb, char __user *buf, int count)
+                                    struct sk_buff *skb,
+                                    char __user *buf, int count)
 {
         char __user *ptr = buf;
-        int len, total = 0;
+        int len;
 
         len = min_t(unsigned int, skb->len, count);
 
         if (copy_to_user(ptr, skb->data, len))
                 return -EFAULT;
 
-        total += len;
+        if (!data->hdev)
+                return len;
 
         data->hdev->stat.byte_tx += len;
 
@@ -148,21 +238,19 @@ static inline ssize_t vhci_put_user(struct vhci_data *data,
         case HCI_COMMAND_PKT:
                 data->hdev->stat.cmd_tx++;
                 break;
-
         case HCI_ACLDATA_PKT:
                 data->hdev->stat.acl_tx++;
                 break;
-
         case HCI_SCODATA_PKT:
                 data->hdev->stat.sco_tx++;
                 break;
         }
 
-        return total;
+        return len;
 }
 
 static ssize_t vhci_read(struct file *file,
-                                char __user *buf, size_t count, loff_t *pos)
+                         char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
         struct sk_buff *skb;
@@ -185,7 +273,7 @@ static ssize_t vhci_read(struct file *file,
                 }
 
                 ret = wait_event_interruptible(data->read_wait,
-                                        !skb_queue_empty(&data->readq));
+                                               !skb_queue_empty(&data->readq));
                 if (ret < 0)
                         break;
         }
@@ -194,7 +282,7 @@ static ssize_t vhci_read(struct file *file,
 }
 
 static ssize_t vhci_write(struct file *file,
-                        const char __user *buf, size_t count, loff_t *pos)
+                          const char __user *buf, size_t count, loff_t *pos)
 {
         struct vhci_data *data = file->private_data;
 
@@ -213,10 +301,17 @@ static unsigned int vhci_poll(struct file *file, poll_table *wait)
         return POLLOUT | POLLWRNORM;
 }
 
+static void vhci_open_timeout(struct work_struct *work)
+{
+        struct vhci_data *data = container_of(work, struct vhci_data,
+                                              open_timeout.work);
+
+        vhci_create_device(data, amp ? HCI_AMP : HCI_BREDR);
+}
+
 static int vhci_open(struct inode *inode, struct file *file)
 {
         struct vhci_data *data;
-        struct hci_dev *hdev;
 
         data = kzalloc(sizeof(struct vhci_data), GFP_KERNEL);
         if (!data)
@@ -225,35 +320,13 @@ static int vhci_open(struct inode *inode, struct file *file)
         skb_queue_head_init(&data->readq);
         init_waitqueue_head(&data->read_wait);
 
-        hdev = hci_alloc_dev();
-        if (!hdev) {
-                kfree(data);
-                return -ENOMEM;
-        }
-
-        data->hdev = hdev;
-
-        hdev->bus = HCI_VIRTUAL;
-        hci_set_drvdata(hdev, data);
-
-        if (amp)
-                hdev->dev_type = HCI_AMP;
-
-        hdev->open     = vhci_open_dev;
-        hdev->close    = vhci_close_dev;
-        hdev->flush    = vhci_flush;
-        hdev->send     = vhci_send_frame;
-
-        if (hci_register_dev(hdev) < 0) {
-                BT_ERR("Can't register HCI device");
-                kfree(data);
-                hci_free_dev(hdev);
-                return -EBUSY;
-        }
+        INIT_DELAYED_WORK(&data->open_timeout, vhci_open_timeout);
 
         file->private_data = data;
         nonseekable_open(inode, file);
 
+        schedule_delayed_work(&data->open_timeout, msecs_to_jiffies(1000));
+
         return 0;
 }
 
@@ -262,8 +335,12 @@ static int vhci_release(struct inode *inode, struct file *file)
         struct vhci_data *data = file->private_data;
         struct hci_dev *hdev = data->hdev;
 
-        hci_unregister_dev(hdev);
-        hci_free_dev(hdev);
+        cancel_delayed_work_sync(&data->open_timeout);
+
+        if (hdev) {
+                hci_unregister_dev(hdev);
+                hci_free_dev(hdev);
+        }
 
         file->private_data = NULL;
         kfree(data);
@@ -309,3 +386,4 @@ MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth virtual HCI driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("devname:vhci");